joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72a49bd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x18]
test byte [esi + 0x15], 8
lea eax, [edi + 0x78]
mov dword [ebp + 8], eax
je 0x72a49c02
lea eax, [esi + 0x34]
push eax
call fcn.72a3d437
mov eax, dword [esi + 0x54]
mov dword [edi + 0x14], eax
xor eax, eax
jmp 0x72a49c69
mov ebx, dword [esi + 0xc]
mov ax, word [ebx + 0xa]
test ax, ax
je 0x72a49c1f
movsx eax, ax
mov ecx, ebx
add ecx, eax
lea eax, [esi + 0x5c]
push ecx
push eax
call fcn.72a1ab16
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x800a9c68
je 0x72a49bfe
cmp dword [edi + 0x10], 0
je 0x72a49bfe
mov ecx, esi
call fcn.72a29851
push eax
push ebx
call 0x72a49ce5
cmp dword [esi + 0x20], 0
movzx eax, ax
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x1c]
jne 0x72a49c79
test eax, eax
je 0x72a49c79
and dword [edi + 0x10], 0
cmp eax, 0xffffffff
jne 0x72a49c70
mov eax, dword [esi + 0x48]
push ebx
dec eax
push eax
call fcn.72a49b9e
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, dword [esi + 0x48]
dec ecx
mov dword [esi + 0x20], ecx
jmp 0x72a49c69
mov edx, 0x72a41d44
cmp dword [esi + 0x3c], edx
je 0x72a49cb0
mov esi, dword [esi]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0x20]
test esi, esi
je 0x72a49cba
lea ecx, [esi + 0x34]
cmp eax, ecx
jne 0x72a49cba
cmp dword [esi + 0x20], 0
mov ecx, dword [esi + 0x1c]
jne 0x72a49ca7
test ecx, ecx
jne 0x72a49bfe
cmp dword [esi + 0x3c], edx
je 0x72a49cb0
mov esi, dword [esi]
jmp 0x72a49c88
test byte [esi + 0x15], 0x20
je 0x72a49bfe
call fcn.72a0e2a7
push edi
call fcn.7294a203
push eax
call fcn.72a0e86e
push eax
push 0x13
call fcn.7294b091
push dword [ebp + 8]
call fcn.72a0c6b6
push 0x9c68
call fcn.72a0e22c
mov eax, dword [esp + 4]
push esi
mov cx, word [eax + 0xe]
test cx, cx
je 0x72a49d0a
movsx ecx, cx
mov si, word [esp + 0xc]
add eax, ecx
mov cx, word [eax]
add eax, 2
dec cx
cmp si, word [eax]
jae 0x72a49d11
xor ax, ax
pop esi
ret 8
movzx edx, cx
cmp si, word [eax + edx*4]
lea edx, [eax + edx*4]
jb 0x72a49d23
mov ax, word [edx + 2]
jmp 0x72a49d0d
push 1
pop edx
cmp cx, dx
jne 0x72a49d31
mov ax, word [eax + 2]
jmp 0x72a49d0d
add eax, 4
cmp cx, dx
jbe 0x72a49d47
cmp si, word [eax]
jb 0x72a49d47
inc edx
add eax, 4
cmp dx, cx
jb 0x72a49d39
mov ax, word [eax - 2]
jmp 0x72a49d0d
Function at 0x401d54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x401d6d
push 0x80004005
call fcn.00401c46
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
je 0x401dbc
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x401dba
cmp dword [ebp + 0x10], ebx
jbe 0x401db7
cmp dword [ebp + 0x10], 2
jbe 0x401dc3
cmp dword [ebp + 0x10], 7
jne 0x401db7
cmp ecx, 1
jb 0x401db7
lea edx, [ecx + esi]
cmp byte [edx - 1], bl
jne 0x401db7
cmp ecx, 1
jbe 0x401dbc
cmp byte [edx - 2], bl
je 0x401dbc
push 0xd
pop eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ecx + esi - 1], bl
jmp 0x401db5

Function at 0x401f6f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4060d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x406354], 0
je 0x401f92
mov eax, dword [0x406350]
jmp 0x401fe5
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x88], 2
jne 0x401fd8
cmp dword [ebp - 0x94], 6
jb 0x401fd8
mov eax, ecx
jmp 0x401fda
xor eax, eax
mov dword [0x406350], eax
mov dword [0x406354], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402d5c
leave
ret
Function at 0x402adf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4060d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll__vsnprintf_s]
add esp, 0x14
test eax, eax
jns 0x402b1e
mov byte [ebp - 0x425], 0
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00402a60
push 0x4049d0
lea eax, [ebp - 0x24]
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcat_s]
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402b42
sub eax, edx
cmp eax, 6
jbe 0x402b6b
lea eax, [esi + eax - 6]
push str.__08x_
push eax
call dword [sym.imp.MSVCR100.dll__mbscmp]
pop ecx
pop ecx
test eax, eax
jne 0x402b6b
xor edi, edi
inc edi
jmp 0x402b6d
xor edi, edi
lea eax, [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402b73
sub eax, edx
mov esi, eax
mov eax, str.Error:
test edi, edi
jne 0x402b8c
mov eax, 0x4048e6
lea ecx, [ebp - 0x824]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x424]
push eax
call dword [sym.imp.MSVCR100.dll__snprintf_s]
add esp, 0x20
test eax, eax
jns 0x402bcd
mov dword [ebp - 0x29], 0x2e2e2e
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push eax
call sub.MSVCR100.dll_memcpy
lea edi, [ebp - 0x424]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402be8
lea eax, [ebp - 0x424]
mov esi, 0x4049fc
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402d5c
leave
ret

Function at 0x402d5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4060d0]
jne 0x402d66
repz ret
jmp fcn.0040321a
Function at 0x40b3b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4e5048
call sym._EnterCriticalSection_4
mov ebx, dword [0x4e5040]
sub esp, 4
test ebx, ebx
je 0x40b3fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40b3f4
test esi, esi
je 0x40b3f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b3d0
mov dword [esp], 0x4e5048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40b5e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40b630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40b708
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40b66e
cmp eax, 4
jne 0x40b690
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40b67e
cmp edx, 4
je 0x40b67e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040b5e0

Function at 0x40bc80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40bcb0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x40bcd4
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x41c450
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4a1104], 0
jne 0x41c524
mov byte [0x4a1104], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41c5be
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x41c51a
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4a217d
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x41c551
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x41c4eb
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x41c515
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x41c5b9
Function at 0x401cd3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x405020]
test eax, eax
je 0x401d12
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d12
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d12
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d12
cmp dword [ecx + 0x74], 0xe
jbe 0x401d12
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4024b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf8
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040219f
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0
jne 0x4024ed
push 0x57
call fcn.00404c84
xor eax, eax
jmp 0x4025a1
push 0x1c
push 0
lea edx, [ebp - 0x64]
push edx
call fcn.0040219f
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404c9c
test eax, eax
jne 0x40251b
xor eax, eax
jmp 0x4025a1
push 0
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404ca2
test eax, eax
jne 0x402538
xor eax, eax
jmp 0x4025a1
movzx eax, word [ebp - 0x44]
cmp eax, 0x5a4d
jne 0x402551
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x58]
ja 0x402551
cmp dword [ebp - 8], 0x40
jae 0x40255f
push 0xc1
call fcn.00404c84
xor eax, eax
jmp 0x4025a1
push 0
push 0xf8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404ca2
test eax, eax
jne 0x402582
xor eax, eax
jmp 0x4025a1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
je 0x40259b
push 0xc1
call fcn.00404c84
xor eax, eax
jmp 0x4025a1
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401415
mov esp, ebp
pop ebp
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x100037b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, edx
mov edx, dword [ebp]
cmp edi, 7
ja case.default.0x100037c8
jmp dword [edi*4 + 0x1000395c]
mov eax, esi
and eax, 3
sub edi, eax
sub eax, 1
je 0x1000380b
sub eax, 1
je 0x100037f8
sub eax, 1
jne 0x1000381e
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
mov ebx, edi
sar ebx, 3
test ebx, ebx
je 0x100038a0
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
mov ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x10001280]
xor edx, dword [esi + 4]
add esi, 8
xor edx, ecx
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
sub ebx, 1
jne 0x10003827
and edi, 7
jmp 0x100037c3
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10001280]
jmp case.0x100037c8.0
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10001280]
pop edi
pop esi
mov dword [ebp], edx
pop ebp
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x65cc08c7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x308d16b2
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x43cf6c
Capabilities:
Encode data using xor

Disassembly:
push 0x43ccda
mov edx, dword [esp]
add esp, 4
or eax, ecx
call fcn.0043cfa1
add eax, 0x50dc2bac
xor dword [ebx], edx
add eax, 0x309a8560
or ecx, eax
inc ebx
push 0xc32f8b7c
pop ecx
cmp ebx, edi
jne fcn.0043cf6c
ret
Function at 0x42f600
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac54b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a0c3c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42f682
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049ea30
mov eax, dword [eax]
push 0x4ca240
push eax
call fcn.00490124
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a0ec7
test bl, bl
je 0x42f682
push 0x4ca240
lea ecx, [esp + 0xc]
call fcn.004a1257
push 0x4cdda4
lea ecx, [esp + 0xc]
call fcn.004a1257
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42f6be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a0ec7
jmp 0x42f789
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42f742
lea edx, [esp + 0x7c]
push 0x4cdda0
push edx
call fcn.00490124
add esp, 8
test eax, eax
je 0x42f742
lea eax, [esp + 0x7c]
push 0x4cdd9c
push eax
call fcn.00490124
add esp, 8
test eax, eax
je 0x42f742
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42f6d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a0ec7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42ff80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42ffe2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc