joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409958
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x47d244], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409995
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409980
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409972
mov dword [ecx*4 + 0x47d240], eax
inc ecx
cmp ecx, 0x100
jne 0x40996b
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x4099b7
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x47d240]
jmp 0x40999f
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x1ea3286c
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1a9f3a58
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x34c44da0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rsrc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5ae20853
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x642c56a8
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x28], 0x10
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x642c56f2
test byte [eax + 0x1c], 2
je 0x642c56f2
cmp byte [eax + 0x19], 5
jb 0x642c56f2
push 0x642c16b4
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
test esi, esi
jne 0x642c56fe
xor eax, eax
inc eax
jmp 0x642c57a4
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x642c5703
sub eax, edx
sar eax, 1
je 0x642c56f6
mov ecx, esi
mov eax, 0x642c16c4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x642c5740
test dx, dx
je 0x642c573c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x642c5740
add eax, 4
add ecx, 4
test dx, dx
jne 0x642c571a
xor eax, eax
jmp 0x642c5745
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x642c56f6
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x642c5792
mov eax, dword [section..data]
cmp eax, edi
je 0x642c578e
test byte [eax + 0x1c], 2
je 0x642c578e
cmp byte [eax + 0x19], 2
jb 0x642c578e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x642c16b4
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
xor eax, eax
jmp 0x642c57a4
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.642c51c5
leave
ret 4
Function at 0x642c58d8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x642c590b
test byte [eax + 0x1c], 2
je 0x642c590b
cmp byte [eax + 0x19], 5
jb 0x642c590b
push 0x642c16b4
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
push 0x25
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x642c595a
push dword [ebp + 8]
call fcn.642c582d
test eax, eax
jne 0x642c5a3a
mov eax, dword [section..data]
cmp eax, edi
je 0x642c5953
test byte [eax + 0x1c], 2
je 0x642c5953
cmp byte [eax + 0x19], 2
jb 0x642c5953
push 0x642c16b4
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
xor eax, eax
jmp 0x642c5a3a
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x642c59b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [section..data]
cmp ecx, edi
je 0x642c5a36
test byte [ecx + 0x1c], 2
je 0x642c5a36
cmp byte [ecx + 0x19], 2
jb 0x642c5a36
push eax
push 0x642c16b4
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.642c5545
jmp 0x642c5a36
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.642c6e70
mov dword [ebp - 4], eax
test eax, eax
jne 0x642c59eb
mov eax, dword [section..data]
cmp eax, edi
je 0x642c5a36
test byte [eax + 0x1c], 2
je 0x642c5a36
cmp byte [eax + 0x19], 2
jb 0x642c5a36
push 0x642c16b4
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
jmp 0x642c5a36
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x642c59ff
cmp eax, ebx
ja 0x642c59ff
mov eax, dword [ebp - 4]
jmp 0x642c5a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [section..data]
cmp ecx, edi
je 0x642c5a2e
test byte [ecx + 0x1c], 2
je 0x642c5a2e
cmp byte [ecx + 0x19], 2
jb 0x642c5a2e
push eax
push 0x642c16b4
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.642c5545
push dword [ebp - 4]
call fcn.642c6f08
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x642c5e20
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x642c5e43
xor eax, eax
jmp 0x642c5e9e
push 0x40
call fcn.642c7cdc
test eax, eax
je 0x642c5e3f
