joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406380
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x20
mov ebx, edx
mov edi, ecx
call fcn.0040b7e3
mov esi, eax
add esp, 4
test esi, esi
je 0x412529
mov dword [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
mov dword [esi + 0x18], eax
push 0
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4124ed
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x403830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x4124ed
mov ecx, dword [esi + 0x1c]
sub esp, 8
call fcn.00406446
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x1c], 0
test edi, edi
jg 0x412519
js 0x412502
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x412502
movzx edi, di
or edi, 0x80070000
mov ecx, esi
call fcn.00406300
push esi
call fcn.0040b812
add esp, 4
mov eax, edi
jmp 0x40643c
movzx edi, di
or edi, 0x80070000
test edi, edi
jmp 0x406432
mov eax, 0x8007000e
jmp 0x40643c

Function at 0x4065a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41b514], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x412610
mov eax, dword [ebp + 0xc]
mov ecx, 2
mul ecx
test edx, edx
jb 0x4065d9
ja 0x40662c
cmp eax, 0xffffffff
ja 0x40662c
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41267a
mov eax, dword [ebp - 0xc]
cmp eax, 1
jne 0x412602
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], 0
jne 0x40662c
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b820
mov esp, ebp
pop ebp
ret 8
mov eax, 0x80040153
jmp 0x406616
cmp eax, 2
jne 0x40662c
jmp 0x406607
mov esi, dword [ebp + 0xc]
inc esi
mov eax, esi
call fcn.00410060
mov ebx, esp
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41267a
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x412649
cmp eax, 2
jne 0x40662c
mov eax, dword [ebp - 8]
cmp byte [ebx + eax - 1], 0
jne 0x40662c
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x406614
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x406616
movzx eax, ax
or eax, 0x80070000
jmp 0x406616
Function at 0x4090d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xffffffff
je 0x409138
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x412d1a
test eax, eax
je 0x409131
push 0
push eax
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x412d1a
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x412d1a
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0x8000ffff
jmp 0x409133
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x409133
movzx eax, ax
or eax, 0x80070000
jmp 0x409133
Function at 0x40e6d9
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push ecx
lea ecx, [ebp - 0x210]
mov dword [ebx], esi
mov dword [ebx + 4], esi
call fcn.0040e3c4
push 0x402408
lea ecx, [ebp - 0x210]
call fcn.0040e37c
lea eax, [ebp - 0x210]
push eax
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov dword [ebp - 0x218], eax
test eax, eax
jne 0x40e751
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40e789
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.0040e1e9
mov esi, eax
jmp 0x40e789
lea edx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov ecx, eax
call fcn.0040ccd4
mov edi, eax
test edi, edi
jns 0x40e77d
push edi
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.0040e205
mov esi, edi
jmp 0x40e789
mov eax, dword [ebp - 0x214]
cdq
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea ecx, [ebp - 0x218]
call fcn.0040c25e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b820
leave
ret 8

Function at 0x40f629
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
mov ebx, ecx
mov dword [ebp - 4], esi
push 0x4024bc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
js 0x40f69c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x4024f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
js 0x40f69c
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40f6f0
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x4024bc
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
js 0x40f700
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x4024f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
js 0x40f700
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x40f6fb
cmp dword [ebp - 0xc], 1
jne 0x40f6fe
xor esi, esi
inc esi
mov dword [ebx], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413d5b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41b514], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x413dad
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x413e2d
lea eax, [ebp - 0x398]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x413e19
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
jne 0x413dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413e42
movzx eax, ax
or eax, 0x80070000
jmp 0x413e42
call fcn.00410060
mov edi, esp
xor eax, eax
push eax
push eax
push ebx
push edi
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x413dc4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x413e2d
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
je 0x413e2d
cmp eax, 0xffffffff
je 0x413e2d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413e42
mov eax, 0x80070002
jmp 0x413e42
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x80070002
lea esp, [ebp - 0x3a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b820
leave
ret
Function at 0x413fa9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
cmp ecx, 0x43
je 0x413fda
cmp ecx, 0x57
je 0x413fd3
mov eax, 0x80070057
jmp 0x414108
mov edi, 0x402838
jmp 0x413fdf
mov edi, 0x402888
push ebx
push esi
xor ecx, ecx
lea eax, [ebp - 0x210]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x108]
mov ebx, ecx
push eax
push ecx
jmp 0x4140c0
test eax, eax
jne 0x41411a
cmp byte [ebp - 0x108], 0x2e
jne 0x4140aa
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41411a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4028ae
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4140aa
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4140aa
dec eax
cmp eax, 0x104
jae 0x414115
push 1
mov edx, edi
mov byte [ebp + eax - 0x108], 0
lea ecx, [ebp - 0x20c]
call fcn.0041412c
test eax, eax
js 0x414106
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push SysReAllocString
mov dword [ebp - 0x210], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x413ffd
push 0
mov edx, edi
mov ecx, 0x4028a0
call fcn.0041412c
test eax, eax
js 0x414106
push 0
mov edx, edi
mov ecx, 0x402840
call fcn.0041412c
test eax, eax
js 0x414106
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040b820
leave
ret
call fcn.0040ba18
jle 0x414106
movzx eax, ax
or eax, 0x80070000
jmp 0x414106

