joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, eax
push ebx
push esi
mov esi, ecx
cmp dword [eax + 0x14], 0x10
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 8], esi
jb 0x409d0e
mov edx, dword [eax]
xor ecx, ecx
mov ebx, 0x811c9dc5
test edi, edi
je 0x409d31
lea esp, [esp]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x409d20
lea ecx, [esi + 0x94]
mov dword [ebp - 0xc], 0
xor edx, edx
mov eax, ebx
div dword [ecx]
mov edi, edx
mov eax, edi
or eax, 1
mov dword [ebp - 0x10], eax
bsr eax, eax
movzx ecx, al
mov dword [ebp - 0xc], eax
cmp dword [esi + ecx*4 + 4], 0
je 0x409d76
mov edx, 1
mov eax, edi
shl edx, cl
mov ecx, dword [esi + ecx*4 + 4]
and edx, 0xfffffffe
sub eax, edx
cmp dword [ecx + eax*4], 0
jne 0x409d7e
push edi
mov ecx, esi
call fcn.0040ad20
mov ecx, dword [0x461060]
movzx eax, bl
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
mov al, byte [eax + ecx]
mov byte [ebp - 1], al
mov eax, ebx
shr eax, 8
movzx eax, al
mov al, byte [eax + ecx]
mov byte [ebp - 2], al
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
mov al, byte [eax + ecx]
mov byte [ebp - 3], al
mov al, byte [ebx + ecx]
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x10]
bsr eax, eax
mov ebx, dword [ebp - 4]
movzx ecx, al
or ebx, 1
mov dword [ebp - 0x18], eax
mov eax, 1
shl eax, cl
and eax, 0xfffffffe
sub edi, eax
mov eax, dword [esi + ecx*4 + 4]
push ebx
mov eax, dword [eax + edi*4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x84]
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.00409a80
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov esi, dword [ecx]
lea esp, [esp]
test esi, esi
je 0x409e25
cmp dword [esi + 0x20], ebx
ja 0x409e25
jne 0x409e1f
mov ecx, dword [ebp - 8]
lea eax, [edi + 4]
push eax
lea eax, [esi + 4]
push eax
call fcn.0040a5e0
test al, al
je 0x409e44
mov ecx, esi
mov esi, dword [esi]
jmp 0x409e00
mov dword [edi], esi
mov edx, edi
mov eax, esi
lock cmpxchg dword [ecx], edx
cmp eax, esi
je 0x409e5f
cmp eax, edi
je 0x409e5f
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
jmp 0x409dfa
mov ecx, dword [ebp - 0x1c]
push edi
call fcn.0040a7a0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, 1
lock xadd dword [eax + 0x8c], ecx
inc ecx
mov edx, dword [eax + 0x94]
lea esi, [eax + 0x94]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x10], 1
fild dword [ebp + 0xc]
test ecx, ecx
jns 0x409e90
fadd dword [0x462c60]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov dword [ebp + 0xc], edx
fild dword [ebp + 0xc]
test edx, edx
jns 0x409ea6
fadd dword [0x462c60]
fstp dword [ebp + 0xc]
fdiv dword [ebp + 0xc]
fld dword [eax + 0x98]
fcompp
fnstsw ax
test ah, 5
jp 0x409ec4
lea ecx, [edx + edx]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a840
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x40a85c
mov esi, dword [ebx]
mov edx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp + 0xc], edx
test edi, edi
je 0x40a884
lea ebx, [ebx]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x40a870
mov dword [ebp + 0xc], edx
mov edi, dword [ebp - 4]
mov eax, edx
xor edx, edx
mov dword [ebp - 8], 0
div dword [edi + 0x94]
mov esi, edx
mov eax, esi
or eax, 1
mov dword [ebp - 8], eax
bsr eax, eax
movzx ecx, al
cmp dword [edi + ecx*4 + 4], 0
je 0x40a8c7
mov edx, 1
mov eax, esi
shl edx, cl
mov ecx, dword [edi + ecx*4 + 4]
and edx, 0xfffffffe
sub eax, edx
cmp dword [ecx + eax*4], 0
jne 0x40a8cf
push esi
mov ecx, edi
call fcn.0040abc0
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x461060]
movzx eax, dl
mov dword [ebp - 4], 0
