joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065f8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10065fd9
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10065f80
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10065f8f
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046bc32
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10065fe0
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004ce56
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1006607f
add edi, 4
add eax, 2
dec ecx
jne 0x10065fc5
call 0x1006602c
loope 0x10066022
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1006607c
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1006608d
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10066040
cmp eax, ecx
ja 0x10066040
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100660ca
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100660c0
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1004d335
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x101d6190
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101ee630], 0
mov byte [0x101ee634], 0
mov edi, dword [0x101ee628]
add edi, 0xffffe149
mov dword [0x101ee624], edi
mov dword [0x101ee62c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101d6200
mov eax, dword [ebp - 0x20]
xor ecx, ecx
add eax, 0xffffd525
mov dword [0x101ee628], eax
mov dword [0x101ee62c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x101d6242
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101ee628]
mov esi, eax
add esi, 0xffffe149
mov dword [0x101ee624], esi
mov esi, dword [0x101ee62c]
add esi, 1
mov dword [0x101ee62c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x101d6200
jmp 0x101d61df
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x101ee638], 0
mov dword [0x101ee624], 0x2253
mov esi, dword [0x101ee630]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x101ee638], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x30]
idiv ebx
mov dword [0x101ee630], edx
mov dword [0x101ee624], 0x1af3
mov esi, dword [ebp - 0x2c]
mov bl, byte [edi + esi]
mov byte [0x101ee634], bl
add ecx, 0xffffe224
mov dword [0x101ee628], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov bl, byte [0x101ee634]
mov ecx, dword [0x101ee630]
mov byte [edi + ecx], bl
mov ecx, dword [0x101ee628]
mov edx, ecx
add edx, 0xffffe149
mov dword [0x101ee624], edx
mov esi, dword [0x101ee62c]
add esi, 1
mov dword [0x101ee62c], esi
cmp esi, 0x100
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], edx
jl 0x101d6242
mov eax, dword [ebp - 0x34]
mov dword [0x101ee624], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d68e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x101d6981
mov eax, dword [ebp - 0x18]
mov ecx, 0x106d
xor edx, edx
mov esi, dword [ebp - 0x10]
cmp word [esi + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
je 0x101d6959
jmp 0x101d6947
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jl 0x101d6981
jmp 0x101d690d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x101ee628], ecx
add esp, 0x2c
pop esi
pop ebp
ret
mov eax, 0x106d
xor ecx, ecx
mov dword [0x101ee624], 0x11f2
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp word [edx + esi*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
je 0x101d699d
jmp 0x101d6947
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
je 0x101d690d
jmp 0x101d692e
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp word [edx + esi*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x101d6947
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
cmp word [edx], 0x64
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x101d6947
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp word [edx + esi*2 - 0x12], 0x64
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x101d6947
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp word [edx + esi*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x101d6947
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff9
mov dword [ebp - 0x30], eax
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x30]
cmp word [edx + esi*2], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x101d6947
mov eax, 1
mov ecx, dword [0x101ee628]
add ecx, 0xef6
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jmp 0x101d6947
Function at 0x101d6a70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov edx, dword [0x101ee624]
mov esi, edx
add esi, 0xffffff71
mov dword [0x101ee624], esi
add edx, 0xfffff428
mov dword [0x101ee628], edx
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.101d6330
mov ecx, 0xa69
lea edx, [0x101d6e70]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x80], esi
mov dword [0x101ee628], 0x12c8
mov dword [esp + 0x90], 0x154a00
mov esi, dword [0x101ee610]
mov dword [esp + 0x50], esi
mov esi, dword [0x101ee614]
mov dword [esp + 0x78], esi
mov esi, dword [0x101ee618]
mov dword [esp + 0x4c], esi
mov esi, dword [0x101ee61c]
mov dword [esp + 0x60], esi
mov dword [0x101ee624], 0x1bd1
mov esi, dword [0x101ee620]
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
jmp 0x101d6b80
mov eax, 0x890
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x101d6b80
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [0x101ee628], eax
mov dword [esp + 0x5c], ecx
mov dword [0x101ee624], 0x39d
mov eax, dword [ecx + edx + 0x50]
mov dword [esp + 0x70], eax
call fcn.101d68e0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x101d6bbc
jmp 0x101d6bf8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
mov dword [esp + 8], ecx
jne 0x101d6b26
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edx
je 0x101d6b45
jmp 0x101d6b26
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101d7390
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101ee628]
add ecx, 0xffffd92f
mov dword [0x101ee624], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x101d6cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101ee62c], 0
mov dword [0x101ee630], 0
mov dword [0x101ee63c], 0
mov edi, dword [0x101ee628]
mov ebx, edi
add ebx, 0xffffe149
mov dword [0x101ee624], ebx
add edi, 0xffffd49d
mov dword [0x101ee628], edi
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x101d6e5c
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x101d6d2b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101ee62c], edx
mov dword [0x101ee624], 0x13cb
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101ee630], edx
mov dword [0x101ee628], 0x7fe
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101ee634], cl
mov dword [0x101ee624], 0xfae
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x101ee628]
add edx, 0xffffe149
mov dword [0x101ee624], edx
mov cl, byte [0x101ee634]
mov edx, dword [0x101ee630]
mov byte [edi + edx], cl
mov edx, dword [0x101ee624]
add edx, 0xffffddc4
mov dword [0x101ee624], edx
mov edx, dword [0x101ee62c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101ee630]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x101ee628]
mov ecx, edx
add ecx, 0xffffe149
and ebx, 0xff
mov dword [0x101ee63c], ebx
mov dword [0x101ee624], ecx
mov cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
xor cl, byte [ebx + esi]
add edx, 0xffffa56d
mov dword [0x101ee624], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov dword [0x101ee628], 0x87a
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x38], esi
je 0x101d6e5a
mov eax, dword [0x101ee62c]
mov ecx, dword [0x101ee630]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x101d6d2b
jmp 0x101d6e5c
mov dword [0x101ee624], 0x584
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1000264e
push 0
push 0
push 0
push 0x100023a0
push 0
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10002cda
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10007004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002db2
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x10002da3
cmp dword [ebp - 0x20], 0x10
jb 0x10002d91
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10002d91
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10002d91
mov edx, dword [esi]
test edx, edx
jne 0x10002d5f
push 0x200
push edx
push dword [0x10007620]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10002dab
jmp 0x10002d85
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10002d85
shl eax, 3
push eax
push edx
push 0
push dword [0x10007620]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10002dab
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10002d1a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003a5f
leave
ret

Function at 0x10002dc0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.10002cda
cmp dword [esi], ebx
je 0x10002e20
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x10002e1f
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10002e16
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10002b87
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x10002de6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002e24
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10002e72
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10002e62
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10002e59
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10002e36
mov eax, dword [esi]
pop ebx
push eax
push 0
push dword [0x10007620]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x10002e74
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10007630]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x10002e90
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
test eax, eax
jne 0x10002eb1
push 0xa
pop eax
jmp 0x10002ef0
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10002ecc
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000341d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10007628]
push esi
xor esi, esi
jmp 0x1000342f
cmp dword [edx + 4], esi
jne 0x10003488
mov edx, dword [edx]
test edx, edx
jne 0x10003428
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1000348c
push 0x20
mov dword [edx + 4], esi
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop esi
mov eax, dword [edx + 4]
add esi, 0x20
mov dword [ecx], eax
mov dword [edx + 4], ecx
add ecx, 0x20
cmp esi, 0xfe0
jbe 0x10003458
mov eax, dword [0x10007628]
mov dword [edx], eax
mov dword [0x10007628], edx
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
test edx, edx
jne 0x1000347b
xor eax, eax
pop esi
ret
Function at 0x40143f
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x828
push ebx
push esi
push edi
sub eax, eax
mov word [ebp - reloc.comctl32.dll_PropertySheetA], ax
push 0x400
xor edi, edi
lea eax, [ebp - 0x828]
push eax
push edi
pop ebx
push edi
pop esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x828]
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
pop edi
cmp edi, 0xffffffff
je 0x4014e0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
pop ebx
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.00401720
push eax
pop esi
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4014c8
cmp dword [ebp - 0x20], ebx
je 0x4014d9
push esi
pop ecx
call fcn.00401790
xor esi, esi
sub ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call fcn.00401271
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401213
mov edi, dword [ebp - 0xc]
push reloc.winmm.dll_joyGetDevCapsW
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
add eax, 0x18
push 0x3000
add eax, ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
pop ebx
mov dword [ebp - 8], ebx
or ebx, ebx
je 0x401650
push reloc.winmm.dll_joyGetDevCapsW
push edi
pop edx
push ebx
pop ecx
jmp section..htext
push edi
pop ecx
call fcn.00401790
mov ecx, esi
call fcn.00401790
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, reloc.advapi32.dll_RegEnumKeyW
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x642c5fdf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor ebx, ebx
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x630], 0x20a
cmp edi, ebx
je 0x642c61eb
push 1
push 1
push 0x642c1774
push 0x80000001
mov word [edi], ax
call fcn.642c7428
mov esi, eax
cmp esi, ebx
je 0x642c61e9
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x642c1758
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x642c1290
test ebx, ebx
je 0x642c60ca
cmp ebx, 2
jne 0x642c61e9
mov dword [ebp - 0x628], 0x642c18c4
jmp 0x642c6129
cmp dword [ebp - 0x62c], 1
je 0x642c60e0
cmp dword [ebp - 0x62c], 2
jne 0x642c61e9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x642c6129
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x642c6129
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.642c20f2
test eax, eax
jl 0x642c61df
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 5
call fcn.642d2d69
test eax, eax
jne 0x642c6158
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x642c1888
call fcn.642d2d69
pop ecx
pop ecx
jmp 0x642c61e9
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.642c20b8
xor ebx, ebx
cmp eax, ebx
jl 0x642c61df
mov eax, dword [ebp - 0x628]
cmp word [eax], 0x5c
je 0x642c6188
push esi
push dword [ebp + 0xc]
push edi
call fcn.642c20f2
cmp eax, ebx
jl 0x642c61df
push dword [ebp - 0x628]
push dword [ebp + 0xc]
push edi
call fcn.642c20f2
cmp eax, ebx
jl 0x642c61df
lea eax, [ebp - 0x624]
push eax
push 0x642c1854
push ebx
push ebx
push 0x8005
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebx
jl 0x642c61df
push 0x93d
push 0x642c1810
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
jl 0x642c61df
push edi
call fcn.642c5a44
xor eax, eax
inc eax
jmp 0x642c61eb
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c51c5
leave
ret 8