Function at 0x41425b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4142b8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x414292
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414287
sub ecx, esi
jmp 0x414294
xor ecx, ecx
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push 0x4028ae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x4142c3
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret 8
Function at 0x4190df
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41b514], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x419122
push esi
push 0x104
push dword [ebp + 0xc]
push 0x4021a4
push 0x402804
push 0x4027dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x419259
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x419154
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x419262
movzx eax, ax
or eax, 0x80070000
jmp 0x419262
call fcn.00410060
mov ebx, esp
test ebx, ebx
je 0x41925d
xor eax, eax
push eax
push eax
push edi
push ebx
or edi, 0xffffffff
push edi
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x419139
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x4027dc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x419139
call fcn.00410060
mov eax, esp
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41925d
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x4027dc
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x419139
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x402804
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x419139
call fcn.00410060
mov eax, esp
mov dword [ebp - 8], eax
test eax, eax
je 0x41925d
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x402804
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x419139
push 4
pop eax
call fcn.00410020
mov esi, esp
test esi, esi
je 0x41925d
mov eax, 0x108
mov byte [esi], 0
call fcn.00410060
mov edi, esp
test edi, edi
je 0x41925d
push ebx
mov ebx, 0x104
push ebx
push edi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x419139
xor eax, eax
jmp 0x419262
mov eax, 0x8007000e
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b820
leave
ret 0x10
Function at 0x41927c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41b514], 0
mov eax, ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], eax
je 0x4192b5
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x419309
xor esi, esi
test edi, edi
je 0x419329
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4192d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x419309
call fcn.00410060
mov ebx, esp
push esi
push esi
push dword [ebp - 8]
push ebx
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4192d1
mov eax, dword [ebp - 0xc]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jle 0x419315
movzx eax, ax
or eax, 0x80070000
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b820
leave
ret 4
mov ebx, esi
jmp 0x4192f8

Function at 0x41991f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
mov esi, 0xc04
push eax
push 8
push 0x404
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41996d
push 3
lea eax, [ebp - 0x44]
push 0x402cb8
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffff800
add esi, eax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0040b820
leave
ret

Function at 0x419983
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x41b6b4]
jne 0x419a1f
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x402cc0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419a1e
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x402d78
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x419a1e
push 3
push dword [edi*8 + 0x401670]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x419a10
inc edi
cmp edi, 0x1c
jb 0x4199ee
jmp 0x419a1e
mov ax, word [edi*8 + 0x401674]
mov word [0x41b6b4], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x41b6b4]
xor ecx, ebp
call fcn.0040b820
leave
ret
Function at 0x1000ee90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1001e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x1000eed2
dec eax
jne 0x1000eee2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x1001e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x1001e3d8], eax
jmp 0x1000eee2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x1001e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.10017ff3
add esp, 0x194
ret 0xc
Function at 0x10010ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10010fff
pop dword [ebp - 0x38]
mov eax, 0x10010fff
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc95b6f34
sub dword [ebp - 0x48], 0x7b0929e9
mov dword [ebp - 0x44], 0xfc2b17ae
sub dword [ebp - 0x44], 0xc9f7cb69
mov dword [ebp - 0x40], 0xce317989
add dword [ebp - 0x40], 0x7e1acaa5
mov dword [ebp - 0x3c], 0x9affff20
sub dword [ebp - 0x3c], 0x9affff20
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa468fd85
sub dword [ebp - 0x48], 0x2ff6942f
mov dword [ebp - 0x44], 0x735a2b18
add dword [ebp - 0x44], 0xce12365d
mov dword [ebp - 0x40], 0xe348b5ba
sub dword [ebp - 0x40], 0x7fd9494e
mov dword [ebp - 0x3c], 0x69c62f80
add dword [ebp - 0x3c], 0x9639d080
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39531
push 0
call eax
mov ecx, 0x80f071ef
sub ecx, 0x80f01ec5
xor ebx, ebx
add ebx, eax
mov edi, 0x872bc1d5
add edi, 0x88d6582b
add edi, dword [ebp - 0x38]
mov edx, 0x86d92b58
sub edx, 0x49f6eac7
xor dword [ebp - 0x24], 0xfeb19dfe
mov esi, dword [edi]
xor dword [ebp - 0x18], eax
sub esi, edx
mov dword [ebx], esi
xor dword [ebp - 0xc], 0xd8852086
add ebx, 0xaef3a191
sub ebx, 0xaef3a18d
add edi, 0x4e2474d5
sub edi, 0x4e2474d1
loop 0x10011114
add eax, 0xb55050a9
add eax, 0x4ab0eed2
xor ebx, ebx
add ebx, eax
add eax, 0xe10de93f
add eax, 0x1ef216c6
mov ecx, 0x7890efc3
add ecx, 0x976f103d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x258010a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x258010b6
pop dword [ebp - 0x3c]
mov eax, 0x258010b6
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x57b4f413
add dword [ebp - 0x4c], 0xf69d5138
mov dword [ebp - 0x48], 0x5c08a8d7
sub dword [ebp - 0x48], 0x29d55c92
mov dword [ebp - 0x44], 0x7d348e5d
sub dword [ebp - 0x44], 0x30e84a2f
mov dword [ebp - 0x40], 0x6f53c4f5
add dword [ebp - 0x40], 0x90ac3b0b
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xb95cfc09
sub eax, 0x93db2bc5
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x7ad146e9
add dword [ebp - 0x4c], 0xf9a1226d
mov dword [ebp - 0x48], 0xd058d79c
sub dword [ebp - 0x48], 0x8eec7627
mov dword [ebp - 0x44], 0xc1da1674
add dword [ebp - 0x44], 0xa19555f8
mov dword [ebp - 0x40], 0xcbedfea5
add dword [ebp - 0x40], 0x3412015b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2e4
push 0
call eax
mov ecx, 0xc2623dd1
sub ecx, 0xc261fb50
xor edx, edx
add edx, eax
mov ebx, 0x7e0c3087
add ebx, 0xa7766579
add ebx, dword [ebp - 0x3c]
mov esi, 0xbdc9af8d
sub dword [ebp - 0x10], ebx
mov edi, dword [ebx]
xor dword [ebp - 0x28], ebx
add edi, esi
add dword [ebp - 4], 0xb4b2c40a
mov dword [edx], edi
xor dword [ebp - 0x38], edx
add edx, 4
add ebx, 0xc5c7ed4b
add ebx, 0x3a3812b9
loop 0x258011ca
add eax, 0x11f053d1
add eax, 0xee10a906
xor ebx, ebx
add ebx, eax
add eax, 0x9473e84b
add eax, 0x6b8c17ba
mov ecx, 0xe3df0bcc
add ecx, 0x41a0f434
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x25807297
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bb95
call fcn.2581acc1
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x25824498]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cc0]
cmp eax, dword [ecx + 4]
jg 0x25807364
cmp byte [0x25823cbc], 0
je 0x2580735e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.258010a7
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580735e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.258010a7
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cd40
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cca0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580735e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.258010a7
pop ecx
pop ecx
call fcn.2581acb0
ret
mov edi, 0x25823cc0
push edi
call fcn.258010a7
cmp dword [0x25823cc0], 0xffffffff
pop ecx
jne 0x258072c5
mov eax, dword [0x25823df0]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258073c2
mov eax, dword [0x258240cc]
push ebx
push str.enableTMSLogging
push 0x2581db80
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258073c6
jmp 0x258073c2
mov al, bl
jmp 0x258073c6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cbc], al
call fcn.258010a7
pop ecx
jmp 0x258072c5
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4043b6a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x66b748c8
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x6e9012f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6e901325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6e901325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6e90132c
mov eax, 1
jmp 0x6e901331
mov eax, 0
leave
ret