joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e03521d
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], 1
call fcn.2e056553
mov eax, 0x2e0b3dac
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov ecx, eax
cmp dword [ecx], 0
je 0x2e03528a
add ecx, 0x14
inc esi
cmp ecx, 0x2e0b3dd4
jl 0x2e035274
jmp 0x2e0353dd
imul esi, esi, 0x14
add esi, eax
je 0x2e0353dd
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2e0353bf
cmp dword [ebp - 0x214], 1
jne 0x2e0353bf
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x2e0353c1
cmp dword [ebp - 0x210], ebx
je 0x2e0353c1
shr dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0x104
jae 0x2e035306
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx*2 - 0x20c], ax
jmp 0x2e03530a
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x2e0353c1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2e0056b4
push eax
call edi
cmp eax, ebx
jne 0x2e035338
mov eax, dword [ebp + 0x10]
jmp 0x2e03533a
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x2e03535e
push 0x2e0056a8
push dword [esi]
call edi
push 0x2e005694
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x2e005684
jmp 0x2e035392
cmp eax, 2
jne 0x2e035373
push 0x2e0056a8
push dword [esi]
call edi
push 0x2e005670
jmp 0x2e035350
cmp eax, 3
jne 0x2e03539c
push 0x2e005660
push dword [esi]
call edi
push 0x2e005648
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x2e005634
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], ebx
je 0x2e0353c1
cmp dword [esi + 0x10], ebx
je 0x2e0353c1
cmp dword [esi + 0xc], ebx
je 0x2e0353c1
push dword [0x2e0b3dd4]
push esi
call fcn.2e034ffa
test eax, eax
jl 0x2e0353c1
xor esi, esi
jmp 0x2e0353c1
xor ebx, ebx
cmp esi, ebx
je 0x2e0353dd
mov eax, dword [esi]
cmp eax, ebx
je 0x2e0353d2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e056441
leave
ret 0xc

Function at 0x2e035bb2
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
jmp 0x2e035bcc
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x2e035bbf
pop ebp
ret 8
Function at 0x2e0362d9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x14]
xor edx, edx
push 0xa
mov eax, edi
pop ecx
div ecx
xor ebx, ebx
mov dword [ebp - 4], 0x811c9dc5
mov esi, eax
inc esi
cmp esi, edi
jae 0x2e036301
sub edi, esi
test edi, edi
jbe 0x2e036325
mov ecx, dword [ebp + 8]
push ebx
call fcn.2e02e49a
mov ecx, dword [ebp - 4]
movzx eax, word [eax]
imul ecx, ecx, 0x1000193
xor ecx, eax
add ebx, esi
mov dword [ebp - 4], ecx
cmp ebx, edi
jb 0x2e036305
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x2e041f9e
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.2e04a59a
test eax, eax
jne 0x2e042008
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e042008
cmp dword [esp + 0x10], 4
jne 0x2e042008
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x2e04201f
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x2e0426eb
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x2e07ae68
call fcn.2e0574a2
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x2e042729
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x2e042729
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x2e042729
mov eax, dword [ecx + 0x50]
jmp 0x2e04274a
mov ecx, 0x4550
cmp dx, cx
jne 0x2e042756
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x2e042756
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x2e042756
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x2e04275a
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.2e0574e7
ret

