joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426c40
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x254
mov esi, dword [ebp + 8]
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x426cac
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x426cde
lea eax, [ebp - 0x22c]
push 0x105
push eax
push 0x43479c
call fcn.0040d26d
add esp, 0xc
mov esi, 0x43479c
mov word [0x4349a4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040dac1
mov eax, esi
add esp, 0x254
pop esi
pop ebp
ret
lea eax, [esi + 4]
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x426c70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0040d386
cmp esi, 2
jne 0x426cf8
mov dword [eax], 2
jmp 0x426cfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x12
je 0x426c97
call fcn.0040d386
mov dword [eax], 2
jmp 0x426c97
mov dword [eax], 9
xor esi, esi
jmp 0x426c97

Function at 0x43b65d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
or esi, ecx
mov ecx, esi
or ecx, ecx
call fcn.0043b698
inc ecx
dec esi
dec ecx
xor dword [edi], edx
sub esi, 1
sub esi, 0x85bc9500
dec esi
inc edi
sub ecx, 0x7aa5710b
cmp edi, ebx
jne fcn.0043b65d
or ecx, esi
sub esi, 0x13065a3a
inc ecx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x516364a1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, str._nQp
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x512e3cc0
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x9c0370
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9c04c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9c0396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9c0382
add dl, dl
jne 0x9c03a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9c03f4
xor eax, eax
add dl, dl
jne 0x9c03ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9c0495
add dl, dl
jne 0x9c03bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9c03c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9c03d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9c03de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9c03ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9c038d
mov eax, 1
add dl, dl
jne 0x9c0402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9c040d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9c03f9
sub eax, ebx
mov ebx, 1
jne 0x9c0440
mov ecx, 1
add dl, dl
jne 0x9c0426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9c0431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9c041d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9c038d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9c0457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9c0462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9c044e
cmp eax, 0x7d00
jae 0x9c0485
cmp eax, 0x500
jb 0x9c0480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9c038d
cmp eax, 0x7f
ja 0x9c0488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9c038d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9c04b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9c038d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xa30c5f
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0xa30cb6
push edi
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0xb088fb
cmp dword [esi + 0x20], edi
jne 0xb08916
mov eax, dword [esi + 0x24]
test eax, eax
jne 0xb08931
cmp dword [esi + 0x10], 0
jne 0xb089b5
cmp dword [esi + 0x14], 0
jne 0xb089d0
cmp dword [esi + 0x18], 0
jne 0xb089eb
mov ecx, dword [esi + 0x2c]
test ecx, ecx
jne 0xb08a06
pop edi
pop esi
leave
ret
push dword [esi + 0xc]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0xc], edi
jmp 0xa30c78
push dword [esi + 0x20]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0x20], edi
jmp 0xa30c81
push ebx
mov ebx, edi
cmp dword [eax], edi
jbe 0xb08997
mov dword [ebp - 4], edi
add edi, 4
add edi, eax
je 0xb08984
mov ecx, dword [edi + 8]
test ecx, ecx
je 0xb08952
call fcn.00c5d1fc
and dword [edi + 8], 0
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0xb08962
call fcn.00c5d1fc
and dword [edi + 0xc], 0
cmp dword [edi + 0x14], 0
je 0xb08984
push dword [edi + 0x14]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [edi + 0x10], 0
and dword [edi + 0x14], 0
mov eax, dword [esi + 0x24]
inc ebx
mov edi, dword [ebp - 4]
add edi, 0x18
mov dword [ebp - 4], edi
cmp ebx, dword [eax]
jb 0xb0893b
xor edi, edi
pop ebx
test eax, eax
je 0xb089ad
push eax
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0x24], edi
jmp 0xa30c8c
push dword [esi + 0x10]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0x10], edi
jmp 0xa30c96
push dword [esi + 0x14]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0x14], edi
jmp 0xa30ca0
push dword [esi + 0x18]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0x18], edi
jmp 0xa30caa
call fcn.00bee87f
mov dword [esi + 0x2c], edi
jmp 0xa30cb5
Function at 0xa3201b
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0xc804e0
call fcn.00ab48b0
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je 0xa320a3
xor esi, esi
cmp dword [ecx + 0x14], esi
je 0xa320a3
cmp dword [ecx + 0xc], esi
ja 0xa32046
jb 0xa32096
cmp dword [ecx + 8], 0x40
jb 0xa32096
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1c], 3
test eax, eax
je 0xb09cf9
cmp eax, 0xffffffff
je 0xb09cf9
mov dword [ebp - 4], esi
mov edx, 0x5a4d
cmp word [eax], dx
je 0xb09c5c
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
mov eax, edx
mov dword [eax], 3
jmp 0xb09d1d
mov eax, edx
mov dword [eax], 1
jmp 0xb09d1d
mov dword [ebp - 0x1c], 4
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x30], edx
lea edi, [edx + 4]
cmp dword [ecx + 0xc], esi
ja 0xb09c80
jb 0xa32072
cmp dword [ecx + 8], edi
jb 0xa32072
add eax, edx
mov dword [ebp - 0x34], eax
cmp dword [eax], 0x4550
jne 0xb09c99
mov dword [ebp - 0x1c], 6
jmp 0xa32072
mov ecx, 0x454e
cmp word [eax], cx
jne 0xa32072
mov dword [ebp - 0x1c], 5
jmp 0xa32072
mov esi, 0xc000000d
push esi
push 0xa290c4
push 0x4e8
push 0xa290e0
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xa3207c
xor eax, eax
jmp 0xa32086
Function at 0xa320b0
Capabilities:
Get file attributes
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 0x21], dl
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
xor esi, esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x38], esi
push 6
pop ecx
mov dword [ebp - 0x34], esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
cmp dword [ebx + 0x10], esi
jne 0xb09d24
push 5
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebx]
call dword [sym.imp.ntdll.dll_ZwQueryInformationFile]
mov edi, eax
test edi, edi
js 0xa321d6
push dword [ebx]
xor eax, eax
mov dword [ebp - 0x50], 0x18
cmp byte [ebp - 0x21], al
mov dword [ebp - 0x4c], esi
setne al
mov dword [ebp - 0x44], esi
dec eax
mov dword [ebp - 0x48], esi
and eax, 0xf7000000
mov dword [ebp - 0x40], esi
add eax, 0x11000000
mov dword [ebp - 0x3c], esi
push eax
push 2
push esi
lea eax, [ebp - 0x50]
push eax
push 0xf0005
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
mov edi, eax
test edi, edi
js 0xa321d6
push 2
push 0x500000
push 2
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
mov edi, eax
test edi, edi
js 0xa321d6
mov eax, dword [ebp - 0x28]
mov edi, esi
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov al, byte [ebp - 0x21]
mov byte [ebx + 0x1b], al
mov eax, esi
mov word [ebx + 0x19], 0x101
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0xb09d2e
test eax, eax
jne 0xb09d3d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
jmp 0xa321b5
mov edi, 0xc000010e
jmp 0xa321c5
push esi
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, dword [ebp - 0x2c]
jmp 0xa321bd
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
jmp 0xa321c5
Function at 0xa3222e
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x38], eax
push esi
push edi
test ebx, ebx
je 0xb09ebc
xor ecx, ecx
cmp word [ebx], cx
je 0xb09ebc
test eax, eax
je 0xb09ebc
mov dword [eax], ecx
lea eax, [ebp - 0x30]
push ebx
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword fs:[0x30]
push 0x38
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0xb09e00
mov edx, ebx
mov ecx, edi
call fcn.00a323fd
mov esi, eax
test esi, esi
js 0xb09e0a
push 0xc
push 0x9ede40
push ebx
call fcn.00ab4bba
add esp, 0xc
test eax, eax
je 0xa322d2
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov esi, eax
test esi, esi
js 0xb09e26
lea eax, [edi + 8]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, eax
call fcn.00a32379
mov esi, eax
test esi, esi
js 0xb09e69
and dword [ebp - 0x40], 0
lea edi, [ebp - 0x24]
and dword [ebp - 0x3c], 0
xor eax, eax
push 6
pop ecx
push 5
rep stosd dword es:[edi], eax
push 0x18
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.ntdll.dll_ZwQueryInformationFile]
mov esi, eax
test esi, esi
js 0xb09e9a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x18]
je 0xa3236b
push 2
pop eax
mov dword [ecx + 0x28], eax
xor edi, edi
mov eax, dword [ebp - 0x38]
xor esi, esi
mov dword [eax], ecx
test edi, edi
jne 0xa32370
cmp dword [ebp - 0x2c], ebx
je 0xa32358
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0xc
xor eax, eax
inc eax
jmp 0xa32339
mov ecx, edi
call fcn.00a32a08
jmp 0xa32349
mov esi, 0xc0000017
jmp 0xa32349
push esi
push 0xa1ec68
push 0x79
push 0xa29024
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xa32345
push esi
push ebx
push 0xa28740
push 0x92
jmp 0xb09e40
push esi
push ebx
push 0xa28ff4
push 0x9f
push 0xa29024
push 1
jmp 0xb09e5c
push esi
push ebx
push 0xa28ff4
push 0xa1
push 0xa29024
push 3
call fcn.00a32ac8
add esp, 0x18
jmp 0xa32345
mov ecx, esi
call fcn.00c5c53e
test eax, eax
jne 0xa32345
cmp esi, 0xc0000022
je 0xb09e49
cmp esi, 0xc0000043
je 0xb09e49
cmp esi, 0xc0000013
je 0xb09e49
cmp esi, 0xc00000ba
je 0xb09e49
jmp 0xb09e34
push esi
push 0xa289a4
push 0xb5
push 0xa29024
push 1
call fcn.00a32ac8
mov edi, dword [ebp - 0x28]
add esp, 0x14
jmp 0xa32345
mov eax, 0xc000000d
jmp 0xa3235a
Function at 0xa3292e
Capabilities:
Get number of processors

Disassembly:
push 0xc
push 0xc80500
call fcn.00ab48b0
push 0x9ede74
push 0x53
mov edi, 0x9ede60
push edi
push 3
call fcn.00a32ac8
add esp, 0x10
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x27c]
cmp dword [esi + 0x278], ebx
jne 0xb0a0b0
test ecx, ecx
jg 0xb0a0ea
mov ecx, esi
call fcn.00a32aa2
test byte [esi + 0x58], 2
jne 0xb0a101
mov ecx, dword [esi + 4]
test ecx, ecx
je 0xa32990
call fcn.00a329cd
mov edx, dword [esi + 0x1a4]
test edx, edx
jne 0xa329c4
push esi
push ebx
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, esi
call fcn.00beffd5
jmp 0xa32990
or eax, 0xffffffff
lock xadd dword [ecx + 0x27c], eax
dec eax
mov dword [ebp - 0x1c], eax
jns 0xa3299a
mov eax, dword [esi + 0x27c]
add eax, 0x27c
lock inc dword [eax]
push 0x9fd6a0
push 0x64
push edi
push 1
call fcn.00a32ac8
add esp, 0x10
jmp 0xa3299a
push 0x9fd6d0
push 0x72
push edi
push 1
call fcn.00a32ac8
add esp, 0x10
jmp 0xa329ab
mov ecx, dword [esi + 0x54]
call fcn.00a329cd
jmp 0xa32984

Function at 0xa329cd
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x53c]
test eax, eax
jne 0xb0a120
test byte [esi + 0x10], 8
jne 0xb0a181
mov ecx, dword [esi]
call fcn.00a32a08
mov eax, dword fs:[0x30]
push esi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
ret
cmp dword [eax + 8], 1
jne 0xa329e3
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xb0a148
mov eax, dword fs:[0x30]
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esi + 0x53c]
test eax, eax
je 0xb0a15d
push eax
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [esi + 0x540]
mov dword [esi + 0x53c], edi
test ecx, ecx
je 0xa329e3
call fcn.00c5d1fc
mov dword [esi + 0x540], edi
jmp 0xa329e3
test byte [esi + 0x10], 1
je 0xa329ed
cmp dword [esi + 4], edi
je 0xa329ed
push dword [esi + 4]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
jmp 0xa329ed
Function at 0xa32d51
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x20], ecx
push esi
push edi
lea edi, [ebp - 0x10]
mov ebx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
test ecx, ecx
je 0xa32da5
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetNativeSystemInformation]
mov esi, eax
test esi, esi
js 0xb0a303
mov ecx, dword [ebp - 0x20]
mov ax, word [ebp - 0x10]
mov word [ecx], ax
test ebx, ebx
jne 0xb0a32e
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0xc
push esi
push 0xa28100
push 0x700
jmp 0xb0a31b
push esi
push 0xa280b4
push 0x722
push 0xa2812c
push edi
call fcn.00a32ac8
add esp, 0x14
jmp 0xa32daf
push 0
push 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov esi, eax
test esi, esi
js 0xb0a310
mov ax, word [ebp - 0x1c]
mov word [ebx], ax
jmp 0xa32dad

Function at 0xa349ff
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push 5
pop ecx
push 4
push eax
push 4
add esi, 0x10
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [0xc959dc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
jne 0xb0aefb
