joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001040
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test eax, eax
je 0x100011be
xorps xmm0, xmm0
lea edx, [esp + 0x14]
movdqu xmmword [eax], xmm0
lea ecx, [esp + 0x10]
movdqu xmmword [eax + 0x10], xmm0
call fcn.10001000
push dword [esp + 0x10]
lea eax, [esp + 0x2a8]
push dword [esp + 0x18]
push str._X_X
push eax
call fcn.100011e0
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [esp + 0x20]
add esp, 0x10
xor ebx, ebx
mov dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x1c]
push eax
call edi
cmp eax, 0x6f
jne 0x10001105
push dword [esp + 0x10]
call fcn.100047de
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100010d8
lea edi, [eax + 3]
jmp 0x10001190
lea eax, [esp + 0x10]
mov esi, ebx
push eax
push ebx
call edi
test eax, eax
je 0x10001111
mov edi, 4
mov esi, dword [esp + 0xc]
test ebx, ebx
je 0x10001194
push ebx
call fcn.100047a6
add esp, 4
jmp 0x10001194
test eax, eax
jne 0x1000118b
lea esi, [esp + 0x18]
mov edi, 6
test esi, esi
je 0x100010eb
lea ebx, [ebx]
lea eax, [esi + 0x10c]
push str.Virtual
push eax
call fcn.10004870
add esp, 8
test eax, eax
je 0x10001140
mov esi, dword [esi]
test esi, esi
jne 0x10001120
jmp 0x100010eb
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
mov esi, dword [esp + 0x20]
push eax
push str._02X_02X_02X_02X_02X_02X
push 0x20
push esi
call fcn.10004b57
add esp, 0x24
xor edi, edi
jmp 0x100010ef
mov edi, 5
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x2a4]
push eax
push 0x20
push esi
call fcn.10004b73
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.10004797
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c4]
mov eax, 0x57
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10004797
mov esp, ebp
pop ebp
ret
Function at 0x10001330
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014968
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov ebx, ecx
xor edi, edi
mov byte [ebp - 0x28], 0
push str.kernel32.dll
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100013ae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call esi
mov dword [ebp - 0x30], eax
test eax, eax
je 0x100013a9
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x34]
call esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], edi
jmp 0x100013b1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0
test eax, eax
je 0x100013d3
lea ecx, [ebp - 0x38]
push ecx
call eax
movzx ecx, byte [ebp - 0x28]
test eax, eax
mov edx, 1
cmovne ecx, edx
mov byte [ebp - 0x28], cl
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10001404
cmp byte [ebp - 0x28], 0
je 0x10001404
push dword [ebp - 0x38]
call eax
mov byte [ebp - 0x28], 0
cmp esi, 0xffffffff
jne 0x1000143e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000142a
cmp byte [ebp - 0x28], 0
je 0x1000142a
push dword [ebp - 0x38]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000147e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100014d0
cmp byte [ebp - 0x28], 0
je 0x100014d0
push dword [ebp - 0x38]
call ecx
jmp 0x100014cc
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0
push eax
push ebx
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100014a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100014b3
cmp dword [ebp - 0x14], ebx
je 0x100014ac
mov edi, 0x1d
jmp 0x100014b3
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x100014d0
cmp byte [ebp - 0x28], 0
je 0x100014d0
push dword [ebp - 0x38]
call eax
mov byte [ebp - 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100014f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x3ff
lea eax, [ebp - 0x493]
mov byte [ebp - 0x494], 0
push 0
push eax
mov esi, edx
mov ebx, ecx
call fcn.1000c7d0
push 0x7e
lea eax, [ebp - 0x92]
push 0
push eax
call fcn.1000c7d0
add esp, 0x18
mov dword [ebp - 0xa], 0
xor eax, eax
mov word [ebp - 6], 0
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x660063
movq qword [ebp - 0x12], xmm0
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x14], 0x410044
push eax
push esi
mov dword [ebp - 0x10], 0x410054
mov dword [ebp - 0x90], 0x30
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x498], eax
test eax, eax
jne 0x100015a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100015cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x49c], eax
test eax, eax
jne 0x100015fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x498]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, 0x400
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x494]
push esi
push dword [ebp - 0x49c]
push eax
call fcn.10005ad0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
lea eax, [ebp - 0x494]
push eax
push ebx
call fcn.10004090
add esp, 0xc
test eax, eax
jne 0x10001696
lea ecx, [ebx + 8]
call fcn.10001040
mov esi, eax
call fcn.10004010
mov dword [ebx + 0x58], eax
xor ecx, ecx
cmp cx, word [ebx + 0x9c]
lea eax, [ebx + 0x9c]
jne 0x1000167a
push str.gmboxdrv
push 0x20
push eax
call fcn.100051ae
add esp, 0xc
add ebx, 0x5c
xor eax, eax
cmp ax, word [ebx]
jne 0x10001694
push str.gmboxdrv
push 0x20
push ebx
call fcn.100051ae
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004797
mov esp, ebp
pop ebp
ret
Function at 0x10001e00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push closesocket
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10001e93
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.SecureProtocols
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x10001e93
cmp dword [ebp - 0xc], 4
je 0x10001e72
mov esi, 0x3f2
jmp 0x10001e93
or dword [ebp - 4], 0x800
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0
push str.SecureProtocols
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x10001ea1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001fb0
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, edx
lea eax, [esp + 0x28]
mov edi, ecx
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000200b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x1000202d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
jmp 0x100020c5
mov eax, 2
push esi
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x10]
xor esi, esi
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x1c], edi
xor edi, edi
mov word [esp + 0x1a], ax
test ecx, ecx
je 0x100020a7
test ebx, ebx
je 0x100020b7
lea ebx, [ebx]
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + ecx]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x100020a1
add esi, eax
cmp esi, ebx
jae 0x100020a7
mov ecx, dword [esp + 0x10]
inc edi
cmp edi, 0xa
jb 0x10002060
mov edi, dword [esp + 0x14]
cmp esi, ebx
mov eax, 0x58
cmovne edi, eax
jmp 0x100020bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [esp + 0x14]
cmp esi, ebx
mov eax, 0x58
cmovne edi, eax
jmp 0x100020bb
mov edi, dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1bc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10004797
mov esp, ebp
pop ebp
ret
Function at 0x100020f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, edx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x1000224b
test ax, ax
je 0x1000224b
push esi
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10002118
sub edx, ecx
jne 0x1000212b
lea eax, [edx + 0x57]
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edx + 0x20]
cmp eax, 0x400
jbe 0x1000213f
mov eax, 0x6cf
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0x420
call fcn.100047de
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000215c
lea eax, [edi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x420
push 0
push edi
call fcn.1000c7d0
lea ebx, [edi + 0x20]
add esp, 0xc
mov ecx, ebx
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x10002174
mov ecx, ebx
mov dword [edi], 0x54505258
mov dword [edi + 4], 0x20
mov dword [edi + 8], 0x10000000
mov dword [edi + 0x10], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100021a1
sub ecx, edx
lea eax, [ecx + 1]
mov dword [edi + 0x1c], eax
cmp eax, 4
jb 0x100021f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x10], edx
mov dword [ebp - 4], eax
cmp eax, 4
jb 0x100021f8
mov ecx, ebx
lea eax, [edi + 0x20]
mov ebx, 4
mov esi, 0x4246d991
sub ebx, eax
lea esp, [esp]
xor edx, esi
add esi, 0x1e6cdc
xor dword [ecx], edx
add ecx, 4
lea eax, [ebx + ecx]
cmp eax, dword [ebp - 4]
jbe 0x100021e0
lea ebx, [edi + 0x20]
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x10002225
xor ecx, ecx
cmp edx, 4
jb 0x1000221f
mov eax, 4
jmp 0x10002210
add ecx, dword [ebx + eax - 4]
add eax, 4
cmp eax, edx
jbe 0x10002210
test ecx, ecx
jne 0x10002222
or ecx, 0xffffffff
mov dword [edi + 0x18], ecx
push ecx
lea eax, [edx + 0x20]
mov edx, dword [ebp - 8]
push eax
push edi
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.10001fb0
push edi
mov esi, eax
call fcn.100047a6
add esp, 0x14
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x57
mov esp, ebp
pop ebp
ret
Function at 0x10002260
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], edx
push ebx
mov ebx, dword [ebp + 0x18]
test eax, eax
je 0x10002296
test ebx, ebx
je 0x10002296
cmp byte [ebx], 0
jne 0x100022aa
mov eax, 0x57
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
mov ecx, eax
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100022b0
sub ecx, esi
cmp ecx, 0x40
jae 0x1000245b
mov ecx, ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100022c7
sub ecx, esi
cmp ecx, 0x80
jae 0x1000245b
test edx, edx
je 0x100022fa
mov ecx, edx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100022e5
sub ecx, edx
cmp ecx, 0xff
ja 0x1000245b
push edi
push 0x1000
call fcn.100047de
mov edi, eax
add esp, 4
test edi, edi
jne 0x10002322
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push 0x1000
push 0
push edi
call fcn.1000c7d0
add esp, 0xc
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
lea eax, [ebp - 0x88]
movdqu xmmword [ebp - 0x84], xmm0
push eax
movdqu xmmword [ebp - 0x74], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x88]
cmp ax, 9
je 0x10002372
mov dword [ebp - 0x54], 0
cmp ax, 6
jne 0x10002379
mov dword [ebp - 0x54], 1
push str.ntdll.dll
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100023c9
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100023c9
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x50]
push ecx
call eax
mov esi, dword [ebp - 0x48]
and esi, 0xfffffff
mov dword [ebp - 0x48], esi
jmp 0x100023cc
mov esi, dword [ebp - 0x48]
push 0x3f
lea eax, [ebp - 0x43]
mov byte [ebp - 0x44], 0
push 0
push eax
call fcn.1000c7d0
cmp dword [ebp - 0x54], 0
mov ecx, 0x10019818
mov eax, str.amd64
cmove eax, ecx
push eax
push esi
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push dword [ebp - 0x50]
push str._u._u._u__s
push eax
call fcn.10004ad3
mov ecx, dword [ebp - 0x58]
mov eax, 0x10019828
test ecx, ecx
cmovne eax, ecx
push eax
push ebx
push dword [ebp - 0x60]
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push str._d__d__d__s__s__s__s
push edi
call fcn.10004ad3
mov edx, dword [ebp - 0x64]
add esp, 0x48
mov ecx, dword [ebp - 0x5c]
push edi
call fcn.100020f0
push edi
mov esi, eax
call fcn.100047a6
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x6cf
pop esi
xor ecx, ebp
pop ebx
call fcn.10004797
mov esp, ebp
pop ebp
ret
Function at 0x10002d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x210], 0
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x10002d9e
pop edi
lea eax, [esi + 0x57]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1000c7d0
push str.SystemCurrentControlSetServices_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100051ae
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100050f7
add esp, 0x24
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10002e8f
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0x6d0049
push eax
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x208], 0x670061
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x204], 0x500065
mov dword [ebp - 0x200], 0x740061
mov dword [ebp - 0x1fc], 0x68
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x10002e8f
mov eax, dword [ebp - 0x214]
cmp eax, 2
je 0x10002e8f
cmp eax, 1
mov ecx, 0xd
cmovne esi, ecx
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x10002ea0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10004797
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100032f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x488], 0
test edi, edi
jne 0x10003326
lea eax, [ecx + 0x57]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret
push esi
push 0x3ff
lea eax, [ebp - 0x483]
mov byte [ebp - 0x484], 0
push 0
push eax
call fcn.1000c7d0
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.1000c7d0
push str.SystemCurrentControlSetControl
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.100051ae
add esp, 0x24
lea eax, [ebp - 0x488]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x84]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1000341a
mov dword [ebp - 0x490], eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x484]
mov dword [ebp - 0x48c], 0x400
push eax
lea eax, [ebp - 0x490]
mov dword [ebp - 0x84], 0x640055
push eax
push esi
lea eax, [ebp - 0x84]
mov dword [ebp - 0x80], 0x4f0066
push eax
push dword [ebp - 0x488]
mov dword [ebp - 0x7c], 0x740070
mov dword [ebp - 0x78], 0x6f0069
mov dword [ebp - 0x74], 0x73006e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1000341a
push dword [ebp - 0x48c]
lea eax, [ebp - 0x484]
push eax
push edi
call fcn.10004090
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x488]
test eax, eax
je 0x1000342b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.10004797
mov esp, ebp
pop ebp
ret
Function at 0x30007171
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30009190
call fcn.3000753a
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x3000b8b4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30006f10
cmp eax, esi
jne 0x30006f03
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30006f13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30006eea
xor esi, esi
inc esi
mov eax, dword [0x3000b8b0]
cmp eax, esi
jne 0x30006f26
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30006f55
mov eax, dword [0x3000b8b0]
test eax, eax
jne 0x30006f4f
mov dword [0x3000b8b0], esi
push 0x30001284
push 0x3000127c
call fcn.30185000
pop ecx
pop ecx
test eax, eax
je 0x30006f55
jmp 0x3000707d
mov dword [0x3000b528], esi
mov eax, dword [0x3000b8b0]
cmp eax, esi
jne 0x30006f79
push 0x30001278
push 0x30001268
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3000b8b0], 2
test ebx, ebx
jne 0x30006f85
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3000b8c0], 0
je 0x30006fa9
push 0x3000b8c0
call fcn.300074c2
pop ecx
test eax, eax
je 0x30006fa9
push 0
push 2
push 0
call dword [0x3000b8c0]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30007005
test al, al
je 0x30006fc3
cmp dword [ebp - 0x1c], 0
jne 0x30007005
mov al, byte [esi]
test al, al
je 0x30006fd3
cmp al, 0x20
ja 0x30006fd3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30006fc3
test byte [ebp - 0x3c], 1
je 0x30006fdf
movzx eax, word [ebp - 0x38]
jmp 0x30006fe2
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3000b524], eax
cmp dword [0x3000b518], 0
jne 0x30007059
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30007014
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30007027
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30006fb0
cmp dword [0x3000b528], 0
jne 0x30007068
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3000b524]
jmp 0x30007089
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.3000757f
ret
call fcn.3000681c
jmp 0x30006eb0
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x61fd6b35
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xf3201
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4010aa
Capabilities:
Get system information on windows

Disassembly:
jmp 0x403840
sub esp, 0x24
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0
push str.GetNativeSystemInfo
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
pop edi
je 0x40387e
lea ecx, [esp]
push ecx
call eax
jmp 0x403889
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
jne 0x4038aa
mov ecx, dword [esp + 0x28]
push str.__64_bit
call fcn.0052adbe
mov eax, 1
add esp, 0x24
ret
cmp ax, 6
jne 0x4038c7
mov ecx, dword [esp + 0x28]
push str.__IA64
call fcn.0052adbe
mov eax, 1
add esp, 0x24
ret
test ax, ax
jne 0x4038e3
mov ecx, dword [esp + 0x28]
push str.__32_bit
call fcn.0052adbe
mov eax, 1
add esp, 0x24
ret
mov ecx, dword [esp + 0x28]
push str.__Unknown_architecture
call fcn.0052adbe
mov eax, 1
add esp, 0x24
ret