Function at 0x2e042f21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x2e042f67
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.2e04a2ff
mov edi, eax
cmp edi, 0xffffffff
je 0x2e042f66
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x2e047aa0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x2e047ac2
xor esi, esi
jmp 0x2e047b48
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x2e047abb
push esi
call fcn.2e05769b
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x2e047aea
push ebx
push 0x33753468
jmp 0x2e047b33
push eax
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x2e047b01
push ebx
push 0x33753469
jmp 0x2e047b33
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x2e00407c
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x2e047b2d
cmp dword [ebp - 4], 0x34
jne 0x2e047b2d
mov esi, dword [ebp - 8]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x2e047b3a
push ebx
push 0x3375346a
call fcn.2e045ed0
xor esi, esi
cmp dword [ebp + 0xc], ebx
je 0x2e047b48
push dword [ebp + 0xc]
call fcn.2e0576a6
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x2e0481cc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.2e047263
test eax, eax
jne 0x2e0481e9
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push edi
push eax
push 0x11
call fcn.2e042b9d
push dword [ebp - 0x1c]
push 0x12
call fcn.2e042b9d
push 0x2e003fc8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x2e0482ea
push esi
push 0x2e0140b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x2e0482e9
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x2e0482e9
push dword [ebp - 4]
call fcn.2e041b81
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x2e0482e1
lea ecx, [ebp - 4]
push ecx
push eax
call esi
test eax, eax
je 0x2e0482e1
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp eax, edi
jbe 0x2e0482e1
mov edx, dword [ebp - 0xc]
push ebx
mov ebx, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x2e048298
dec eax
dec eax
jne 0x2e0482a9
push dword [edx]
call fcn.2e047719
pop ecx
cmp edi, eax
ja 0x2e0482a9
mov edi, eax
jmp 0x2e0482a9
push dword [edx]
inc dword [ebp - 8]
call fcn.2e047719
pop ecx
cmp esi, eax
ja 0x2e0482a9
mov esi, eax
add edx, 0x18
dec ebx
jne 0x2e04827c
pop ebx
test esi, esi
je 0x2e0482bf
push esi
push 0x19e1
call fcn.2e042b9d
test edi, edi
je 0x2e0482ce
push edi
push 0x19e2
call fcn.2e042b9d
cmp dword [ebp - 8], 0
je 0x2e0482e1
push dword [ebp - 8]
push 0x19e0
call fcn.2e042b9d
push dword [ebp - 0xc]
call fcn.2e041bb5
pop esi
call fcn.2e04121c
pop edi
test eax, eax
jne 0x2e0482fd
push dword [ebp - 0x1c]
call fcn.2e0480b9
pop ecx
leave
ret
Function at 0x2e0482ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x2e014124
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x118
lea eax, [ebp - 0x138]
push ebx
push eax
mov dword [ebp - 0x140], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x13c], ebx
call fcn.2e056553
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push 1
push ebx
push 0x2e0140f8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x2e0483b8
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push 0x2e0140e8
push dword [ebp - 0x144]
mov dword [ebp - 0x14c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e0483aa
push dword [ebp - 0x148]
push 0x22df
call fcn.2e042b9d
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2e0483c3
push ebx
push 0x66397234
call fcn.2e045ed0
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x2e04844d
push dword [ebp - 0x130]
push 0x1a
call fcn.2e042b9d
movzx eax, word [ebp - 0x28]
movzx ecx, word [ebp - 0x26]
shl eax, 0x10
or eax, ecx
push eax
push 0x43
call fcn.2e042b9d
movzx eax, word [ebp - 0x24]
push eax
push 0x3a5
call fcn.2e042b9d
push dword [ebp - 0x138]
push 0x22e1
call fcn.2e042b9d
push dword [ebp - 0x134]
push 0x22e2
call fcn.2e042b9d
movzx eax, word [ebp - 0x28]
push eax
push 0x22e4
call fcn.2e042b9d
movzx eax, word [ebp - 0x26]
push eax
push 0x22e5
call fcn.2e042b9d
call fcn.2e04a0ad
test eax, eax
je 0x2e0484e0
lea eax, [ebp - 0x20]
push eax
call fcn.2e048031
mov esi, eax
cmp esi, ebx
jne 0x2e048471
push ebx
push 0x38317137
jmp 0x2e0484be
push 0x2e0140d8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x2e048489
push ebx
push 0x38317138
jmp 0x2e0484be
lea ecx, [ebp - 0x140]
push ecx
movzx ecx, word [ebp - 0x26]
push ecx
movzx ecx, word [ebp - 0x28]
push ecx
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call eax
test eax, eax
jne 0x2e0484c5
push 0xffffffffffffffff
push 0x1af7
call fcn.2e042b9d
push ebx
push 0x38317139
call fcn.2e045ed0
jmp 0x2e0484d5
push dword [ebp - 0x140]
push 0x1af7
call fcn.2e042b9d
cmp esi, ebx
je 0x2e0484e0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e056441
leave
ret
Function at 0x2e048748
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x2e0487b8
push esi
lea eax, [ebp - 4]
push eax
call fcn.2e041ce6
test eax, eax
je 0x2e0487b8
push dword [ebp - 4]
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x2e0487b0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2e00407c
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x2e0487b0
cmp dword [ebp - 8], ebx
je 0x2e0487b0
mov esi, dword [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov bl, 1
pop edi
push dword [ebp - 4]
call fcn.2e041ded
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x2e04a0ba
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x2e04a18d
cmp dword [ebp - 0x90], 2
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 6]
push esi
mov dword [0x2e0b8afc], ecx
mov byte [0x2e0b8b02], al
jne 0x2e04a179
mov eax, dword [ebp - 0x9c]
mov dx, word [ebp - 0xc]
mov dword [0x2e0b8af8], eax
mov word [0x2e0b8b00], dx
cmp eax, 5
jne 0x2e04a15b
mov esi, 0x2e0097ac
cmp ecx, 1
jae 0x2e04a13d
push 0
push esi
push 0x3535796e
push esi
call fcn.2e047160
cmp dword [ebp - 0x98], 1
jne 0x2e04a15b
cmp word [ebp - 0xc], 1
ja 0x2e04a15b
push 0
push esi
push 0x3535796f
push esi
call fcn.2e047160
movzx eax, word [ebp - 8]
mov ecx, eax
and ecx, 0x110
and eax, 0x100
mov dword [0x2e0b8b08], ecx
mov dword [0x2e0b8b0c], eax
jmp 0x2e04a18c
push 0
mov esi, 0x2e0097ac
push esi
push 0x31343461
push esi
call fcn.2e047160
pop esi
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [0x2e0b8b04], eax
call fcn.2e056441
leave
ret

