joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5075e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x507765
cmp dword [esi + 0x20], 0
je 0x507765
cmp dword [esi + 0x24], 0
je 0x507765
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x507765
cmp dword [eax], esi
jne 0x507765
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x507645
cmp eax, 0x39
je 0x507645
cmp eax, 0x45
je 0x507645
cmp eax, 0x49
je 0x507645
cmp eax, 0x5b
je 0x507645
cmp eax, 0x67
je 0x507645
cmp eax, 0x71
je 0x507645
cmp eax, 0x29a
jne 0x507765
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x50767e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x5076a0
call fcn.00504040
jmp 0x5076a5
call fcn.00503dc0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00514e20
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00518d30
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x57a64a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x57a648]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x57a64c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x57a64e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x516c34
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x516c73
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x516c73
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x516c73
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x516c73
cmp dword [ecx + 0x74], 0xe
jbe 0x516c73
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x51b130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51b15d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51b15d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x51dec0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x44a480
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x51df26
mov edi, eax
push 0x569116
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x51df26
mov esi, eax
push 0x569124
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x51df26
mov edi, eax
xor ebx, ebx
jmp 0x51df93
push 0x5690b0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x51e008
mov esi, eax
push 0x5690ba
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x51e008
mov edi, eax
push 0x5690cd
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x51e008
mov ebx, eax
push 0x5690e1
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x51e008
mov esi, eax
lea eax, [ebp - 0x28]
push 0
push 0
push 0xc0000000
push eax
call edi
test eax, eax
jne 0x51e008
mov edi, dword [ebp - 0x28]
movzx eax, byte [0x599449]
push 4
push 0xc
call fcn.00421c10
add esp, 8
test eax, eax
je 0x51e016
mov dword [eax], ebx
mov dword [eax + 4], esi
mov ecx, eax
mov dword [eax + 8], edi
xor eax, eax
lock cmpxchg dword [0x599794], ecx
je 0x51dff5
cmp dword [ecx], 0
mov esi, eax
mov dword [ebp - 0x20], ecx
je 0x51dfe4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 8]
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x24]
push 4
push 0xc
push dword [ebp - 0x20]
call fcn.00421c20
add esp, 0xc
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 2
call fcn.0051dc60
jmp 0x51e02f
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.0051ec40
add esp, 8
ud2
Function at 0x51e5f0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x51e671
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x51e6ac
cmp dword [esp + 4], 0
je 0x51e693
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x51e6cf
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x59d054]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x59d054], edi
jne 0x51e650
mov byte [0x59d050], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x51e6a3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x51e716
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x51e697
mov esi, dword [esp]
jmp 0x51e6a3
mov esi, dword [edi]
jmp 0x51e6a2
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x57dd54
push 0x57ddb4
push eax
call fcn.0051e120
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x57dd6c
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x57dda4
push eax
call fcn.0051ed60
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x57dd6c
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0051e0e0
ud2
Function at 0x51efc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x51f011
cmp eax, 1
jne 0x51f088
mov dword [esp], 0x58017e
jmp 0x51f018
mov dword [esp], str._matchesassertion__left__right__failed_n__left:__n_right:
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x51f0a4
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x5801b8
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x483a40
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x4839e0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x4839e0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x51f12a
mov edx, 7
mov dword [esp], 0x580180
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x51f02d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x5801ec
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x483a40
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x47e8c0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x4839e0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x4839e0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0051ed60
add esp, 8
ud2
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x59d7661d
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x26ee4e4d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x406e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x406e3f
pop dword [ebp - 0x18]
mov eax, 0x96dea240
sub eax, 0x969e3401
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xdd1badb0
add dword [ebp - 0x28], 0x7136979b
mov dword [ebp - 0x24], 0x53ec941e
sub dword [ebp - 0x24], 0x21b947d9
mov dword [ebp - 0x20], 0x65527073
sub dword [ebp - 0x20], 0x19062c45
mov dword [ebp - 0x1c], 0xd0cf626d
add dword [ebp - 0x1c], 0x2f309d93
lea eax, [ebp - 0x28]
push eax
mov eax, 0x6e8a7b08
add eax, 0x91b62504
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf093100d
sub dword [ebp - 0x28], 0x7c20a6b7
mov dword [ebp - 0x24], 0xa9e8a383
sub dword [ebp - 0x24], 0x687c420e
mov dword [ebp - 0x20], 0xcb7a0880
sub dword [ebp - 0x20], 0x680a9c14
mov dword [ebp - 0x1c], 0xc580a1ff
add dword [ebp - 0x1c], 0x3a7f5e01
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x673262fe
sub eax, 0x66f1c2ea
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x382fd
push 0
call eax
mov ecx, 0xdfbcbecc
add ecx, 0x20438668
mov edi, eax
mov ebx, 0x8a06c234
add ebx, 0x763cfbcc
add ebx, dword [ebp - 0x18]
mov esi, 0xd8c5456e
mov dword [ebp - 0xc], 0x906d5d6c
mov edx, dword [ebx]
add dword [ebp - 0x10], 0x9a74b365
xor edx, esi
sub dword [ebp - 0xc], 0x7e20d82e
mov dword [edi], edx
add edi, 0x1fba3ab9
sub edi, 0x1fba3ab5
add ebx, 0xeff4fa29
add ebx, 0x100b05db
loop 0x406f5b
add eax, 0xf4495227
sub eax, 0xf4484a84
mov ebx, eax
add eax, 0xe7a1aaf4
sub eax, 0xe7a1aaef
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x49c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x49c2a6
pop ebp
sub ebp, 0x45c54c
lea edi, [ebp + 0x45e155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x49c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x49c2d9
mov dword [ebp + 0x45e159], 1
cmp dword [ebp + 0x45e159], 0
jne 0x49c2e4
jmp 0x49c2fa
push ebp
lea eax, [ebp + 0x45c5c2]
push eax
mov eax, 0x30
push eax
call fcn.0049c389
pop ebp
jmp 0x49c30e
push ebp
lea eax, [ebp + 0x45c5c2]
push eax
mov eax, 0x30
push eax
call fcn.0049c616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x45c9ae]
mov esi, edi
lodsb al, byte [esi]
add eax, dword [ecx - 8]
push esp
cmp dword [edx], ebp
sal dword [ecx + eax*2], 0xe3
popal
out dx, eax
cmp cl, ch
jmp [ecx + 0x6b]
Function at 0x49c389
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
dec ebp
add al, 3
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ecx + 0x7d8b0300]
or al, 6
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ebx]
fild dword [ebx]
mov bx, dx
add al, 0x66
and ebx, 1
add dl, dl
jecxz 0x49c4d1
xor al, bl
add esp, dword [esi - 0x2f]
loop 0x49c4d9
mov bx, dx
add eax, 0xe38166
add byte [edx], 0xb5
add byte [ebx], 0x8b
jge 0x49c4f2
push es
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
cmp bh, ch
jne 0x49c556
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add eax, 0x3f28166
add byte [ebx], 0x8b
jge 0x49c54a
push es
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add bh, dh
rol dword [edx], 0xb5
or byte [ebx], al
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp cl, ch
jne 0x49c48d
pop ecx
pop ebx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [eax + 0x1460106]
inc ebx
add ecx, dword [ebx - 0x72f9f383]
mov edi, 0x45e155
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp ecx, ebx
jne 0x49c3e9
mov esp, ebp
ret 8
Function at 0x49c616
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
jge 0x49c666
push es
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov ecx, dword [ebp + 4]
