ThreatWing Decompiler walkthrough
Your first Decompiler run
The Decompiler is in a hosted beta. Approved users can open the Decompiler console with their existing tenant API key. Do not send binaries to support.
Open the console, enter your tenant API key, and select Load my jobs. Your existing jobs remain in the same workspace. Under New analysis, choose a file and Decompiler workflow, review Before you upload, confirm authorization and processing terms, and select Submit processing job. Processing needs an active beta approval as well as a valid key.
Confirm permission
Record why you are allowed to analyze the file and any limits on that work.
Keep the original
Analyze a copy. Record the source, acquisition time, filename, size, and SHA-256 hash.
Read the processing notice
Check where the file will run, who can access it, and how storage, retention, and deletion work. Stop if the notice is missing or conflicts with your agreement.
Compare the file hash
The service’s SHA-256 must match your copy. Stop for any mismatch.
Select the profile
Choose the supported format and architecture profile. Record its version and time limit. Do not add shell commands or custom analyzer arguments.
Read the result and warnings
Start with classification and file details, then strings, imports, control flow, and pseudocode. Read timeouts and skipped-stage notices before using a result. Recovered code is an approximation.
Verify and save the report
Check the input hash, analyzer version, warnings, and output hashes against the run record. Inspect exports for sensitive information, keep them for the agreed period, and request deletion through the support channel in your beta agreement when finished; the console has no self-service deletion button.
Stop and ask for help
Stop for a mismatched hash, unsupported file shown as successfully analyzed, unexpected profile version, or missing processing notice. Have a qualified reviewer check conclusions outside your expertise.