Function at 0x2e04a287
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x2e04a2a1
test al, 0x10
je 0x2e04a2a1
xor eax, eax
inc eax
jmp 0x2e04a2a3
xor eax, eax
pop ebp
ret 4
Function at 0x2e04a3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x2e0142d0
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2e04a416
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x2e0142b8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2e04a40d
cmp dword [ebp - 8], 1
jne 0x2e04a40d
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x2e009978
call esi
test eax, eax
jne 0x2e04a40a
push 0x2e009964
call esi
test eax, eax
je 0x2e04a40d
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x2e04a41c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x224], esi
call fcn.2e04a1b8
test eax, eax
je 0x2e04a537
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
mov ebx, 0x2e014350
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x2e04a535
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x2e04a529
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x2e01433c
push edi
push dword [ebp - 0x218]
mov ebx, 0x20a
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e04a51d
cmp dword [ebp - 0x21c], 1
jne 0x2e04a51d
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e04a51d
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x2e04a51d
call fcn.2e04a3a0
test eax, eax
jne 0x2e04a51d
mov dword [ebp - 0x224], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop esi
call fcn.2e056441
leave
ret
Function at 0x2e04eea8
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x2e07aea8
call fcn.2e0574a2
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x2e04eee6
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x2e04eee6
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x2e04eee6
mov eax, dword [ecx + 0x50]
jmp 0x2e04ef07
mov ecx, 0x4550
cmp dx, cx
jne 0x2e04ef13
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x2e04ef13
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x2e04ef13
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x2e04ef17
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.2e0574e7
ret 4
Function at 0x2e050d81
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.2e057f13
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2e056441
leave
ret

Function at 0x2e0544fc
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x2e0b9c84
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x2e05454d
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x2e0b9c88], eax
mov ax, word [ebp - 0x30]
mov word [0x2e0b9c8c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x2e0b9c90], eax
mov eax, dword [ebp - 0x40]
mov dword [0x2e0b9c94], eax
mov eax, esi
pop esi
leave
ret

Function at 0x2e056441
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e0b1da0]
jne 0x2e05c231
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2e0ba250], eax
mov dword [0x2e0ba24c], ecx
mov dword [0x2e0ba248], edx
mov dword [0x2e0ba244], ebx
mov dword [0x2e0ba240], esi
mov dword [0x2e0ba23c], edi
mov word [0x2e0ba268], ss
mov word [0x2e0ba25c], cs
mov word [0x2e0ba238], ds
mov word [0x2e0ba234], es
mov word [0x2e0ba230], fs
mov word [0x2e0ba22c], gs
pushfd
pop dword [0x2e0ba260]
mov eax, dword [ebp]
mov dword [0x2e0ba254], eax
mov eax, dword [ebp + 4]
mov dword [0x2e0ba258], eax
lea eax, [ebp + 8]
mov dword [0x2e0ba264], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2e0ba1a0], 0x10001
mov eax, dword [0x2e0ba258]
mov dword [0x2e0ba154], eax
mov dword [0x2e0ba148], 0xc0000409
mov dword [0x2e0ba14c], 1
mov eax, dword [0x2e0b1da0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x2e0b1da4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2e0ba198], eax
push 1
call fcn.2e059ae6
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2e0242ac
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2e0ba198], 0
jne 0x2e05c31d
push 1
call fcn.2e059ae6
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x488740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
or ebp, 0xffffffff
jmp 0x488762
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x488769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x488758
mov eax, 1
add ebx, ebx
jne 0x48877b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48878c
jne 0x4887ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4887ab
dec eax
add ebx, ebx
jne 0x488798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x488770
add ebx, ebx
jne 0x4887a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4887fd
xor ecx, ecx
sub eax, 3
jb 0x4887c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x488832
sar eax, 1
mov ebp, eax
jmp 0x4887ce
add ebx, ebx
jne 0x4887ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48879c
inc ecx
add ebx, ebx
jne 0x4887dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48879c
add ebx, ebx
jne 0x4887e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4887de
jne 0x4887fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4887de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48881c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48880e
jmp 0x48875e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48881c
add edi, ecx
jmp 0x48875e
pop esi
mov edi, esi
mov ecx, 0x77c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48883a
cmp byte [edi], 6
jne 0x48883a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48883f
lea edi, [esi + 0x86000]
mov eax, dword [edi]
or eax, eax
je 0x4888b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe26e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe271c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48886c
mov ecx, edi
jns 0x48889b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe2720]
or eax, eax
je 0x4888b1
mov dword [ebx], eax
add ebx, 4
jmp 0x488889
call dword [esi + 0xe2730]
mov ebp, dword [esi + 0xe2724]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4888eb
sub esp, 0xffffff80
jmp 0x401eb0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx