joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3048ee04
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3048eeb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.304054b0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x3048eea2
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.3040563c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.304054b0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x3048eea2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x3048eec8
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x3048eea2
cmp dword [ebp - 0x14], 0x34
jne 0x3048eea2
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3048eebf
lea eax, [ebp - 0x1c]
call fcn.30404ff0
ret

Function at 0x3048f114
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3048f27d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.30403574
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x304eb888], eax
mov eax, dword [ebp - 0xc]
mov dword [0x304eb88c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x304eb890], eax
mov eax, dword [0x304f0afc]
cmp dword [eax], 2
sete byte [0x304eb7f8]
push 0x3048f288
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.3048ed3c
cmp byte [0x304eb7f8], 0
jne 0x3048f1a0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.3048ee04
test al, al
je 0x3048f1a0
mov eax, dword [ebp - 0x4c]
mov dword [0x304f2890], eax
jmp 0x3048f1a7
xor eax, eax
mov dword [0x304f2890], eax
call fcn.3048ef94
and eax, 0x7f
cmp eax, 0xb
ja case.0x3048f1b8.0
jmp dword [eax*4 + 0x3048f1bf]
mov byte [0x304eb7e4], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7e8], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7ec], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7f0], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7f4], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7fc], 1
mov byte [0x304eb800], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7fc], 1
mov byte [0x304eb804], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb7fc], 1
mov byte [0x304eb808], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb80c], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb810], 1
jmp case.0x3048f1b8.0
mov byte [0x304eb814], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3048f284
lea eax, [ebp - 4]
call fcn.30404ff0
ret
Function at 0x304ba8df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x304ec7d6
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x304ba937
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x304ec7f7
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x304ba92d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x304ba93b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x304d9ecc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x304d9f00
add eax, 3
sar eax, 2
test eax, eax
jle 0x304da05e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x304d9f3d
je 0x304d9fa3
sub eax, 0x2b
je 0x304d9f8f
sub eax, 4
je 0x304d9f99
dec eax
sub eax, 0xa
jb 0x304d9f79
jmp 0x304d9fab
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x304d9f4f
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x304d9f63
jmp 0x304d9fab
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x304d9fab
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x304d9fab
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x304d9fab
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x304d9fab
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x304d9fab
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x304d9f1a
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x304da00f
cmp byte [ebp - 0x21], 0xff
jne 0x304da00f
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x304da04f
cmp byte [ebp - 0x22], 0xff
je 0x304da04f
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x304d9f15
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x304db0a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x304db0ec
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
xor byte [edx + ecx], al
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x304db0d2
mov esp, ebp
pop ebp
ret

Function at 0x304dc334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [ebp - 5]
dec eax
test eax, eax
jb 0x304dc3c6
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
shl eax, 2
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax]
lea eax, [eax*4 + 0x304ef1d8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 1]
lea edx, [edx*4 + 0x304ef5d8]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 2]
lea edx, [edx*4 + 0x304ef9d8]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 3]
lea edx, [edx*4 + 0x304efdd8]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
lea edx, [ecx + edx]
mov dword [edx], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x304dc355
mov esp, ebp
pop ebp
ret
Function at 0x304e5c44
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x304e5dab
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.3040aa60
lea eax, [ebp - 0x1c]
mov edx, 0x304e5dc4
call fcn.304052b8
lea eax, [ebp - 0x1c]
mov edx, 0x304e5dd0
call fcn.304052b8
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
call fcn.30405508
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x24]
mov eax, dword [0x304f05a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x344]
mov edx, 0x304e5ddc
call fcn.30479f24
push dword [ebp - 0x24]
push dword [ebp - 4]
push 0x304e5dec
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.3040a1b4
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.30405370
mov edx, dword [ebp - 0x20]
mov eax, dword [0x304f05a0]
mov eax, dword [eax]
call fcn.304e6fb8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
cmp dword [ebp - 4], 0
jne 0x304e5d2f
mov dword [ebp - 0xc], 0xffffffff
jmp 0x304e5d49
mov eax, dword [ebp - 4]
call fcn.3040a720
test al, al
jne 0x304e5d44
mov dword [ebp - 0xc], 0xfffffffe
jmp 0x304e5d49
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x304e5d90
lea ecx, [ebp - 0x2c]
mov eax, dword [0x304f05a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x344]
mov edx, 0x304e5dfc
call fcn.30479f24
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.3040a0c8
mov edx, dword [ebp - 0x30]
pop eax
call fcn.304052b8
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x304f05a0]
mov eax, dword [eax]
call fcn.304e6fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x304e5db2
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.30405014
ret

