joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432950
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0x158], eax
mov eax, dword [0x4c95a8]
mov ecx, dword [0x4c8930]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4329a5
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.00468d81
mov eax, 0x4c95a4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4c95a8
call fcn.00468dc7
add esp, 4
cmp dword [0x4c95a8], 0xffffffff
jne 0x43298a
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.0046c5c0
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea edi, [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.00468d16
add esp, 4
mov esi, eax
mov ebx, dword [esp + 0xc]
mov eax, dword [0x4c95d0]
mov ecx, dword [0x4c8930]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x432a54
mov ecx, esi
push ebx
push 0x4c95ac
push edi
call fcn.00432bb0
mov dword [0x4c95a4], esi
push 0x4c95a8
call fcn.00468e3d
add esp, 4
jmp 0x43298a
push 0x4c95d0
call fcn.00468dc7
add esp, 4
cmp dword [0x4c95d0], 0xffffffff
jne 0x432a2e
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x4c95cc], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x4c95bc], xmm1
movups xmmword [0x4c95ac], xmm0
push 0x4c95d0
call fcn.00468e3d
add esp, 4
jmp 0x432a2e

Function at 0x432ad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x4c95d0]
mov ecx, dword [0x4c8930]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x432b44
movzx eax, word [0x4c95ac]
cmp eax, 0xc
ja case.0x432b10.1
xor esi, esi
jmp dword [eax*4 + 0x4977a4]
mov esi, 2
jmp case.0x432b10.0
mov esi, 4
jmp case.0x432b10.0
mov esi, 1
jmp case.0x432b10.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00468d81
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4c95d0
call fcn.00468dc7
add esp, 4
cmp dword [0x4c95d0], 0xffffffff
jne 0x432b02
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x4c95cc], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x4c95bc], xmm1
movups xmmword [0x4c95ac], xmm0
push 0x4c95d0
call fcn.00468e3d
add esp, 4
jmp 0x432b02
Function at 0x433450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x433467
mov eax, dword [esi]
mov ecx, eax
jmp 0x43348c
mov eax, dword [esi]
test eax, eax
je 0x433471
mov ecx, eax
jmp 0x43348c
cmp dword [esi + 0xc], 0
je 0x43347d
mov ecx, eax
xor eax, eax
jmp 0x43348c
mov ecx, eax
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x4334e3
add ecx, 1
cmp ecx, 2
jb 0x4334ab
call fcn.0041fa40
push dword [esi]
call fcn.004266b0
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x4334d1
call fcn.0041fa40
push dword [esi + 4]
call fcn.004266b0
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x43352c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x433510
call fcn.0041fa40
push dword [esi]
call fcn.004266b0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43351f
mov dword [esi], ebx
call fcn.0041fa40
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x433577
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
add eax, 1
cmp eax, 2
jb 0x43355d
call fcn.0041fa40
push dword [esi + 4]
call fcn.004266b0
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43356d
mov dword [esi + 4], ebx
call fcn.0041fa40
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4397e8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x439811
mov eax, dword [ecx + 4]
test eax, eax
je 0x439838
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x439838
cmp edi, 2
mov eax, 0x4c9876
mov ecx, 0x4c9a76
cmove ecx, eax
cmp word [ecx], 0
je 0x43984b
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00468d81
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x439838
cmp byte [0x4c9874], 0
setne al
bt ebx, 8
jb 0x439838
shr ebx, 9
and ebx, 1
or bl, al
je 0x439838
cmp edi, 2
mov eax, 0x49844c
mov edx, 0x498460
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x4398aa
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x4398af
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x4398fd
push ebx
push dword [edx]
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
call fcn.0047b2a7
mov edx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x43990d
add edx, 0x14
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x4398d0
jmp 0x439977
movzx ecx, word [esi + ebx*2]
cmp cx, 0x5c
je 0x43991c
test cx, cx
jne 0x4398fd
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x43993c
cmp ebx, 2
mov esi, ebx
jne 0x43994a
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x43994a
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 0xc], esi
cmp cx, 0x5c
jne 0x439963
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x439954
jmp 0x439965
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov edx, eax
mov eax, edi
jmp 0x439905
cmp dword [esp + 0xc], 0
je 0x439838
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x43998f
mov eax, ecx
jmp 0x439991
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.0041a44c
jmp 0x439838
Function at 0x43b160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4c6f50]
xor ecx, ebp
mov dword [ebp - 8], ecx
cmp eax, 3
jne 0x43b21e
mov dword [ebp - 0x14], 0x43b240
lea eax, [ebp - 0x14]
push 0
push eax
push 0x43b140
push 0x4c9e90
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x43b230
cmp dword [0x4c9e94], 0
jne 0x43b21e
push dword [0x4c9e98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43b21e
mov esi, eax
push 0x4c9e9c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x4c9ea8]
mov dword [ebp - 0xc], eax
movsd xmm0, qword [0x4c9ea0]
movsd qword [ebp - 0x14], xmm0
push 0x4c9e9c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43b1f7
push dword [esi]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x43b206
push dword [esi + 4]
call eax
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43b215
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.0042c6b0
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00468d81
add esp, 0x10
pop esi
pop ebp
ret 0xc
call fcn.004790d4
int3
Function at 0x44ab80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x24], edx
push edx
push ecx
push edi
call fcn.004246f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x44abaf
mov edi, dword [ebp - 0x1c]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x44abcd
push dword [ebp - 0x1c]
call fcn.00468d46
add esp, 4
cmp dword [ebp + 8], 0
je 0x44acac
test esi, esi
je 0x44acac
mov dword [ebp - 0x20], esi
add esi, esi
mov ecx, 0xffffffff
cmovae ecx, esi
push ecx
call fcn.00468d73
add esp, 4
mov edi, eax
lea esi, [ebp - 0x1c]
push dword [ebp - 0x24]
push ebx
push esi
call fcn.004246f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x44ac10
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x44ac2c
push dword [ebp - 0x1c]
call fcn.00468d46
add esp, 4
cmp word [edi], 0
mov esi, dword [ebp + 8]
je 0x44ac4f
xor ecx, ecx
nop word [eax + eax]
lea eax, [ecx + 1]
cmp word [edi + ecx*2 + 2], 0
mov ecx, eax
jne 0x44ac40
jmp 0x44ac51
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.00424750
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x44ac6e
mov byte [esi], 0
mov byte [esi + 0xb], 0
jmp 0x44ac91
mov eax, dword [esi]
mov byte [eax], 0
mov dword [esi + 4], 0
cmp byte [esi + 0xb], 0
jns 0x44ac91
push dword [esi]
call fcn.00468d46
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
push edi
call fcn.00468d7c
add esp, 4
mov esi, dword [ebp - 0x20]
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44b260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x44b303
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.00468d16
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.0044b1d0
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.0044b320
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x44b2ed
mov ecx, edi
call fcn.0044b370
push edi
call fcn.00468d46
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x44b300
push dword [esp + 8]
call fcn.00468d46
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00468d81
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44dc40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4ca288]
mov ecx, dword [0x4c8930]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44dc6b
mov ecx, 0x4ca280
pop ebp
jmp fcn.00430150
push 0x4ca288
call fcn.00468dc7
add esp, 4
cmp dword [0x4ca288], 0xffffffff
jne 0x44dc60
mov dword [0x4ca284], 0
mov dword [0x4ca280], 0
mov ecx, 0x4ca280
push 0
call fcn.004301c0
push 0x4ca288
call fcn.00468e3d
add esp, 4
jmp 0x44dc60
Function at 0x4879b2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487bfb

Function at 0x48bbce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048bbd9
Function at 0x1056e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1056e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1056e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1056e06a
add dl, dl
jne 0x1056e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1056e0dc
xor eax, eax
add dl, dl
jne 0x1056e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1056e17d
add dl, dl
jne 0x1056e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1056e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1056e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1056e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1056e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1056e075
mov eax, 1
add dl, dl
jne 0x1056e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1056e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1056e0e1
sub eax, ebx
mov ebx, 1
jne 0x1056e128
mov ecx, 1
add dl, dl
jne 0x1056e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1056e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1056e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1056e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1056e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1056e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1056e136
cmp eax, 0x7d00
jae 0x1056e16d
cmp eax, 0x500
jb 0x1056e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1056e075
cmp eax, 0x7f
ja 0x1056e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1056e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1056e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1056e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40100b
Capabilities:
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x4010ad
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x40102e
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011b8
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401048
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011b8
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401134
mov word [ebx], 0x5c
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011b8
mov dword [ebp - 0x108], eax
push 0x401023
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4011ad
push 0x3e8
call eax
test eax, eax
je 0x4011ad
push eax
push 0x40
push 0x3000
push 0x10000
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x40119a
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x4010a7]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40108c]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40104d]
push 0x10
push 0x4010a7
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x28ca6edc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x190b0fdb
nop
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x12723d47
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x12777870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
push ecx
push eax
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x12723f23
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x12723f17
mov eax, dword [ebp - 0x110]
cmp eax, ebx
je 0x12723f17
mov dword [esi], eax
shl eax, 5
push eax
push edi
call sym.d3dim.dll_D3DMalloc
test eax, eax
je 0x12723dde
mov dword [edi], ebx
mov dword [esi], ebx
mov dword [ebp - 0x110], ebx
mov eax, dword [esi]
shl eax, 5
push eax
push ebx
push dword [edi]
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], ebx
cmp dword [ebp - 0x110], ebx
jbe 0x12723f17
mov dword [ebp - 0x118], ebx
mov esi, 0x80
push 0x7f
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x114]
mov dword [ebp - 0x124], esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x12723ef8
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x10c]
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x12723ef8
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x128]
push eax
push ebx
push 0x12721198
push dword [ebp - 0x11c]
mov dword [ebp - 0x120], esi
mov byte [ebp - 0x88], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x12723eec
mov eax, dword [edi]
mov ecx, dword [ebp - 0x118]
add eax, ecx
lea ecx, [eax + 0x1c]
push ecx
lea ecx, [eax + 0x18]
push ecx
lea ecx, [eax + 0x14]
push ecx
lea ecx, [eax + 0x10]
push ecx
lea ecx, [eax + 0xc]
push ecx
lea ecx, [eax + 8]
push ecx
add eax, 4
push eax
lea eax, [ebp - 0x108]
push 0x12721180
push eax
call dword [sym.imp.msvcrt.dll_sscanf]
add esp, 0x24
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
add dword [ebp - 0x118], 0x20
cmp eax, dword [ebp - 0x110]
jb 0x12723e0c
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1273b495
leave
ret
Function at 0x1272db44
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push 0x3c
push 0x12770bb8
call fcn.1273b4d0
lea eax, [ebp - 0x1c]
push eax
push 0x12721580
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1272dbb5
push 4
pop esi
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x12721f44
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1272dbac
cmp dword [ebp - 0x24], esi
jne 0x1272dbac
cmp dword [ebp - 0x28], edi
je 0x1272dbac
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x12773388], edi
xor eax, eax
jmp 0x1272dc17
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x12773388], edi
jge 0x1272dc12
mov dword [0x12773388], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x4c], di
jne 0x1272dc12
cmp word [ebp - 0x2c], 5
jb 0x1272dc12
mov dword [ebp - 4], edi
call fcn.1272db17
test eax, eax
je 0x1272dc0b
emms
mov dword [0x12773388], 1
jmp 0x1272dc0b
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x12773388]
call fcn.1273b515
ret

Function at 0x1272dc8a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x12777870]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1272dcc5
sub eax, ecx
jmp 0x1272dcda
cmp byte [ebp + eax - 0x108], 0x5c
je 0x1272dcdd
dec eax
jns 0x1272dcd0
lea eax, [ebp + eax - 0x107]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1272dc22
lea eax, [ebp - 0x210]
push eax
push 0x12721f58
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
pop esi
test eax, eax
jne 0x1272dd4a
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1272dd17
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x12721f50
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1273b495
leave
ret