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xf], al
mov eax, edx
shr eax, 8
movzx eax, al
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xe], al
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 0x18
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xd], al
movzx eax, byte [edx + ecx]
mov byte [ebp + 0xc], al
mov eax, dword [ebp - 8]
bsr eax, eax
mov edx, dword [ebp + 0xc]
movzx ecx, al
or edx, 1
mov eax, 1
mov dword [ebp + 0xc], edx
shl eax, cl
and eax, 0xfffffffe
sub esi, eax
mov eax, dword [edi + ecx*4 + 4]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x40a9cf
mov edi, edi
cmp dword [eax + 0x24], edx
ja 0x40a9cf
jne 0x40a9c5
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
jb 0x40a959
mov esi, dword [ebx]
cmp dword [eax + 0x18], 0x10
lea ecx, [eax + 4]
jb 0x40a965
mov ecx, dword [eax + 4]
mov edi, dword [eax + 0x14]
cmp edi, dword [ebx + 0x10]
jne 0x40a9c5
sub edi, 4
jb 0x40a983
mov edx, dword [ecx]
cmp edx, dword [esi]
jne 0x40a988
add ecx, 4
add esi, 4
sub edi, 4
jae 0x40a972
cmp edi, 0xfffffffc
je 0x40a9bc
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x40a9b5
cmp edi, 0xfffffffd
je 0x40a9bc
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x40a9b5
cmp edi, 0xfffffffe
je 0x40a9bc
mov dl, byte [ecx + 2]
cmp dl, byte [esi + 2]
jne 0x40a9b5
cmp edi, 0xffffffff
je 0x40a9bc
mov cl, byte [ecx + 3]
cmp cl, byte [esi + 3]
je 0x40a9bc
sbb ecx, ecx
or ecx, 1
jmp 0x40a9be
xor ecx, ecx
test ecx, ecx
je 0x40a9e1
mov edx, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x40a940
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x40aa00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x40aa1c
mov esi, dword [ebx]
mov edx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp + 0xc], edx
test edi, edi
je 0x40aa44
lea ebx, [ebx]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x40aa30
mov dword [ebp + 0xc], edx
mov edi, dword [ebp - 4]
mov eax, edx
xor edx, edx
mov dword [ebp - 8], 0
div dword [edi + 0x94]
mov esi, edx
mov eax, esi
or eax, 1
mov dword [ebp - 8], eax
bsr eax, eax
movzx ecx, al
cmp dword [edi + ecx*4 + 4], 0
je 0x40aa87
mov edx, 1
mov eax, esi
shl edx, cl
mov ecx, dword [edi + ecx*4 + 4]
and edx, 0xfffffffe
sub eax, edx
cmp dword [ecx + eax*4], 0
jne 0x40aa8f
push esi
mov ecx, edi
call fcn.0040ad20
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x461060]
movzx eax, dl
mov dword [ebp - 4], 0
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xf], al
mov eax, edx
shr eax, 8
movzx eax, al
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xe], al
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 0x18
movzx eax, byte [eax + ecx]
mov byte [ebp + 0xd], al
movzx eax, byte [edx + ecx]
mov byte [ebp + 0xc], al
mov eax, dword [ebp - 8]
bsr eax, eax
mov edx, dword [ebp + 0xc]
movzx ecx, al
or edx, 1
mov eax, 1
mov dword [ebp + 0xc], edx
shl eax, cl
and eax, 0xfffffffe
sub esi, eax
mov eax, dword [edi + ecx*4 + 4]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x40ab8f
mov edi, edi
cmp dword [eax + 0x20], edx
ja 0x40ab8f
jne 0x40ab85
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
jb 0x40ab19
mov esi, dword [ebx]
cmp dword [eax + 0x18], 0x10
lea ecx, [eax + 4]
jb 0x40ab25
mov ecx, dword [eax + 4]
mov edi, dword [eax + 0x14]
cmp edi, dword [ebx + 0x10]
jne 0x40ab85
sub edi, 4
jb 0x40ab43
mov edx, dword [ecx]
cmp edx, dword [esi]
jne 0x40ab48
add ecx, 4
add esi, 4
sub edi, 4
jae 0x40ab32
cmp edi, 0xfffffffc
je 0x40ab7c
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x40ab75
cmp edi, 0xfffffffd
je 0x40ab7c
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x40ab75
cmp edi, 0xfffffffe
je 0x40ab7c
mov dl, byte [ecx + 2]
cmp dl, byte [esi + 2]
jne 0x40ab75
cmp edi, 0xffffffff
je 0x40ab7c
mov cl, byte [ecx + 3]
cmp cl, byte [esi + 3]
je 0x40ab7c
sbb ecx, ecx
or ecx, 1
jmp 0x40ab7e
xor ecx, ecx
test ecx, ecx
je 0x40aba1
mov edx, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x40ab00
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x411f60
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x411fa0
push dword [esi + 0x18]
push eax
call dword [0x46109c]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], 0
test eax, eax
je 0x411f89
push eax
call dword [0x461070]
push dword [esi + 0x14]
mov dword [esi + 0x10], 0
call dword [0x461070]
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x411fad
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x411fba
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x411fc7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x411fd4
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x20]
pop esi
jmp 0x43a960
jo 0x43a9d0

Function at 0x41a470
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd0]
mov dword [esi], 0x465f5c
mov dword [esi + 0xc8], 0x4660f4
test eax, eax
je 0x41a49e
push eax
call dword [0x46132c]
mov dword [esi + 0xd0], 0
mov eax, dword [esi + 0xcc]
test eax, eax
je 0x41a4b9
push eax
call dword [0x46132c]
mov dword [esi + 0xcc], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x41a4d4
push eax
call dword [0x461070]
mov dword [esi + 0xd4], 0
mov eax, dword [esi + 0x104]
mov eax, dword [eax]
test eax, eax
je 0x41a4f3
push eax
call dword [0x4611bc]
mov eax, dword [esi + 0x104]
mov dword [eax], 0
lea ecx, [esi + 0x290]
call fcn.00443e1a
lea ecx, [esi + 0x210]
call fcn.00443dd8
lea ecx, [esi + 0x190]
call fcn.00443dd8
lea ecx, [esi + 0x110]
call fcn.00443dd8
mov eax, dword [esi + 0x104]
test eax, eax
je 0x41a576
mov ecx, dword [esi + 0x10c]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x41a54e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a57e
mov eax, edx
push ecx
push eax
call fcn.00442958
mov dword [esi + 0x104], 0
add esp, 8
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov ecx, esi
pop esi
jmp fcn.0042cfb0
call dword [0x461498]
int3
Function at 0x427020
Capabilities:
Get number of processors

Disassembly:
jno 0x427024
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, 0x12
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 7
add eax, ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
outsb dx, byte [esi]
bound edx, qword [ecx]
movsb byte es:[edi], byte [esi]
push 0x73707474
cmp ch, byte [edi]
das
ja 0x4270e1
ja 0x42709a
jns 0x4270dd
jne 0x4270e4
jne 0x4270d4
arpl word cs:[edi + 0x6d], bp
das
popal
jo 0x4270e4
das
jae 0x4270f2
popal
je 0x4270f4
das
ja 0x4270e5
je 0x4270e9
push 0x656d6974
aas
outsb dx, byte [esi]
jae 0x4270cc
jns 0x427105
insb byte es:[edi], dx
cmp eax, 0x61746564
imul ebp, dword [eax + esi*2 + 0x61], 0x63266567
jo 0x427111
insb byte es:[edi], dx
jo 0x4270fe
arpl word es:[bx + si + 0x6e], si
cmp eax, 0x434e3979
jno 0x427118
jbe 0x4270f7
xor byte [esi + 0x63], dh
dec esi
xor al, 0x78
jb 0x42710c
outsd dx, dword fs:[esi]
arpl word [ecx + 0x64], bp
cmp eax, 0x45477652
inc ecx
inc ebp
push ebp
jae 0x4270f4
jae 0x4270ed
jbe 0x42712e
jb 0x427108
xor ah, byte [esi]
jb 0x427134
jb 0x427134
jb 0x427145
jb 0x427113
jb 0x427113
push 0x73707474
and eax, 0x32254133
inc esi
inc ecx
and eax, 0x32254632
inc esi
and eax, 0x77774632
ja 0x42715d
ja 0x42715e
ja 0x427116
jns 0x427159
jns 0x427159
outsd dx, dword [esi]
jne 0x427160
jne 0x427150
bound esp, qword [ebp + 0x2e]
arpl word [edi + 0x6d], bp
arpl word cs:[edi + 0x6d], bp
insd dword es:[edi], dx
and eax, 0x61774632
xor al, byte [esi + 0x77]
popal
je 0x42715d
push 0x76463325
and eax, 0x44664433
xor eax, dword [esi + 0x44]
jbe 0x427125
xor byte fs:[eax + 0x4f], bh
xor esi, dword [esi]
xor dword cs:[ecx], esi
jo 0x42719d
cmp dword [esi], esi
cmp dword cs:[ecx], edi
pop edx
bound edi, qword [edx + 0x76]
jae 0x4271b6
outsd dx, dword [esi]
xor byte [eax], dh
arpl word es:[0x26424557], di
Function at 0x427100
Capabilities:
Get number of processors

Disassembly:
jno 0x427024
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, 0x12
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 7
add eax, ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
outsb dx, byte [esi]
bound edx, qword [ecx]
movsb byte es:[edi], byte [esi]
push 0x73707474
cmp ch, byte [edi]
das
ja 0x4270e1
ja 0x42709a
jns 0x4270dd
jne 0x4270e4
jne 0x4270d4
arpl word cs:[edi + 0x6d], bp
das
popal
jo 0x4270e4
das
jae 0x4270f2
popal
je 0x4270f4
das
ja 0x4270e5
je 0x4270e9
push 0x656d6974
aas
outsb dx, byte [esi]
jae 0x4270cc
jns 0x427105
insb byte es:[edi], dx
cmp eax, 0x61746564
imul ebp, dword [eax + esi*2 + 0x61], 0x63266567
jo 0x427111
insb byte es:[edi], dx
jo 0x4270fe
arpl word es:[bx + si + 0x6e], si
cmp eax, 0x434e3979
jno 0x427118
jbe 0x4270f7
xor byte [esi + 0x63], dh
dec esi
xor al, 0x78
jb 0x42710c
outsd dx, dword fs:[esi]
arpl word [ecx + 0x64], bp
cmp eax, 0x45477652
inc ecx
inc ebp
push ebp
jae 0x4270f4
jae 0x4270ed
jbe 0x42712e
jb 0x427108
xor ah, byte [esi]
jb 0x427134
jb 0x427134
jb 0x427145
jb 0x427113
jb 0x427113
push 0x73707474
and eax, 0x32254133
inc esi
inc ecx
and eax, 0x32254632
inc esi
and eax, 0x77774632
ja 0x42715d
ja 0x42715e
ja 0x427116
jns 0x427159
jns 0x427159
outsd dx, dword [esi]
jne 0x427160
jne 0x427150
bound esp, qword [ebp + 0x2e]
arpl word [edi + 0x6d], bp
arpl word cs:[edi + 0x6d], bp
insd dword es:[edi], dx
and eax, 0x61774632
xor al, byte [esi + 0x77]
popal
je 0x42715d
push 0x76463325
and eax, 0x44664433
xor eax, dword [esi + 0x44]
jbe 0x427125
xor byte fs:[eax + 0x4f], bh
xor esi, dword [esi]
xor dword cs:[ecx], esi
jo 0x42719d
cmp dword [esi], esi
cmp dword cs:[ecx], edi
pop edx
bound edi, qword [edx + 0x76]
jae 0x4271b6
outsd dx, dword [esi]
xor byte [eax], dh
arpl word es:[0x26424557], di
Function at 0x3001c119
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x3001c14f
jle 0x3001c1b0
and eax, 0xffff
or eax, 0x80070000
jmp 0x3001c1b0
cmp dword [ebp + 0x10], edi
push esi
je 0x3001c196
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x3001c196
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jle 0x3001c192
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x3001c1af
mov eax, dword [ebp + 0x14]
cmp eax, edi
jne 0x3001c1a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3001c1ad
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
pop esi
pop edi
leave
ret 0x10

Function at 0x3001c1f4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x3001b290]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea edx, [ebp - 0x214]
push edx
push 0x2000e
xor esi, esi
push esi
push ecx
push eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x3001c24a
jle 0x3001c2e9
and eax, 0xffff
or eax, 0x80070000
jmp 0x3001c2e9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
jmp 0x3001c26c
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call fcn.3001c1f4
mov edi, eax
cmp edi, esi
jne 0x3001c2c9
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x105
call ebx
test eax, eax
je 0x3001c254
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
jle 0x3001c2e7
and eax, 0xffff
or eax, 0x80070000
jmp 0x3001c2e7
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jle 0x3001c2e5
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.300305d2
leave
ret 8
Function at 0x3002f383
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x3006bb84
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x3002f3d4
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x3006bb88], eax
mov ax, word [ebp - 0x30]
mov word [0x3006bb8c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x3006bb90], eax
mov eax, dword [ebp - 0x40]
mov dword [0x3006bb94], eax
mov eax, esi
pop esi
leave
ret

Function at 0x3003051e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x3001b294
push 0x3000d8d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x30030553
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x3001b290
push ebx
call edi
test esi, esi
mov dword [0x3001b290], esi
jne 0x300305b7
mov dword [0x3001b290], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x300671ac], 0x44bf19b1
pop ebx
leave
ret
Function at 0x30031ed9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x3001b290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x464]
push esi
push eax
mov dword [ebp - 0x468], 0x44
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x424], esi
xor eax, eax
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push ebx
stosd dword es:[edi], eax
call 0x30026079
cmp eax, 0x104
jg 0x30031f90
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push 0x6b
push ebx
push 0x3001b74c
push 0x208
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x30031f90
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
jmp 0x30031f9b
push esi
push 0x30303030
call fcn.3001d0f8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.300305d2
leave
ret 8

Function at 0x30032722
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.30032627
test eax, eax
je 0x30032793
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30032793
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x3001b87c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30032789
cmp dword [ebp - 0x10], 1
je 0x30032789
and word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x4059b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404114
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e1c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a21
lea eax, [ebp - 0x10]
call fcn.00403ea4
ret

Function at 0x409e80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409eb9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f94
jmp 0x409ec2
mov eax, ebx
mov edx, esi
call fcn.00403ef8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409ecc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409eed
mov al, byte [esp]
jmp 0x409eef
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a584
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a3ec
mov eax, dword [0x414504]
cmp byte [eax], 0
je 0x40a600
mov eax, dword [0x414424]
call fcn.00402d98
call fcn.00402a98
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004077d4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a648
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a636
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x414400]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415660]
call fcn.00404e5c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret