joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c4c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0xc], dl
push ebx
push esi
push edi
test dl, dl
je 0x1002c584
mov dword [ebp - 0x20], 0x5ee2
cmp dword [ebp - 0x20], 0x5f38
push 0
pop ebx
jle 0x1002c55c
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x18], 0x65fd
mov dword [ebp - 0x14], eax
mov esi, eax
mov dword [ebp - 0x10], 0x6796
mov eax, esi
lea ecx, [ebp - 0x38]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c51f
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.100040fa
inc esi
dec dword [ebp - 0x10]
jne 0x1002c506
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
add eax, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x1002c4fd
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6c12
jl 0x1002c4f1
inc edi
cmp edi, 0x79ec
jl 0x1002c4ee
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1002c56e
push ecx
xor cl, cl
call fcn.1002bb38
pop ecx
cmp dword [ebp - 0x20], 0x5cce
jge 0x1002c59b
push str.dkbibabi_ripo_digfjwtj_wcbdfe
call fcn.10036008
pop ecx
jmp 0x1002c59b
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x2266
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002c8d5
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1004be09
call fcn.1004ae30
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], 0x31b4
cmp dword [ebp - 0x1c], 0x32eb
push edi
mov dword [ebp - 0x10], esp
jle 0x1002c93d
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10062a18
or eax, ebx
cdq
push edx
push eax
call fcn.10003a17
inc ebx
cmp ebx, 0x3b4e
jl 0x1002c90b
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x14f9
jl 0x1002c902
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x331b
jl 0x1002c900
cmp byte [ebp - 0x14], 0
je 0x1002c956
push 0
push 1
push 0x1576
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x1002c963
push 0x10a1
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2ef8
jge 0x1002c97f
mov edx, str.fysqq_bgj_jxbz_kqo_qddwtsgkz_yopfdg_ljzoajy_nnqztn_tddpkrep_noy_fqbcejsyc_puujty_qivwyf
mov ecx, 0x10062a18
call fcn.10006198
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002cadb
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x14], 0
mov eax, ecx
push ebx
push esi
push edi
mov byte [ebp - 4], dl
mov dword [ebp - 0xc], eax
je 0x1002cb3f
cmp byte [ebp + 0x10], 0
je 0x1002cb1a
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002cbfb
mov dl, 1
push 0
push 0x600
mov cl, dl
call fcn.1002c9c6
pop ecx
jmp 0x1002cbdf
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002cbfb
push 0x17f
push 0
push 0x5a35
call fcn.1002c158
add esp, 0xc
jmp 0x1002cbfb
test dl, dl
je 0x1002cbe2
mov dword [ebp - 8], 0x7030
cmp dword [ebp - 8], 0x7363
jle 0x1002cbbf
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 0x14], ecx
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x24]
and eax, edi
and eax, esi
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002cb7f
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.100040fa
mov ecx, dword [ebp + 0x14]
inc ecx
mov dword [ebp + 0x14], ecx
cmp ecx, 0x193
jl 0x1002cb62
inc ebx
cmp ebx, 0x5d0a
jl 0x1002cb5d
inc edi
cmp edi, 0x1131
jl 0x1002cb5b
inc esi
cmp esi, 0x3a61
jl 0x1002cb59
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
je 0x1002cbcc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 8], 0x6e2a
jge 0x1002cbfb
push str.idj_nutqzti_btmsx_ajx_afuaxsueb_ldzmjl_xfpqfmcj_ujarinw_orpgr_ftxakwxb_zsnpnfh_uval
call fcn.10036008
pop ecx
jmp 0x1002cbfb
push 0xca0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002ce83
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x1002cea7
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002cec0
sub esp, 0xc
xor dl, dl
call fcn.1002c4c5
add esp, 0xc
jmp 0x1002cec0
cmp byte [ecx], 0
je 0x1002cec0
push 0x11ac
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret

Function at 0x1002d92c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1004be32
call fcn.1004ae30
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
je 0x1002d9d7