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x642c17fc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x642c5e86
cmp eax, esi
ja 0x642c5e86
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 8
push eax
push edi
call dword [sym.imp.USER32.dll_WinHelpW]
xor eax, eax
jmp 0x642c5e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x642c17b0
call fcn.642c7962
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.642c51c5
leave
ret 8

Function at 0x642c5eb2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [section..data]
mov esi, section..data
mov ebx, 0x642c16ec
cmp eax, esi
je 0x642c5f1f
test byte [eax + 0x1c], 2
je 0x642c5f1f
cmp byte [eax + 0x19], 5
jb 0x642c5f1f
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
test eax, eax
jge 0x642c5f70
mov eax, dword [section..data]
cmp eax, esi
je 0x642c5f67
test byte [eax + 0x1c], 2
je 0x642c5f67
cmp byte [eax + 0x19], 2
jb 0x642c5f67
push dword [ebp - 0x214]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
movzx eax, word [ebp - 0x214]
jmp 0x642c5fb0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.642c20b8
mov edi, eax
test edi, edi
jge 0x642c5fb9
mov eax, dword [section..data]
cmp eax, esi
je 0x642c5fad
test byte [eax + 0x1c], 2
je 0x642c5fad
cmp byte [eax + 0x19], 2
jb 0x642c5fad
movzx ecx, di
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x642c5fc3
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c51c5
leave
ret 0xc
Function at 0x642c5fdf
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor ebx, ebx
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x630], 0x20a
cmp edi, ebx
je 0x642c61eb
push 1
push 1
push 0x642c1774
push 0x80000001
mov word [edi], ax
call fcn.642c7428
mov esi, eax
cmp esi, ebx
je 0x642c61e9
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x642c1758
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x642c1290
test ebx, ebx
je 0x642c60ca
cmp ebx, 2
jne 0x642c61e9
mov dword [ebp - 0x628], 0x642c18c4
jmp 0x642c6129
cmp dword [ebp - 0x62c], 1
je 0x642c60e0
cmp dword [ebp - 0x62c], 2
jne 0x642c61e9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x642c6129
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x642c6129
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.642c20f2
test eax, eax
jl 0x642c61df
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 5
call fcn.642c5eb2
test eax, eax
jne 0x642c6158
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x642c1888
call fcn.642c7962
pop ecx
pop ecx
jmp 0x642c61e9
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.642c20b8
xor ebx, ebx
cmp eax, ebx
jl 0x642c61df
mov eax, dword [ebp - 0x628]
cmp word [eax], 0x5c
je 0x642c6188
push esi
push dword [ebp + 0xc]
push edi
call fcn.642c20f2
cmp eax, ebx
jl 0x642c61df
push dword [ebp - 0x628]
push dword [ebp + 0xc]
push edi
call fcn.642c20f2
cmp eax, ebx
jl 0x642c61df
lea eax, [ebp - 0x624]
push eax
push 0x642c1854
push ebx
push ebx
push 0x8005
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebx
jl 0x642c61df
push 0x93d
push 0x642c1810
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
jl 0x642c61df
push edi
call fcn.642c5a44
xor eax, eax
inc eax
jmp 0x642c61eb
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c51c5
leave
ret 8
Function at 0x642c74ce
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], 4
mov dword [ebp - 8], esi
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x642c7510
test byte [eax + 0x1c], 2
je 0x642c7510
cmp byte [eax + 0x19], 5
jb 0x642c7510
push 0x642c1a74
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x642c7559
mov eax, dword [section..data]
cmp eax, edi
je 0x642c75d0
test byte [eax + 0x1c], 2
je 0x642c75d0
cmp byte [eax + 0x19], 2
jb 0x642c75d0
push ebx
push 0x642c1a74
push 0xf
jmp 0x642c75c5
cmp dword [ebp - 4], 4
je 0x642c758d
mov eax, dword [section..data]
cmp eax, edi
je 0x642c7586
test byte [eax + 0x1c], 2
je 0x642c7586
cmp byte [eax + 0x19], 2
jb 0x642c7586
push 0x642c1a74
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
mov ebx, 0x3f1
jmp 0x642c75d0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x642c75d0
mov eax, dword [section..data]
cmp eax, edi
je 0x642c75d0
test byte [eax + 0x1c], 2
je 0x642c75d0
cmp byte [eax + 0x19], 2
jb 0x642c75d0
push ebx
push 0x642c1a74
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x642c78b7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x642c194c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x642c78e2
xor eax, eax
leave
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x642c1d84
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x642c790f
cmp dword [ebp - 0x10], 4
je 0x642c7913
and dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x642c7962
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x642c95bc], 0
jne 0x642c79b2
call fcn.642c78b7
mov dword [0x642c9018], eax
mov dword [0x642c95bc], 1
cmp dword [0x642c9018], 0
jle 0x642c7a50
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.642c7926
test eax, eax
jl 0x642c7a50
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x642c79e4
sub eax, edx
sar eax, 1
mov ecx, 0x3fd
cmp eax, ecx
jae 0x642c7a14
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x642c7a04
sub eax, edx
sar eax, 1
jmp 0x642c7a16
mov eax, ecx
add eax, eax
cmp word [ebp + eax - 0x806], 0xa
je 0x642c7a43
push 0xd
pop ecx
mov word [ebp + eax - 0x804], cx
push 0xa
pop ecx
mov word [ebp + eax - 0x802], cx
xor ecx, ecx
mov word [ebp + eax - 0x800], cx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.642c51c5
leave
ret
Function at 0x642c7b33
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x120], 0
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [section..data]
mov esi, section..data
push 2
mov edi, 0x642c1dac
pop ebx
cmp eax, esi
je 0x642c7b97
test byte [eax + 0x1c], bl
je 0x642c7b97
cmp byte [eax + 0x19], 5
jb 0x642c7b97
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x642c7be6
mov eax, dword [section..data]
cmp eax, esi
je 0x642c7bdf
test byte [eax + 0x1c], bl
je 0x642c7bdf
cmp byte [eax + 0x19], bl
jb 0x642c7bdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
xor eax, eax
jmp 0x642c7c93
cmp dword [ebp - 0x110], ebx
je 0x642c7c12
mov eax, dword [section..data]
cmp eax, esi
je 0x642c7bdf
test byte [eax + 0x1c], bl
je 0x642c7bdf
cmp byte [eax + 0x19], 3
jb 0x642c7bdf
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
jmp 0x642c7bdf
cmp dword [ebp - 0x11c], 5
jae 0x642c7c34
mov eax, dword [section..data]
cmp eax, esi
je 0x642c7bdf
test byte [eax + 0x1c], bl
je 0x642c7bdf
cmp byte [eax + 0x19], 3
jb 0x642c7bdf
push edi
push 0xe
jmp 0x642c7c05
mov eax, dword [ebp - 8]
test al, 0x40
je 0x642c7c4d
xor eax, eax
cmp byte [ebp - 6], 1
setne al
dec eax
and eax, 0xffffffe0
add eax, 0x40
jmp 0x642c7c93
test eax, 0x200
je 0x642c7c59
xor eax, eax
inc eax
jmp 0x642c7c93
test bl, al
je 0x642c7c61
push 8
jmp 0x642c7c92
test al, al
jns 0x642c7c69
push 0x10
jmp 0x642c7c92
test eax, 0x400
je 0x642c7c77
mov eax, 0x80
jmp 0x642c7c93
cmp byte [ebp - 6], 1
jne 0x642c7c81
mov eax, ebx
jmp 0x642c7c93
cmp byte [ebp - 6], 3
je 0x642c7c90
cmp byte [ebp - 6], bl
jne 0x642c7bdf
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c51c5
leave
ret
Function at 0x642c7df9
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x642c9004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [section..data]
mov esi, section..data
mov edi, 0x642c1ed8
cmp eax, esi
je 0x642c7e3d
test byte [eax + 0x1c], 2
je 0x642c7e3d
cmp byte [eax + 0x19], 5
jb 0x642c7e3d
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c2001
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x642c7ea1
mov eax, dword [section..data]
cmp eax, esi
je 0x642c7e9d
test byte [eax + 0x1c], 2
je 0x642c7e9d
cmp byte [eax + 0x19], 2
jb 0x642c7e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push edi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.642c5545
xor eax, eax
jmp 0x642c7eab
cmp dword [ebp - 0x114], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.642c51c5
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x253a3856
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2783983
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219