joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13a5a26
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg dword [esp + 0xc], ecx
mov word [esp + 0xa], dx
pop word [esp + 3]
lea esp, [esp + 9]
not dx
jmp 0x13a5a10
mov byte [esp], dh
bswap ebx
sub esp, 3
mov cx, sp
std
xchg dword [esp + 2], esi
jmp 0x13a5a60
sub esp, 0
not cx
pop eax
mov cl, byte [esp + 0xc]
std
jmp 0x13a59dc
pop word [esp + 7]
bsr si, ax
pop word [esp + 3]
bsr ebp, ebp
rdtsc
sub esp, 7
jmp 0x13a5a86
sub esp, 9
inc dh
not ah
xchg cx, si
mov dh, 0xc0
pop bx
jmp 0x13a5a34
mov di, bp
pop word [esp + 5]
pop dword [esp + 5]
mov si, word [esp + 8]
call fcn.013a5a70
mov byte [esp + 0x10], bl
setp ch
mov bh, 0x53
cmp eax, ecx
pop eax
pop word [esp + 0xa]
jmp 0x13a5ac1
push dword [esp + 6]
shl dh, cl
pushal
sub esp, 0x1c
lea esp, [esp + 0x4d]
dec cx
jmp 0x13a5b4a
rdtsc
lea ecx, [esp + eax]
bsf ecx, esi
pop bx
xchg byte [esp + 5], al
bsr ecx, ebp
call fcn.013a5b2b
loop 0x13a5b1e
sbb eax, 0x8afc7f6c
loopne 0x13a5a8a
insb byte es:[edi], dx
jg 0x13a5b00
cld
mov ah, al
sub esp, 7
in al, dx
pop es
pop ebp
push word [esp + 1]
push dword [esp + 2]
jmp 0x13a5ae9
retf
mov cl, byte [esp]
mov edx, edi
dec dl
mov bx, 0x2382
xchg ch, dl
rdtsc
jmp 0x13a5b03

Function at 0x13a5cf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1f]
setae dl
shr al, 5
xchg cl, al
bswap ecx
lea esp, [esp]
jmp 0x13a5d0c
lea eax, [edi - 0xa9]
xchg byte [esp + 0xe], dh
lea eax, [edi*4]
xchg bh, dl
inc bp
jmp 0x13a5cdd
push si
add esp, 2
not ebx
stc
lea ebx, [edx*4]
jmp 0x13a5e1f
xchg dx, si
cpuid
rdtsc
sete dl
setbe ch
xchg byte [esp], cl
jmp 0x13a5d30
rdtsc
not si
setl ah
pushal
push word [esp + 1]
popal
jmp 0x13a5d46
add esp, 0
mov cx, bx
mov esi, ecx
mov byte [esp], cl
cpuid
setnp al
jmp 0x13a5d66
Function at 0x13a5db1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [eax + edx]
jmp 0x13a5df3
mov bh, byte [esp + 8]
mov ah, 0x5a
lea esp, [esp]
mov si, 0x7b2f
jmp 0x13a5e08
pop eax
lea ecx, [eax + eax]
lea eax, [ebx*4]
xchg dl, cl
not bx
sub esp, 6
jmp 0x13a5ddd
mov dx, word [esp + 7]
pop dword [esp + 1]
pop word [esp]
mov ch, 0xa7
jmp 0x13a5e71
rdtsc
sub cl, 0x3c
bsf ebx, ecx
call 0x13a5e34
pushal
lea esp, [esp + 0x48]
mov bx, word [esp]
call fcn.013a5f00
push edx
jecxz 0x13a5edb
push ss
in eax, 1
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
in eax, 0x83
in al, dx
push ds
sub esp, 0x1e
rdtsc
bsf eax, edi
add ah, bl
mov al, byte [esp + 0xd]
pop dword [esp + 0x13]
jmp 0x13a5e4a
add byte [ebx - 0x2809ff3c], al
mov dx, word [esp]
lea esp, [esp]
mov bp, word [esp]
jmp 0x13a5f0e
bt bx, ax
ror al, 4
bsf ax, bp
mov bh, byte [esp]
shl ecx, cl
mov bx, dx
jmp 0x13a5f98
xchg edx, edi
call fcn.013a5f52
xchg byte [esp], cl
xchg dh, al
mov ax, word [esp]
lea ebp, [esi*4]
jmp 0x13a5fe0
and cx, bx
mov byte [esp], cl
push sp
mov word [esp], dx
mov word [esp], cx
xchg word [esp], ax
jmp 0x13a6116
mov cx, word [esp + 1]
xchg al, dl
pop ax
neg cl
mov ah, 0x47
call fcn.013a6010
pop di
mov bl, byte [esp + 2]
xchg dword [esp + 0x14], esi
push word [esp + 0x1c]
jmp 0x13a6188
push dword [esp + 0x1e]
mov ecx, 0x5b313078
xchg al, dh
xchg dword [esp + 0xf], ebx
xchg ecx, eax
jmp 0x13a619a
rol dl, cl
neg ebp
bsf edi, eax
mov bh, 0x30
bsf esi, ecx
push dword [esp + 1]
jmp 0x13a6172
push di
bswap eax
setno dh
mov dl, bl
lea ebx, [eax + ebp]
mov ax, word [esp + 8]
jmp 0x13a7830
mov dword [esp + 0x12], ebx
mov dh, 0xce
rcl dx, cl
neg cx
jmp 0x13a656b
xchg word [esp + 4], cx
xchg ah, ch
mov esi, dword [esp + 0xe]
sub esp, 8
bswap ebp
jmp 0x13a61da
xchg word [esp + 4], di
bsr bx, si
push eax
neg dx
xchg cx, bx
bswap ebp
jmp 0x13a61f0
dec al
push di
mov bh, ch
mov eax, esi
call fcn.013a62bc
lea ecx, [ecx*4]
mov dword [esp + 0xf], esp
bt esi, esp
cpuid
mov ah, 0xf8
lea ecx, reloc.kernel32.dll_GetProcAddress
jmp 0x13a64bd
xchg dword [esp + 0xb], ecx
rol di, 0xe
lea esi, reloc.kernel32.dll_GetProcAddress
std
mov di, 0xb56
popal
jmp 0x13a6208
pop dword [esp + 0x1a]
mov dl, 0x23
lea edx, [esp + ecx]
ror bx, 3
xchg ebp, eax
sub esp, 5
jmp 0x13a72fc

Function at 0x13a5f52
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
pop esi
add esp, 0
shl ecx, 0xc
mov dh, byte [esp]
jmp 0x13a5f3c
Function at 0x13a6010
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, di
add esp, 0
cmp bp, 0x5999
jmp 0x13a6079
lea esp, [esp + 4]
jmp 0x13a5ffa
xchg byte [esp + 1], ah
cld
mov di, bx
rcr al, cl
bswap eax
jmp 0x13a6055
mov ebp, eax
bsf eax, ebp
mov dl, byte [esp + 1]
setns dl
lea esi, [eax - 0xf6]
jmp 0x13a6016
bts edx, esp
std
clc
push bx
rdtsc
lea ecx, reloc.kernel32.dll_GetProcAddress
jmp 0x13a602c
lea edx, [esi - 0xe6]
sub esp, 0x17
mov bh, byte [esp + 6]
mov word [esp + 2], di
btr ebp, eax
bswap ecx
jmp 0x13a60ce
lea ebx, reloc.kernel32.dll_GetProcAddress
stc
mov ebx, dword [esp]
xchg di, cx
dec ebp
rol edi, 6
jmp 0x13a6044
push dword [esp + 0x13]
xchg ah, bl
btc dx, sp
pushfd
mov bx, 0xfb9d
jmp 0x13a60fb
mov esi, dword [esp + 0x14]
cpuid
lea ebp, reloc.kernel32.dll_GetProcAddress
lea ebx, [edx*4]
mov bp, word [esp + 8]
mov dword [esp + 0x10], eax
jmp 0x13a608c
mov al, byte [esp + 0x18]
ror cl, 2
lea edi, [edi*4]
mov dx, ax
pop si
xchg bl, cl
jmp 0x13a60a2
neg edi
xchg word [esp + 4], bx
push dword [esp]
xchg bh, dh
add esp, 2
jmp 0x13a61c1
bsr bp, bx
pop edi
mov edi, 0xd29a681e
cmc
mov dx, 0xf4ce
pushfd
jmp 0x13a60e5
mov dl, dh
bswap ecx
cld
pushfd
rdtsc
not bh
jmp 0x13a6128
lea esp, [esp + 0xd]
rdtsc
xchg cx, di
pop edx
mov byte [esp + 7], dh
mov bh, byte [esp + 0x1c]
jmp 0x13a613e
lea edi, reloc.kernel32.dll_GetProcAddress
mov si, bx
lea edi, [ebx + ebx]
pop dword [esp + 0x16]
mov byte [esp + 0x12], ch
sub esp, 0x11
jmp 0x13a615e

Function at 0x13a66ea
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.013a6073
jmp 0x13a6769
mov eax, dword [eax + 0xc]
jmp 0x13a6781
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
mov eax, dword fs:[0x30]
jmp 0x13a6753
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x13a680e
mov eax, dword [eax + 8]
push eax
jmp 0x13a606e

Function at 0x13a6b07
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xe], al
xchg word [esp + 5], di
std
mov edi, ecx
mov edx, 0xa581b789
cpuid
rcl al, 6
std
jmp 0x13a6734
jmp 0x13a679b

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x548c0f09
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x6bb9466e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4037bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x4037cf
mov eax, 0
jmp 0x40382f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4037e8
mov eax, 0
jmp 0x40382f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40380b
mov eax, 0
jmp 0x40382f
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x16]
mov word [ebp - 0xa], ax
movzx eax, word [ebp - 0xa]
and eax, 0x2000
test eax, eax
jne 0x40382a
mov eax, 0
jmp 0x40382f
mov eax, 1
leave
ret
Function at 0x403a28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0x10]
mov word [ebp - 0x3c], ax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004037bc
test eax, eax
jne 0x403a4e
mov eax, 0
jmp 0x403ba5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0x78
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
test eax, eax
je 0x403a80
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
jne 0x403a8a
mov eax, 0
jmp 0x403ba5
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x403b43
mov dword [ebp - 0x10], 0
jmp 0x403b36
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x2c]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.00402b44
cmp dword [ebp + 0xc], eax
jne 0x403b32
mov eax, dword [ebp - 0x10]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x403b67
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 0x10], eax
jb 0x403ae0
jmp 0x403b67
movzx edx, word [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
sub edx, eax
mov eax, edx
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403b74
mov eax, 0
jmp 0x403ba5
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
cmp edx, eax
jb 0x403ba2
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
add edx, eax
mov eax, dword [ebp - 0xc]
cmp edx, eax
jbe 0x403ba2
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004038bb
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x406ad0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0x41b4e8
mov dword [ebp - 0x18], 0x41b50c
mov dword [esp + 0xc], 1
mov dword [esp + 8], 2
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00403e24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406b7c
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00406be0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406b7f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00406ba0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406b82
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov dword [ebp - 0xc], 1
jmp 0x406b83
nop
jmp 0x406b83
nop
jmp 0x406b83
nop
cmp dword [ebp - 0xc], 0
jne 0x406b9b
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x406b9b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0040308b
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4073dc
Capabilities:
Acquire debug privileges
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0x41b4e8
mov dword [ebp - 0x10], 0x41b588
mov dword [esp + 0xc], 2
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x41b5c4
call fcn.00406ad0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407467
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str.Could_not_impersonate_SYSTEM
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40746c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.S_1_5_19
call fcn.00406ad0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4074ea
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str.Could_not_impersonate_LOCAL_SERVICE
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x409daf
Capabilities:
Acquire debug privileges
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], str.SeDebugPrivilege
mov dword [ebp - 0x10], str.SeImpersonatePrivilege
mov dword [esp + 0xc], 1
mov dword [esp + 8], 2
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00403e24
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x409dfd
mov eax, 0
jmp 0x409e5e
call fcn.004044a8
test eax, eax
jne 0x409e59
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2a
mov dword [esp + 4], 1
mov dword [esp], str.The_Windows_version_must_be_6.3_or_greater
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, 0
jmp 0x409e5e
mov eax, 1
leave
ret

Function at 0x40a330
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040b0f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040b0f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x40a390
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41d39c]
test esi, esi
jle 0x40a490
mov eax, dword [0x41d3a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40a3c0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40a43f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40a3b0
mov dword [esp], ebx
call fcn.0040ad00
mov edi, eax
test eax, eax
je 0x40a4b7
mov eax, dword [0x41d3a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040ae10
mov edx, dword [0x41d3a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40a497
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40a438
sub eax, 4
and eax, 0xfffffffb
jne 0x40a446
add dword [0x41d39c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x41d3a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40a438
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040a330
xor esi, esi
jmp 0x40a3ca
mov eax, dword [0x41d3a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040a330
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040a330
lea esi, [esi]
nop