mov dword [ebp - 0x14], 0x4eb1
cmp dword [ebp - 0x14], 0x5152
jle 0x1002d991
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10062a18
xor eax, esi
cdq
push edx
push eax
call fcn.10003a17
inc edi
cmp edi, 0x2b7b
jl 0x1002d95f
inc esi
cmp esi, 0x415
jl 0x1002d95d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
cmp byte [ebx], 0
je 0x1002d99f
push ecx
xor cl, cl
call fcn.1002b7aa
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4e54
jge 0x1002d9bb
mov edx, str.tywb_zta_lxznlvfxo_pjuyhl_uowu
mov ecx, 0x10062a18
call fcn.10006198
jmp 0x1002d9de
mov eax, dword [ebp + 8]
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002db9b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x1002dbdb
cmp byte [ebp + 0xc], 0
je 0x1002dbc2
cmp byte [edx], 0
je 0x1002dc10
push 1
push 1
xor dl, dl
mov ecx, 0x5754
call fcn.1002c874
pop ecx
jmp 0x1002dbf4
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002dc10
push 0
push 0x1d2
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
pop ebp
ret
test cl, cl
je 0x1002dbf7
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002dc10
push ecx
mov edx, 0x54f8
mov cl, 1
call fcn.1002b94f
pop ecx
pop ebp
ret
push 0x1e36
push 0x257b
push 0
push 0x8ed
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x289c468e
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4b006751
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10037761
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10082998]
jne 0x1003776b
repz ret
jmp fcn.1003df8c

Function at 0x10045dde
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1003d8d1
and dword [ebp - 4], 0
cmp dword [0x100867e4], 0
mov ebx, eax
jne 0x10045e8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10045f40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10056310
push edi
call esi
test eax, eax
je 0x10045f40
push eax
call fcn.1003d85f
mov dword [esp], 0x10056300
push edi
mov dword [0x100867e4], eax
call esi
push eax
call fcn.1003d85f
mov dword [esp], 0x100562ec
push edi
mov dword [0x100867e8], eax
call esi
push eax
call fcn.1003d85f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100867ec], eax
call esi
push eax
call fcn.1003d85f
pop ecx
mov dword [0x100867f4], eax
test eax, eax
je 0x10045e8f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1003d85f
pop ecx
mov dword [0x100867f0], eax
mov eax, dword [0x100867f0]
cmp eax, ebx
je 0x10045ee7
cmp dword [0x100867f4], ebx
je 0x10045ee7
push eax
call fcn.1003d8da
push dword [0x100867f4]
mov esi, eax
call fcn.1003d8da
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10045ee7
test edi, edi
je 0x10045ee7
call esi
test eax, eax
je 0x10045ede
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10045ede
test byte [ebp - 0xc], 1
jne 0x10045ee7
or dword [ebp + 0x10], 0x200000
jmp 0x10045f20
mov eax, dword [0x100867e8]
cmp eax, ebx
je 0x10045f20
push eax
call fcn.1003d8da
pop ecx
test eax, eax
je 0x10045f20
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10045f20
mov eax, dword [0x100867ec]
cmp eax, ebx
je 0x10045f20
push eax
call fcn.1003d8da
pop ecx
test eax, eax
je 0x10045f20
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100867e4]
call fcn.1003d8da
pop ecx
test eax, eax
je 0x10045f40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10045f42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x40b2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40b2ec
add dl, dl
jne 0x40b306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40b352
xor eax, eax
add dl, dl
jne 0x40b313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40b3ef
add dl, dl
jne 0x40b322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40b32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40b338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40b343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x40b34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x40b2f2
mov eax, 1
add dl, dl
jne 0x40b360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40b36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x40b357