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45e155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45e155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov cl, 0
xor ebx, ebx
mov bx, dx
and bx, 1
shl bl, cl
xor al, bl
shl dx, 1
mov bx, dx
and bx, 0x8000
mov ch, 0x80
cmp bh, ch
jne 0x49c6ed
xor dx, 0x8003
inc cl
mov ch, 8
cmp cl, ch
jne 0x49c6ca
pop ecx
pop ebx
mov byte [esi], al
inc esi
inc ebx
cmp ecx, ebx
jne 0x49c675
mov esp, ebp
ret 8
Function at 0x3f1704
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [0x3f16fc], 0
push esi
mov esi, dword [0x3f1700]
mov dword [ebp - 8], esi
je 0x3f1735
jmp 0x3f1726
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x3f1738
pop esi
leave
ret
mov eax, dword [ebp - 0x28]
dec eax
push eax
push esi
call fcn.003f1757
jmp 0x3f1748
lea eax, [ebp - 4]
push eax
push esi
call fcn.003f177f
jmp 0x3f176c
mov ecx, dword [ebp - 4]
add esp, 0x10
test ecx, ecx
jbe 0x3f17c2
jmp 0x3f17af
push ebx
push edi
lea edi, [eax + 0xc]
lea esi, [eax + 8]
lea ebx, [eax + 0x24]
mov dword [ebp - 4], ecx
jmp 0x3f183b
and dword [0x3f16fc], 0
jmp 0x3f1735
mov eax, dword [edi]
push dword [esi]
add eax, dword [ebp - 8]
push eax
call fcn.003f1757
jmp 0x3f182d
add esi, 0x28
add ebx, 0x28
add edi, 0x28
dec dword [ebp - 4]
jne 0x3f183b
jmp 0x3f1834
pop ecx
pop ecx
jmp 0x3f1800
pop edi
pop ebx
jmp 0x3f17c2
test byte [ebx + 3], 0x10
jne 0x3f1800
jmp 0x3f17ee

Function at 0x3f1757
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
jne 0x3f179b
jmp 0x3f1797
xor eax, eax
leave
ret
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x3f17e1
test eax, eax
je 0x3f1797
jmp 0x3f1817
mov eax, dword [ebp - 8]
and eax, 0xffffff80
test al, al
mov dword [ebp - 8], eax
jns 0x3f184f
jmp 0x3f184a
xor eax, eax
inc eax
leave
ret
lea ecx, [ebp - 8]
push ecx
or eax, 0x40
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x3f1868
neg eax
sbb eax, eax
neg eax
leave
ret

Function at 0x41087a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Packed with generic packer

Disassembly:
pushal
pushfd
cld
mov eax, 1
mov ecx, 0xffff
loopne 0x410887
dec eax
cmp eax, 0
jne 0x410882
push 0x44b4c9
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x44b4d6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push eax
mov ecx, esp
push ecx
push 0x40
push 0x5b
push entry0
call eax
mov ecx, esp
push ecx
push 0x40
push 0x19
push 0x44b4b0
mov eax, ebx
call eax
add esp, 4
jmp 0x44b4b0
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001aefd
pop dword [ebp - 0x4c]
mov eax, 0xbbf4e06e
sub eax, 0xabf33171
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xd808b868
add dword [ebp - 0x5c], 0x76498ce3
mov dword [ebp - 0x58], 0x96d1d15e
add dword [ebp - 0x58], 0x9b617ae7
mov dword [ebp - 0x54], 0xbd740329
sub dword [ebp - 0x54], 0x7127befb
mov dword [ebp - 0x50], 0x95eeac1a
add dword [ebp - 0x50], 0x6a1153e6
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x2356299c
sub eax, 0x1354691c
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x8714b9c2
sub dword [ebp - 0x5c], 0x12a2506c
mov dword [ebp - 0x58], 0xe1a075d7
sub dword [ebp - 0x58], 0xa0341462
mov dword [ebp - 0x54], 0xd177dd9c
sub dword [ebp - 0x54], 0x6e087130
mov dword [ebp - 0x50], 0x8dc06962
add dword [ebp - 0x50], 0x723f969e
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x35dce
push 0
call eax
mov ecx, 0x41bc
xor edx, edx
add edx, eax
mov ebx, 0x1627def1
sub ebx, 0x62576f1
add ebx, dword [ebp - 0x4c]
mov esi, 0xd09bcb4c
xor dword [ebp - 0x30], ebx
mov edi, dword [ebx]
sub dword [ebp - 0x18], ecx
xor edi, esi
add dword [ebp - 0x3c], 0x7e333fc4
mov dword [edx], edi
sub dword [ebp - 0x24], 0xc7cd6fb0
add edx, 4
add ebx, 4
loop 0x1001b010
add eax, 0xef89837
sub eax, 0xef79e74
mov ebx, eax
add eax, 0x4fdd10a5
add eax, 0xb022ef60
mov ecx, 0xd72aa852
sub ecx, 0xc72aa852
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4020d0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x402135
cmp dword [edi], 0
mov esi, dword [esi]
je 0x402115
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40212b
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40212b
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x40212b
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x557904], 0
jne 0x402175
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402167
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x557908], eax
mov byte [0x557904], 1
jmp 0x40217a
mov eax, dword [0x557908]
mov byte [0x557904], 1
jmp 0x40217a
mov eax, dword [0x557908]
test eax, eax
je 0x402190
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4