joyce8/EMBER2024-capa huggingface dataset:
Function at 0x341f54ed
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x190
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x18c], eax
cmp dword [esp + 0x194], 0
mov ecx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x18]
mov ecx, 0x20
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
je 0x341f556a
push 0
push 0x6b39dac7
lea ecx, [esp + 0x98]
call fcn.341f52e4
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x98]
call fcn.34313bc0
fld qword [esp + 0x6a]
call fcn.341f5463
mov edx, 4
lea ecx, [esp + 0x3a]
mov edi, edi
xor dword [ecx], eax
add edx, 4
add ecx, 4
cmp edx, 0x28
jle 0x341f555d
mov ebx, dword [esp + 0x6a]
xor esi, esi
movzx ebp, byte [esp + esi*2 + 0x42]
lea edi, [esi + 3]
lea ecx, [edi + 1]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 4
shl ebp, cl
lea ecx, [edi - 2]
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3c]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 1
shl eax, cl
lea ecx, [edi - 1]
xor ebp, eax
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3e]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 2
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul edi
movzx eax, byte [esp + esi*2 + 0x40]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
add ecx, 3
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul esi
movzx eax, byte [esp + esi*2 + 0x3a]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
shl eax, cl
add esi, 5
xor ebp, eax
xor ebx, ebp
cmp esi, 0x28
jb 0x341f5570
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.341f1b18
add esp, 0x190
ret 4
Function at 0x341f5bd2
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
push edi
je 0x341f5c12
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
test eax, eax
je 0x341f5c01
push eax
lea ecx, [esi + 0xa0]
call fcn.341f5e05
test eax, eax
je 0x342a4166
push ebp
push edi
lea ecx, [esi + 0x1c]
call fcn.341f5efa
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.341f1b84
add esp, 4
test eax, eax
mov dword [esi + 0x18], eax
je 0x342a413e
xor edi, edi
cmp dword [esi + 0x14], edi
jbe 0x341f5be2
mov ebx, dword [sym.imp.kernel32.dll_ResumeThread]
lea esp, [esp]
jmp 0x341f5c4f
xor eax, eax
jmp 0x341f5c6b
push 4
call fcn.341f1b84
add esp, 4
test eax, eax
je 0x341f5c4b
push ebp
push esi
push 0x341f5ce6
mov ecx, eax
call fcn.341f5caf
mov ecx, dword [esi + 0x18]
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0x18]
cmp dword [edx + edi*4], 0
je 0x342a4153
test byte [ebp], 8
jne 0x342a417b
lea eax, [esi + 0xd0]
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esi + 0x18]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax]
push ecx
call ebx
add edi, 1
cmp edi, dword [esi + 0x14]
jb 0x341f5c4f
jmp 0x341f5be2
push 1
push 0xfffffc0d
mov ecx, ebp
call fcn.341f7675
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 1
push 0xfffffc0d
mov ecx, ebp
call fcn.341f7675
jmp 0x341f5c7e
push 1
push 0xfffffc0e
mov ecx, ebp
call fcn.341f7675
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edx, dword [esi + 0x18]
mov ebx, dword [edx + edi*4]
test ebx, ebx
je 0x342a4195
mov ecx, ebx
call fcn.3421c6a4
push ebx
call fcn.341f4964
add esp, 4
test edi, edi
mov eax, dword [esi + 0x18]
mov dword [eax + edi*4], 0
jne 0x341f5c0b
mov ecx, dword [esi + 0x18]
push ecx
call fcn.341f4964
add esp, 4
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x341f5caf
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push eax
push 4
mov esi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
je 0x342a6c62
push 1
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, esi
pop esi
ret 0xc
push edi
mov edi, dword [esp + 0x14]
push edi
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
test byte [edi], 1
jne 0x342a6c96
mov eax, dword [edi + 4]
cmp eax, 0xffffea84
jne 0x342a6c96
push 1
push 0
push 0
push 0xffffdf30
push eax
mov ecx, edi
call fcn.3420ffd2
pop edi
mov eax, esi
pop esi
ret 0xc
Function at 0x34204414
Capabilities:
Encrypt data using des

Disassembly:
push ecx
xor eax, eax
movzx edx, byte [eax + 0x34204608]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c11c], dl
movzx edx, byte [eax + 0x34204624]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c100], dl
movzx edx, byte [eax + 0x34204609]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c11d], dl
movzx edx, byte [eax + 0x34204625]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c101], dl
movzx edx, byte [eax + 0x3420460a]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c11e], dl
movzx edx, byte [eax + 0x34204626]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c102], dl
movzx edx, byte [eax + 0x3420460b]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c11f], dl
movzx edx, byte [eax + 0x34204627]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x3437c103], dl
add eax, 4
cmp eax, 0x1c
jb 0x34204417
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edx, 0x3437be18
mov dword [esp + 0x10], 0x10
lea ebx, [ebx]
movzx ebx, byte [ebp + 0x34204640]
test ebx, ebx
jbe 0x3420450a
sub ebx, 1
movzx eax, byte [0x3437c11c]
mov ecx, 0x1b
mov esi, 0x3437c11d
mov edi, 0x3437c11c
rep movsb byte es:[edi], byte [esi]
mov byte [0x3437c137], al
movzx eax, byte [0x3437c100]
mov ecx, 0x1b
mov esi, 0x3437c101
mov edi, 0x3437c100
rep movsb byte es:[edi], byte [esi]
mov byte [0x3437c11b], al
jne 0x342044cb
xor eax, eax
movzx ecx, byte [eax + 0x34204650]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x18], cl
movzx ecx, byte [eax + 0x34204668]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax], cl
movzx ecx, byte [eax + 0x34204651]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x17], cl
movzx ecx, byte [eax + 0x34204669]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax + 1], cl
movzx ecx, byte [eax + 0x34204652]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x16], cl
movzx ecx, byte [eax + 0x3420466a]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax + 2], cl
movzx ecx, byte [eax + 0x34204653]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x15], cl
movzx ecx, byte [eax + 0x3420466b]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax + 3], cl
movzx ecx, byte [eax + 0x34204654]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x14], cl
movzx ecx, byte [eax + 0x3420466c]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax + 4], cl
movzx ecx, byte [eax + 0x34204655]
movzx ecx, byte [ecx + 0x3437c11c]
mov byte [edx + eax - 0x13], cl
movzx ecx, byte [eax + 0x3420466d]
movzx ecx, byte [ecx + 0x3437c100]
mov byte [edx + eax + 5], cl
add eax, 6
cmp eax, 0x18
jb 0x3420450c
add ebp, 1
add edx, 0x30
sub dword [esp + 0x10], 1
jne 0x342044c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x342062a7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
add eax, 7
push esi
shr eax, 3
push edi
mov edi, ecx
lea ecx, [eax + eax*8 + 1]
mov eax, dword [edi]
lea edx, [ecx + eax]
cmp edx, dword [edi + 0xc]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ecx
ja 0x34206347
mov esi, dword [edi + 4]
add esi, eax
test byte [ebx], 8
jne 0x3420633e
cmp dword [esp + 0x18], 0
jne 0x3420635f
mov byte [esi], 0x7f
add esi, 1
xor bl, bl
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
cmp ebp, 8
ja 0x34206354
test ebp, ebp
jbe 0x34206337
mov edi, ebp
mov cl, byte [eax]
xor cl, bl
mov byte [esi], cl
add esi, 1
add eax, 1
sub edi, 1
jne 0x34206300
mov edi, dword [esp + 0x10]
mov edx, 8
sub edx, ebp
movzx eax, bl
push edx
push eax
push esi
call sub.msvcr80.dll_memset
mov eax, dword [esp + 0x30]
mov cl, al
xor cl, bl
add esp, 0xc
sub esi, eax
mov byte [esi + 8], cl
mov edx, dword [esp + 0x14]
add dword [edi], edx
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
push ebx
push ecx
mov ecx, edi
call fcn.342012de
mov esi, eax
jmp 0x342062d8
lea edi, [ebp - 9]
shr edi, 3
add edi, 1
jmp 0x3420636a
mov byte [esi], 0x80
add esi, 1
or bl, 0xff
jmp 0x342062ec
movzx ecx, byte [eax]
xor cl, bl
mov byte [esi], cl
movzx edx, byte [eax + 1]
xor dl, bl
mov byte [esi + 1], dl
movzx ecx, byte [eax + 2]
xor cl, bl
mov byte [esi + 2], cl
movzx edx, byte [eax + 3]
xor dl, bl
mov byte [esi + 3], dl
movzx ecx, byte [eax + 4]
xor cl, bl
mov byte [esi + 4], cl
movzx edx, byte [eax + 5]
xor dl, bl
mov byte [esi + 5], dl
movzx ecx, byte [eax + 6]
xor cl, bl
mov byte [esi + 6], cl
movzx edx, byte [eax + 7]
xor dl, bl
mov byte [esi + 7], dl
add esi, 8
mov byte [esi], 9
add eax, 8
sub ebp, 8
add esi, 1
sub edi, 1
jne 0x3420636a
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], ebp
jmp 0x342062fa
Function at 0x342086bc
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, ecx
mov bl, 0x80
test byte [esi + 0x18], bl
push edi
mov edi, dword [esp + 0x44]
jne 0x3429e79e
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x30], eax
xor eax, eax
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x3429e72a
cmp dword [esp + 0x48], edi
jne 0x3429e78b
test byte [esi + 0x18], bl
jne 0x3429e79e
call fcn.341f3190
add dword [eax + 0xd8], 1
add eax, 0xd4
test byte [ebp], 8
jne 0x3429e819
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x10
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 1
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
mov eax, dword [esp + 0x10]
test al, 1
jne 0x3429e75e
cmp dword [esp + 0x14], 0xfffffc15
jne 0x3429e75e
or dword [esi + 0x18], 0x80
jmp 0x3429e772
test al, 8
je 0x3429e772
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.341f31ab
mov eax, dword [esp + 0x10]
test eax, 0xfffffffe
je 0x34208716
lea ecx, [esp + 0x10]
call fcn.341fd218
jmp 0x34208716
push 1
push 0xfffff8f0
mov ecx, ebp
call fcn.341f7675
jmp 0x34208716
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 4]
push 0
push 0
push ecx
push edx
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3429e7cf
push ebp
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
jmp 0x3429e80d
mov ecx, dword [esp + 0x40]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x4c]
push eax
push edi
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x3429e7f9
push ebp
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
jmp 0x3429e80d
cmp dword [esp + 0x48], edi
je 0x3429e80d
push 1
push 0xfffff8f0
mov ecx, ebp
call fcn.341f7675
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x3420871f
push 0
push ebp
mov ecx, esi
call fcn.34281077
jmp 0x3420873a
Function at 0x3420e9bb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 4]
movzx eax, word [esi + 0xc]
cmp eax, dword [ecx + 0xc]
ja 0x3420ea7b
movzx eax, word [esi + 0xc]
push ebx
movzx ebx, word [esi + eax*2 + 0xc]
push edi
mov edi, dword [esp + 0x10]
and ebx, 0x3fff
cmp edi, eax
jae 0x3420ea79
cmp dword [esp + 0x14], 0
push ebp
mov ebp, dword [esp + 0x1c]
jne 0x3420ea7f
movzx eax, word [esi + edi*2 + 0xe]
and eax, 0x3fff
test ebp, ebp
jge 0x3420ea90
cmp eax, ebx
jb 0x3420ea78
test ebp, ebp
jge 0x3420ea9a
sub eax, ebx
lea edx, [ebx + esi]
push eax
sub ebx, ebp
push edx
add ebx, esi
push ebx
call dword [sym.imp.msvcr80.dll_memmove]
movzx eax, word [esi + 0xc]
add esp, 0xc
cmp edi, eax
jae 0x3420ea5a
lea ecx, [esi + edi*2 + 0xe]
movzx eax, word [ecx]
mov edx, eax
sub edx, ebp
xor edx, eax
and edx, 0x3fff
xor edx, eax
mov word [ecx], dx
movzx eax, word [esi + 0xc]
add edi, 1
add ecx, 2
cmp edi, eax
jb 0x3420ea38
movzx eax, word [esi + 0xc]
movzx ecx, ax
mov dx, word [esi + ecx*2 + 0xc]
and dx, 0x3fff
add eax, eax
sub dx, ax
sub dx, 0xe
mov word [esi + 2], dx
pop ebp
pop edi
pop ebx
pop esi
ret 0xc
push edi
mov ecx, esi
call fcn.3420bbea
test ebp, ebp
jg 0x3420ea90
jmp 0x3429c4e4
cmp ebx, ebp
jae 0x3420ea0b
jmp 0x3420ea78
movzx ecx, word [esi + edi*2 + 0xe]
and ecx, 0x3fff
cmp ecx, ebp
jge 0x3420ea17
jmp 0x3420ea78
add eax, ebp
jmp 0x3420ea03