sub eax, 2
jne 0x40b39a
mov ecx, 1
add dl, dl
jne 0x40b380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x40b38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x40b377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40b2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x40b3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x40b3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x40b3a8
cmp eax, 0x7d00
jae 0x40b3df
cmp eax, 0x500
jb 0x40b3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40b2f2
cmp eax, 0x7f
ja 0x40b3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40b2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x40b40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40b2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0xd2cca8
Capabilities:
Encode data using xor

Disassembly:
adc esi, dword [edx - 0x10]
ret
jmp 0xd2ccb2
pushal
call 0xd2ccb8
pop ebp
sub ebp, 0x10
sub ebp, 0x92cca8
jmp 0xd2ccce
mov eax, 0x92cca8
add eax, ebp
add eax, 0x4c
mov ecx, 0x580
mov edx, 0x19734980
xor byte [eax], dl
inc eax
dec ecx
jne 0xd2cce5
jmp 0xd2ccf8
or ecx, dword [ebp + 0xb]
or dword [eax + eax*4 + 0x41018080], edi
js 0xd2cc84
add byte [eax - 0x79c7b27d], 0x80
add byte [eax - 0x7f7f57c6], 0x80
ja 0xd2cd76
or dword [eax + 0xb], 1
mov word [eax + 0x45838080], es
rcl al, 1
call 0x8170d84d
call 0x81c78da8
sub dword [esp - 0x10210f18], 0x808568de
add byte [eax - 0x7f7f5797], 0x80
aad 0xb
insb byte es:[edi], dx
or eax, dword [0x80808088]
or edx, dword [0x8080808c]
or ecx, dword [0x80808090]
inc ecx
imul eax, dword [edx + 0x420382b1], 0x58fc984
je 0xd2cddd
jg 0xd2cddf
fld qword [edx - 0x74]
or byte [ebx], 0xc
movsb byte es:[edi], byte [esi]
test byte [eax + 0x28e88080], al
or ebx, dword [esi - 0x3f811780]
hlt
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
shr dword [eax - 0x7b], 1
add byte [eax - 0x7d409680], 0x80
adc ch, 0xb
insb byte es:[edi], dx
jg 0xd2cd7d
sub byte [ecx - 0x41], 0x82
add byte [eax + 0x7f6c0bd5], 0xf5
invalid
jg 0xd2cd88
int3
Function at 0x405730
Capabilities:
Encode data using xor

Disassembly:
pop eax
cmpsb byte [esi], byte es:[edi]
in al, dx
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push edi
invalid

Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
inc ebp
or byte [edx], bh
add byte [ebx + ecx*4 - 0x17afaabd], bl
or eax, 0x8bffff02
stc
or byte [edx + 0x5e], cl
pop ebx
pop esi
lds ebx, [ebp - 0x3e]
or al, 0
mov edx, dword [esi]
lea ecx, [ebp - 0x6f]
push ecx
push edx
push eax
push ebx
call 0x97b080
inc eax
cmc
imul edi, dword [0x19d7e], 0x75dd4589
pop es
mov dword [ebx - 0xc], 1
mov eax, dword [ebp + 0xc]
pop edi
or al, 6
jno 0x40b0ae
or byte [esi + 0x5b], bl
mov esp, ebp
push edi
ret 0xc
push ebp
mov ebp, esp
inc ebx
salc
jne 0x40b08f
push cs
mov edi, dword [ebp + 0x10]
mov eax, dword [esi - 0x76]
imul ecx, dword [esi - 5], 0x45c7c10b
sbb byte [eax], al
add byte [esi - 0x788e2900], bl
dec esi
sti
or eax, ecx
mov dword [ebp + 0x18], 0x9e0000
xlatb
jno 0x40b024
jge 0x40b0a7
test bh, cl
je 0x40b10d
mov edx, dword [esi + 4]
lea ecx, [ebp + 8]
push 0
dec ebp
or byte [edx], ch
push ecx
push 0
push 0
push 0xffffffffffffffd1
pop ss
call dword [0x1464c00c]
test eax, eax
jne 0x40b0f2
mov esi, dword [0x10cfc098]
call esi
test eax, eax
jne 0x40b0d2
mov ecx, dword [ebp + 0x14]
mov eax, 0x5df7895e
ret
adc esi, 0x1afc1705
add byte [edx - 0x13], ah
cld
or al, byte [eax]
jne 0x40b0e5
mov eax, 0x1119f
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
invalid
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b100
mov edx, dword [ebp - 0x2e]
pop edi
pop esi
mov dword [edx], eax
mov eax, 0x7300000b
or eax, 0x76f83bc3
add cl, byte [ebx + 0xc468bf8]
mov eax, dword [esi + 0xc]
or al, 0xc0
je 0x40b137
mov cl, byte [esi + 8]
test cl, cl
xchg ebp, eax
mov cl, byte [ebx + 0x4889964e]
cld
mov edi, dword [edx]
push eax
mov ebx, dword [edx + 0x54]
mov ecx, 0x20
call 0xa8ed9d10
mov edx, dword [esi + 0xc]
inc eax
invalid
mov eax, dword [esi - 0x25]
mov edx, dword [ebp + 0xc]
mov bh, 0x8d
loop 0x40b151
push eax
and al, 0x46
add al, 0x51
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b15a
xor eax, eax
inc ebp
sub ecx, ecx
add byte [eax], al
mov edi, dword [0x40c08f]
call edi
test eax, eax
je 0x122b285
jmp 0x40b1c0
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x77b95a84
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x63f465fe
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x35027ca0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x350ab654], 0
jne 0x35027d13
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x350ab660], 0x35027c1d
mov dword [0x350ab664], 0x35027c39
mov dword [0x350ab668], 0x35027c52
mov dword [0x350ab66c], 0x35027c79
test eax, eax
jbe 0x35027cef
shl eax, 2
jmp 0x35027cf4
mov eax, 0x4000
push 0
push eax
push 0
push 1
call fcn.35027c1d
mov dword [0x350ab65c], eax
test eax, eax
je 0x35027d13
mov dword [0x350ab654], 1
mov eax, dword [0x350ab654]
leave
ret
Function at 0x35027e9a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x350a672c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
xor edi, edi
call fcn.3505bbb0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 0xc], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call esi
mov ebx, 0x80070000
test eax, eax
jne 0x35027ef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35027ee7
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x35028035
mov eax, dword [ebp - 0x28]
push 0x1c
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 0x10], eax
call esi
test eax, eax
jne 0x35027f1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35027f15
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x35028035
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x35027f33
mov edi, 0x8000ffff
jmp 0x35028035
test dword [ebp - 0x1c], 0x2000
je 0x35027f6e
mov ecx, dword [ebp - 0x20]
add eax, ecx
push 0x1c
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x35027f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35027f62
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x35028035
jmp 0x35027f71
mov dword [ebp - 8], ecx
test dword [ebp - 0x1c], 0x1000
je 0x35027f29
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jb 0x35027f29
mov ecx, dword [ebp - 0x20]
add ecx, eax
cmp dword [ebp - 0xc], ecx
jae 0x35027f29
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x50]
lea esi, [eax - 1]
not esi
and esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
sub esi, eax
mov eax, dword [ebp - 0x10]
cmp esi, eax
jb 0x35027f29
jbe 0x35027fdf
push 0x4000
mov ecx, esi
sub ecx, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x35027fdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35027fd9
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x35028035
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, eax
je 0x3502800b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35028005
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x35028035
lea eax, [ebp - 0x30]
push eax
push 0x104
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x35028035
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35028033
and eax, 0xffff
or eax, ebx
mov edi, eax
mov eax, edi
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3505b7a5
leave
ret
Function at 0x3502dc9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
call fcn.3502855b
xor ebx, ebx
cmp eax, ebx
jl 0x3502dd54
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x35003a98
push SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 4
call esi
test eax, eax
jne 0x3502dd45
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x35003a88
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0x800704da
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x3502dd40
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x35003a70
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3502dd37
cmp dword [ebp - 8], ebx
je 0x3502dd37
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x3502dd52
push ebx
push 1
push 0x350ab678
call fcn.3502c5af
pop edi
pop esi
pop ebx
leave
ret