pop edi
pop esi
leave
ret 4
mov ecx, dword [ebp + 4]
push eax
push 0x9fd0c8
push 0x64
pop edx
call fcn.00b5b6e5
jmp 0xa34a39
Function at 0xa34a95
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp byte [0xc959d9], bl
je 0xa34ac0
mov eax, dword [0xc959d8]
shr eax, 8
test al, al
je 0xb0af5e
mov al, byte [0xc959d8]
pop ebx
leave
ret
push esi
push edi
mov edi, dword [0xc959dc]
test edi, edi
jne 0xb0af11
push 0xc959dc
push 0x9edfa0
push reloc.SHCORE.dll_Ordinal_1
mov dword [0xc959dc], ebx
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegCreateKeyW]
test eax, eax
jne 0xa34b23
push ebx
push ebx
push ebx
push 0x40
mov esi, 0x9edf80
push esi
push ebx
push dword [0xc959dc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb0af2c
mov word [ebp - 2], 0x101
mov ax, word [ebp - 2]
pop edi
mov word [0xc959d8], ax
pop esi
jmp 0xa34aa8
mov word [ebp - 2], pe_nt_image_headers32
jmp 0xa34b15
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa34ad0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push ebx
push dword [0xc959dc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
neg eax
mov byte [ebp - 1], 1
sbb al, al
inc al
mov byte [ebp - 2], al
jmp 0xa34b15
push 0xc859dc
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 0x9e73bc
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0xa35e73
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0x1c
mov eax, 0xafbdea
call fcn.00af8e62
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
mov esi, 0x811c9dc5
and dword [ebp - 4], 0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], edx
xor edx, edx
lea edi, [eax + eax]
test edi, edi
je 0xa35eb6
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ecx + edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, edi
jb 0xa35ea2
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 0x18]
lea eax, [ebp - 0x28]
and edi, esi
push edi
push eax
mov dword [ebp - 0x20], edi
call fcn.00a360e3
mov esi, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
cmp esi, dword [eax + edi*8]
jne 0xa35f68
or dword [ebp - 4], 0xffffffff
lea edi, [ecx + 4]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], edi
push dword [eax]
call fcn.00a35f92
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
mov edi, dword [eax]
mov dword [ebp - 0x24], edi
mov eax, dword [edi]
cmp esi, eax
je 0xa35f2a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], edx
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [eax + edx*8], ecx
mov ecx, dword [ebp - 0x14]
jne 0xa35f84
mov dword [eax + edx*8], edi
mov eax, dword [ecx + 0xc]
mov dword [eax + edx*8 + 4], edi
mov dword [ebp - 4], 2
call fcn.00a35fe3
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
call fcn.00af8dc0
ret 0xc
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00a3610c
test al, al
jne 0xa35eca
jmp 0xb0b7d7
cmp dword [eax + edx*8], esi
jne 0xb0b7e5
mov dword [eax + edx*8], edi
jmp 0xa35f4b
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
jmp 0xa35f60
mov eax, dword [eax + edx*8 + 4]
mov esi, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esi + edx*8 + 4], eax
cmp eax, edi
je 0xa35f4b
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov ecx, dword [ebp - 0x14]
jmp 0xa35f4b
Function at 0xa36046
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push esi
push edi
mov edi, ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
xor ecx, ecx
mov dword [ebp - 8], edi
lea esi, [eax + eax]
test esi, esi
je 0xa36084
mov edi, dword [ebp - 4]
movzx eax, byte [ecx + edi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, esi
jb 0xa36070
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x18]
mov esi, dword [edi + 0xc]
and eax, edx
mov dword [ebp - 8], eax
mov esi, dword [esi + eax*8]
push eax
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00a360e3
cmp esi, dword [eax]
jne 0xa360b0
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov dword [eax], ecx
pop edi
pop esi
leave
ret 8
push dword [ebp + 0xc]
lea eax, [esi + 8]
push eax
call fcn.00a3610c
test al, al
je 0xa360c7
mov esi, dword [esi]
mov eax, dword [ebp - 8]
jmp 0xa36092
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00a3610c
test al, al
jne 0xa360de
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0xa360aa
mov esi, dword [edi + 4]
jmp 0xa360d7