Function at 0x304e5e5c
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x304e5edd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.30402b6c
mov dword [ebp - 0x10], eax
push 0xff
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x304e5eb4
push 0x7000001
call sub.wsock32.dll_htonl
mov dword [ebp - 8], eax
jmp 0x304e5ec1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x304e5ee4
cmp dword [ebp - 0x10], 0
je 0x304e5edc
mov eax, dword [ebp - 0x10]
call fcn.30402b9c
ret
Function at 0x304e6628
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x304e6861
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x304e67f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x64]
mov eax, dword [0x304f0834]
mov eax, dword [eax]
call fcn.3046879c
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.3040aa2c
lea eax, [ebp - 0x60]
mov edx, 0x304e687c
call fcn.304052b8
mov ecx, dword [ebp - 0x60]
mov dl, 1
mov eax, dword [0x30439e8c]
call fcn.30439f3c
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x304e6890
mov edx, 0x304e68a0
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
add eax, 0x40
call fcn.30405044
push 0
mov ecx, 0x304e68b0
mov edx, 0x304e68cc
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x368], eax
push 0
mov ecx, 0x304e68e4
mov edx, 0x304e68cc
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x36c], eax
push 0
mov ecx, 0x304e68fc
mov edx, 0x304e68cc
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x370], eax
push 0x7530
mov ecx, 0x304e691c
mov edx, 0x304e68cc
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x374], eax
push 0
mov ecx, 0x304e6934
mov edx, 0x304e6948
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
dec eax
mov eax, dword [0x304f08fc]
sete byte [eax]
mov eax, dword [ebp - 0x14]
call fcn.304040a0
mov dword [ebp - 0xc], 0x40
lea eax, [ebp - 0x59]
xor ecx, ecx
mov edx, 0x40
call fcn.304084cc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x59]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x59]
mov ecx, 0x41
call fcn.30405260
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x10]
mov edx, 0x304e695c
call fcn.304052fc
mov eax, dword [0x304f08fc]
cmp byte [eax], 0
je 0x304e67c8
mov dl, 1
mov eax, dword [0x304e1700]
call fcn.304e17c8
mov dword [0x304f2a6c], eax
jmp 0x304e67d9
mov dl, 1
mov eax, dword [0x304e2f10]
call fcn.304e327c
mov dword [0x304f2a6c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [0x304f2a6c]
mov ebx, dword [eax]
call dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x304e683e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x304e6868
lea eax, [ebp - 0x70]
mov edx, 5
call fcn.30405014
lea eax, [ebp - 0x10]
call fcn.30404ff0
ret
Function at 0x304e90fc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
xor ebx, ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.304054a0
xor eax, eax
push ebp
push 0x304e9211
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x141]
mov edx, dword [ebp - 8]
call fcn.3040ace4
mov eax, dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x141]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
jne 0x304e91a7
lea ecx, [ebp - 0x148]
mov edx, 0x304e9228
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x344]
call fcn.30479f24
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 8]
call fcn.304052b8
mov ecx, dword [ebp - 0x148]
mov dl, 1
mov eax, dword [0x30408b5c]
call fcn.3040e404
call fcn.30404944
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.304061b0
jno 0x304e91c7
call fcn.30403fdc
call fcn.304061b0
jno 0x304e91d3
call fcn.30403fdc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x304e91ed
call fcn.30403fd4
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x304e9218
lea eax, [ebp - 0x148]
call fcn.30404ff0
lea eax, [ebp - 8]
call fcn.30404ff0
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4484ba3
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x8b36ffb
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x181393a6
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov byte [ebp - 4], dl
push 1
lea edx, [ebp - 4]
mov ecx, dword [esi]
not ecx
call fcn.18135142
mov ecx, dword [esi + 8]
lea edx, [ebp - 4]
not eax
not ecx
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
call fcn.18135142
pop ecx
not eax
pop ecx
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x181393f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jb 0x18139485
ja 0x18139415
cmp dword [ebp + 0xc], edx
jbe 0x18139485
test eax, eax
je 0x18139463
mov eax, dword [ebp + 8]
mov bl, byte [edi + eax]
mov ax, word [ecx + 8]
mov dl, bl
or ax, 2
movzx esi, ax
call fcn.181393a6
mov eax, esi
mov ecx, esi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0xc]
shr ecx, 8
xor cl, bl
mov byte [edi + eax], cl
add edi, 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x18139419
ja 0x18139485
cmp edi, dword [ebp + 0xc]
jb 0x18139419
jmp 0x18139485
mov ebx, dword [ebp + 8]
mov esi, edx
mov dl, byte [esi + ebx]
call fcn.181393a6
mov ecx, dword [ebp - 4]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x18139468
ja 0x18139485
cmp esi, dword [ebp + 0xc]
jb 0x18139468
pop edi
pop esi
pop ebx
leave
ret

Function at 0x181394ed
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18139530
push esi
push 0xb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18139530
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x18139530
mov al, 1
jmp 0x18139532
xor al, al
pop esi
leave
ret

Function at 0x1815450b
Capabilities:
Enumerate pe sections

Disassembly:
or byte [esi + 0x57], dl
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x18154543
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1815452a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1815453b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x18154545
inc edi
add eax, 0x28
cmp edi, esi
jb 0x18154520
xor eax, eax
pop edi
pop esi
ret
Function at 0x18154b63
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x18154b7c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x18154b77
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x18154b61
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x18154b69
cmp edx, ebx
jne 0x18154cb7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x18154b38
add eax, dword [eax + 4]
jmp 0x18154b25
mov dword [ebp + 0xc], ebx
jmp 0x18154b87
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x18154b9f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x18154bbd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x18154c1b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x18154c02
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x18154c0b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x18154c15
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x18154bf7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x18154b81
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x18154c68
dec eax
je 0x18154c5f
sub eax, 3
je 0x18154c56
mov dword [ebp - 4], 0x40
jmp 0x18154c85
mov dword [ebp - 4], 4
jmp 0x18154c6b
mov dword [ebp - 4], 0x20
jmp 0x18154c6b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x18154cb7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x18154c37
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.181544c8
or cl, dh
mov ah, 0xe
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x18154cc3
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18154e29
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
invalid
jb 0x18154e5a