Function at 0x34210354
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x3429ccd0
cmp dword [ecx + 0x108], 0
jne 0x3429ccad
mov dword [esp + 8], edx
jmp fcn.341f5483
mov eax, dword [ecx + 0x108]
push esi
lea esi, [esp + 0xc]
push esi
push edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
pop esi
ret 8
Function at 0x342139f8
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, ecx
mov bl, 0x80
test byte [esi + 0x18], bl
push edi
mov edi, dword [esp + 0x44]
jne 0x3429e6a0
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x30], eax
xor eax, eax
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x3429e62c
cmp dword [esp + 0x48], edi
jne 0x3429e68d
test byte [esi + 0x18], bl
jne 0x3429e6a0
call fcn.341f3190
add dword [eax + 0xd4], 1
add eax, 0xd4
test byte [ebp], 8
jne 0x3429e71b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x10
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 1
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
mov eax, dword [esp + 0x10]
test al, 1
jne 0x3429e660
cmp dword [esp + 0x14], 0xfffffc15
jne 0x3429e660
or dword [esi + 0x18], 0x80
jmp 0x3429e674
test al, 8
je 0x3429e674
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.341f31ab
mov eax, dword [esp + 0x10]
test eax, 0xfffffffe
je 0x34213a52
lea ecx, [esp + 0x10]
call fcn.341fd218
jmp 0x34213a52
push 1
push 0xfffffc06
mov ecx, ebp
call fcn.341f7675
jmp 0x34213a52
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 4]
push 0
push 0
push ecx
push edx
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3429e6d1
push ebp
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
jmp 0x3429e70f
mov ecx, dword [esp + 0x40]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x4c]
push eax
push edi
push ecx
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x3429e6fb
push ebp
call fcn.341f3190
mov ecx, eax
call fcn.342436f3
jmp 0x3429e70f
cmp dword [esp + 0x48], edi
je 0x3429e70f
push 1
push 0xfffffc06
mov ecx, ebp
call fcn.341f7675
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x34213a5b
push 0
push ebp
mov ecx, esi
call fcn.34281077
jmp 0x34213a76
Function at 0x342144de
Capabilities:
Get hostname

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.kernel32.dll_GetComputerNameA]
test eax, eax
je 0x342a430d
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.342436f3
jmp 0x34214501

Function at 0x34214812
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [0x3437bc50]
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, ebx
and esi, 0xfffeff
cmp ebx, eax
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
jne 0x34214860
test edi, edi
je 0x3421484a
mov dword [edi], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.341f1b18
add esp, 0x18
ret 0xc
cmp dword [0x3437c194], 0
je 0x342c4e48
mov ecx, dword [esp + 0x28]
push ecx
call fcn.34214901
test eax, eax
je 0x342148e5
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
call edx
test eax, eax
jne 0x342148e5
test edi, edi
je 0x342148b1
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x342148fd
cmp dword [0x3437c1a0], ecx
jne 0x342148fd
mov eax, dword [0x3437bc50]
test eax, eax
je 0x342148fd
mov dword [edi], eax
push 0xa
lea eax, [esp + 0x18]
push eax
push 0x1004
push esi
mov dword [0x3437bc50], ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x342c4e5e
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.msvcr80.dll_atoi]
add esp, 4
mov dword [0x3437c19c], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.341f1b18
add esp, 0x18
ret 0xc
mov dword [edi], ecx
jmp 0x342148b1
test edi, edi
je 0x342c4e53
mov eax, dword [0x3437c1a0]
mov dword [edi], eax
mov dword [0x3437c1a0], ebx
jmp 0x342148e5
mov dword [0x3437c19c], 0
jmp 0x342148e5
Function at 0x34217138
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x342171b4
mov eax, dword [edi + 0x40]
push ebx
push ebp
mov dword [esp + 0x14], 1
mov ebp, dword [eax + 0x38]
mov eax, dword [eax + 0x5c]
push esi
mov dword [esp + 0x14], eax
call fcn.341f3190
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
call ebx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, edi
call fcn.3421720b
mov al, byte [esp + 0x18]
test al, 8
jne 0x3429ba2d
test al, 1
pop esi
pop ebp
pop ebx
je 0x3429ba9e
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call fcn.341f31ab
test dword [esp + 0xc], 0xfffffffe
jne 0x3429bb3d
pop edi
add esp, 0x1c
ret 0x10
mov ebp, dword [esp + 0x10]
mov ecx, ebp
sub ebp, 1
test ecx, ecx
mov dword [esp + 0x10], ebp
jbe 0x3421718d
lea ecx, [esp + 0x18]
call fcn.341f4f4b
call fcn.341f3190
call ebx
mov ebp, eax
call fcn.341f3190
mov edx, dword [esp + 0x14]
sub esi, ebp
add esi, edx
cmp esi, 0x80000000
jae 0x3429ba71
call fcn.341f3190
push esi
call dword [sym.imp.kernel32.dll_Sleep]
call fcn.341f3190
call ebx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push ecx
push edx
mov ecx, edi
call fcn.3421720b
mov al, byte [esp + 0x18]
test al, 8
je 0x3421718d
jmp 0x3429ba29
mov ecx, dword [esp + 0x10]
cmp ecx, 0xfffffbae
jl 0x34217198
cmp ecx, 0xfffffbaf
jle 0x3429bac2
cmp ecx, 0xfffffbb2
jne 0x34217198
test byte [edi + 0xec], 0x10
je 0x3429bae6
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x3429bad5
mov eax, ecx
mov ecx, dword [esp + 0x30]
push 1
push eax
call fcn.341f7675
jmp 0x342171a6
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.342ebadd
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x3429bb10
mov cl, byte [esp + 0xc]
and cl, 1
neg cl
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x10]
test eax, eax
je 0x3429bb2c
cmp eax, dword [edi + 0x64]
je 0x3429bb2c
mov edx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, edi
call fcn.342ebccd
jmp 0x342171a6
push 1
push ecx
mov ecx, dword [esp + 0x38]
call fcn.341f7675
jmp 0x342171a6
lea ecx, [esp + 0xc]
call fcn.341fd218
jmp 0x342171b4

Function at 0x3421b639
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add eax, 0x100000
shl eax, 9
cmp edx, 0xffffffff
je 0x3421b650
add eax, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
jmp fcn.34217138

Function at 0x3421c25e
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x342a41bd
pop esi
ret 8
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.342436f3
jmp 0x3421c273

Function at 0x3422c554
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
cmp ecx, dword [esp + 8]
je 0x3422c572
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
inc ecx
jmp 0x3422c55d
ret 8
Function at 0x3426adbd
Capabilities:
Query or enumerate registry key

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
ret 0x10
Function at 0x34280ad5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jbe 0x34280b1c
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esi]
mov ecx, eax
shr ecx, 8
movzx ecx, byte [ecx + 0x34280b20]
shl eax, 8
add eax, edi
mov edi, ecx
shl edi, 0xd
xor edi, ecx
add edi, edi
xor eax, ecx
add edi, edi
xor edi, eax
sub edx, 1
and edi, 0xffff
add esi, 1
test edx, edx
mov eax, edi
ja 0x34280ae5
pop edi
pop esi
ret 8
Function at 0x342d7e28
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
push 2
push eax
push 0xf
call esi
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov ecx, dword [esp + 8]
push 2
push ecx
push 0xe
call esi
push eax
call sub.kernel32.dll_GetLocaleInfoW
pop esi
ret 8

Function at 0x342d7e75
Capabilities:
Delete file

Disassembly:
sub esp, 0x108
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push esi
push 0x104
lea ecx, [esp + 8]
push ecx
push eax
mov esi, 0xfffff8ed
call fcn.3434469f
test eax, eax
jl 0x342d7ed3
lea edx, [esp + 4]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x342d7ed3
xor eax, eax
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.341f1b18
add esp, 0x108
ret 4
mov ecx, dword [esp + 0x108]
mov eax, esi
pop esi
xor ecx, esp
call fcn.341f1b18
add esp, 0x108
ret 4

Function at 0x342d932e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4

Function at 0x342dd736
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push 4
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.MSO.dll_Ordinal_6877]
lea ecx, [esp + 0xc]
push ecx
call sub.kernel32.dll_GetDriveTypeW
xor edx, edx
cmp eax, 4
setne dl
mov ecx, esi
lea ebx, [ecx + 2]
mov eax, edx
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x342dd776
sub ecx, ebx
sar ecx, 1
cmp ecx, 3
jb 0x342dd7a3
add esi, 6
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.341f1b18
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x14]
mov dword [edi], 0
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.341f1b18
add esp, 0xc
ret 8