Function at 0x40a970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41d3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41d3b0]
sub esp, 4
test ebx, ebx
je 0x40a9c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40a9be
test esi, esi
je 0x40a9be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40a9a0
mov dword [esp], 0x41d3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0xa4417cf
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x59af624b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x12332ff
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esi, [ecx + esi - 0x810279]
inc esp
sub edi, ecx
inc esp
movzx esp, byte [esi + ecx*4 - 0x20409e0]
inc ebp
movzx esi, bh
inc ebp
xor ah, bl
dec eax
shl ecx, 0x2f
and cx, cx
inc ecx
sbb ah, 0x91
inc cx
not edi
dec ebp
lea ebp, [edi + eax*4 + 0x7ba7f51f]
inc ecx
ror ah, 1
dec ecx
shl edi, 0xe3
inc ecx
not ah
inc ecx
inc ah
jmp 0x176f3b0
inc esi
xor dword [esp + esi*8 + 0x18], esp
dec esi
mov ebx, dword [esp + esi + 0x18]
call fcn.01241ec9
movzx edx, byte [esi - 2]
shr byte [esp + 2], 0x45
setns cl
or byte [esp], ch
xor dl, bl
sar dword [esp], cl
jnp 0x134320a
mov word [ecx], ax
call fcn.0120adb3
rol cx, 0x42
inc ecx
ror esi, 1
jmp 0x1745384
neg dl
mov eax, ecx
or ecx, eax
sbb cl, 0x35
sub dl, al
sal word [esp + 1], cl
not dl
sub al, al
adc dl, 0xa6
rol ecx, 0x39
push ecx
dec al
xor bl, dl
jmp 0x1778f83
inc ebp
lea esi, [esi + ecx*4 + 0x3fabe207]
inc ecx
not esi
inc ecx
movsx ebp, dx
dec eax
and ebp, eax
inc ecx
push ebx
dec eax
lea ecx, [ecx + ebx*8 + 0xea6b280]
dec esp
lea ebx, [eax*2 + 0x31bbffb3]
inc esp
xor dword [esp + ecx*2 - 0x1d52a510], esi
bswap eax
inc ecx
pop ebx
dec eax
and ecx, 0xd0918ebf
neg cl
dec ebp
arpl si, si
dec ecx
xchg edx, ebx
dec ecx
add edi, esi
inc ebp
mov eax, dword [ecx + ecx*2 - 0x10204f0]
dec esp
lea edi, [ebp + ebp*2 - 0x3e998c4]
dec eax
add eax, ebp
dec ebp
lea ecx, [ecx + ecx*2 - 0x10204ec]
inc ecx
inc dl
jg 0x122e62a
movsx edx, bp
dec eax
rol ebx, 0xdb
inc ecx
neg ah
call fcn.013744dc

Function at 0x1271df3
Capabilities:
Get number of processors

Disassembly:
neg dl
mov eax, 0x9e238a1b
movzx ecx, al
dec dl
add cx, cx
not dl
adc dl, 0xa6
rol ax, 0x28
pop eax
lea ecx, [ecx + ecx + 0x19ab4e9d]
xor bl, dl
add edx, esp
ror cx, 0xa4
movzx eax, cx
mov ecx, dword [edx + ecx*2 - 0x335729e0]
movzx edx, ax
shr eax, 0xc9
xor eax, eax
mov dword [eax + ebp - 4], ecx
and edx, 0xecb34331
push edx
sar eax, 0x88
mov edx, dword [esi + eax*2 - 5]
xchg dword [esp + eax*4], eax
lea esi, [esi + eax*8 - 0x185]
lea ecx, [eax - 0x64ebf2d4]
xor edx, ebx
not edx
or dword [esp + eax - 0x30], eax
jne 0x132c6ae
dec ecx
mov ebx, dword [ecx]
mov eax, 0x47bc6c3f
inc esp
movsx esi, al
dec ebx
mov edx, dword [esi + ecx - 0x37]
dec ebp
lea ecx, [ecx + eax - 0x47bc6c2f]
dec eax
mov dword [ebx + eax - 0x47bc6c3f], edx
dec eax
lea edx, [eax + eax*2 - 0x156617f9]
inc ecx
xor dh, 0xa3
inc ecx
movsx ebx, si
dec ecx
lea esi, [esi + esi - 0xa0]
dec esp
or esi, ebx
inc esp
mov esp, dword [eax + esi - 0x47bc6c3f]
inc ebp
xor esp, ebx
inc ecx
rol esp, 1
inc edi
lea esp, [esi - 0x400040bf]
inc ecx
xor esp, 0x2af6621
inc ecx
not esp
inc ecx
mov eax, 0x57071a91
movsx ecx, dx
inc ecx
ror esp, 2
inc ecx
push ebx
xadd ax, bx
inc esp
movsx ebp, ax
inc esp
xor dword [esp + eax - 0x47bc6cdb], esp
inc ecx
pop ebx
inc ebp
mov edi, eax
dec ebp
arpl sp, sp
add cx, 0x2e3d
call fcn.013857a6
mov dword [esp + eax - 0x30], eax
xor edx, 0xaa2dba91
or ax, word [esp + eax - 0x2f]
lea edx, [edx + eax - 0x3e98094b]
sbb dword [esp + eax - 0x30], eax
neg edx
xadd word [esp + eax - 0x30], cx
bswap edx
setne al
call fcn.017562a4