joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9870
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4b9a74
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4b9a74
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004bc5f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4b9a49
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4b9a38
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x4b9a02
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b99fa
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004bc5f0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004b9a90
add esp, 0x18
test eax, eax
je 0x4b99fa
cmp byte [ebp - 0x68], 0
je 0x4b99bc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4b99fa
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4b99e9
mov al, byte [esi + ecx]
test al, al
je 0x4b99e9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4b99d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4b9910
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4b9a74
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.004baf20
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
Function at 0x4b9bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4b9d2f
cmp dword [ebp + 0xc], 0x20
jb 0x4b9d2f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.004bc5f0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x5383e0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4b9d2f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b9c40
sub ecx, edx
cmp ecx, 0x40
jne 0x4b9d2f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x4b9c7c
mov al, byte [esi + ecx]
test al, al
je 0x4b9c7c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4b9c66
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x4b9cb9
mov al, byte [esi + ecx]
test al, al
je 0x4b9cb9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4b9ca0
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.004bc5f0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004b9d40
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x4b9d2f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004baf20
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
Function at 0x4baac0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.00475df0
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x4bac2d
cmp dword [ebp + 0xc], 0
je 0x4bac2d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.004b6470
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4bac10
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.004bc5f0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4bac05
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.004bc5f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.004bbde0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.004baf20
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4bac1a
inc esi
cmp esi, 0x10
jl 0x4bab00
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
Function at 0x4bac40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4bad28
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bc5f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x4bad28
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bac97
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x4bad28
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4bacc0
mov eax, dword [0x537ddc]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4bacd5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4bacf0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00475dd9
mov esp, ebp
pop ebp
ret
Function at 0x4bad40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.004bc5f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004b9d40
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4badaa
mov al, byte [edi + ecx]
test al, al
je 0x4badaa
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4bad91
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x4badcb
inc eax
sub ecx, 1
jne 0x4badc0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4bae20
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x4bae15
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x4bae14
mov bl, byte [edi + ecx]
test bl, bl
je 0x4bae14
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x4bae00
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.004bc5f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x5383e0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x4baeda
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4baea4
test cl, cl
je 0x4baea0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4baea4
add eax, 2
add esi, 2
test cl, cl
jne 0x4bae84
xor eax, eax
jmp 0x4baea9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4baeda
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4baeb6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4baee3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x5383e0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00475dd9
mov esp, ebp
pop ebp
ret

Function at 0x4ff1c0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fedc5

Function at 0x4ff1cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fef46

Function at 0x506f56
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00506766

Function at 0x506f61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005069a1
Function at 0x5073e9
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005070a2

Function at 0x5073f4
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050717b
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40673a
pop dword [ebp - 0x40]
mov eax, 0x40673a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xea56cd47
add dword [ebp - 0x50], 0x63fb7804
mov dword [ebp - 0x4c], 0xd3abf831
add dword [ebp - 0x4c], 0x5e875414
mov dword [ebp - 0x48], 0x10e01157
add dword [ebp - 0x48], 0x3b6c32d7
mov dword [ebp - 0x44], 0x73c75c3b
sub dword [ebp - 0x44], 0x73c75c3b
lea eax, [ebp - 0x50]
push eax
mov eax, 0x3e140dd7
add eax, 0xc22c732d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3b7912cd
add dword [ebp - 0x50], 0x38f95689
mov dword [ebp - 0x4c], 0x7652f7cf
sub dword [ebp - 0x4c], 0x34e6965a
mov dword [ebp - 0x48], 0x7df100ec
sub dword [ebp - 0x48], 0x1a819480
mov dword [ebp - 0x44], 0x924cd1d1
sub dword [ebp - 0x44], 0x924cd1d1
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xd0d1ea9f
sub eax, 0xd091699f
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35ad1
push 0
call eax
mov ecx, 0x94c78882
sub ecx, 0x94c747de
mov esi, eax
mov edx, 0xa588b20c
add edx, 0x5abe31f4
add edx, dword [ebp - 0x40]
mov ebx, 0x50309f
xor dword [ebp - 0x20], esi
mov edi, dword [edx]
sub dword [ebp - 0x38], 0xb72d0135
add edi, ebx
xor dword [ebp - 8], edx
mov dword [esi], edi
add esi, 0x39d43552
add esi, 0xc62bcab2
add edx, 0x3fbd2341
add edx, 0xc042dcc3
loop 0x406851
add eax, 0xf563
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbbd7f015
add ecx, 0x44680feb
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3dbc6e67
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x791d1d0c
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100022de
pop dword [ebp - 0x48]
mov eax, 0x100022de
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc3c20e74
add dword [ebp - 0x58], 0x8a9036d7
mov dword [ebp - 0x54], 0xa2227f31
sub dword [ebp - 0x54], 0x6fef32ec
mov dword [ebp - 0x50], 0xc749359
sub dword [ebp - 0x50], 0xc0284f2b
mov dword [ebp - 0x4c], 0xbf81791a
sub dword [ebp - 0x4c], 0xbf81791a
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5036a073
add eax, 0xbfc98f91
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9441f05c
sub dword [ebp - 0x58], 0x1fcf8706
mov dword [ebp - 0x54], 0x27102809
add dword [ebp - 0x54], 0x1a5c396c
mov dword [ebp - 0x50], 0xbff95396
sub dword [ebp - 0x50], 0x5c89e72a
mov dword [ebp - 0x4c], 0x7e0b49ed
sub dword [ebp - 0x4c], 0x7e0b49ed
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xc2acd8a1
add eax, 0x4d535767
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36c7e
push 0
call eax
mov ecx, 0x492d
xor edi, edi
add edi, eax
mov ebx, 0x4405edb8
add ebx, 0xcbfa7448
add ebx, dword [ebp - 0x48]
mov esi, 0xde0a07f5
add esi, 0xd2d1b80e
mov dword [ebp - 0x3c], 0x3d121883
mov edx, dword [ebx]
sub dword [ebp - 0x34], ecx
xor edx, esi
add dword [ebp - 0x28], edx
mov dword [edi], edx
add edi, 0xf44110e8
add edi, 0xbbeef1c
add ebx, 4
loop 0x100023f7
add eax, 0x2596f0fb
add eax, 0xda6a268c
mov ebx, eax
add eax, 0xa41f0223
sub eax, 0xa41f021e
mov ecx, 0xb8d66aba
add ecx, 0x57299546
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x7c34100e
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7c38b2ac]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c34800f
mov dword [0x7c38b2ac], 1
cmp esi, ebx
je 0x7c348030
cmp word [esi], bx
mov eax, esi
je 0x7c34106e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x7c3410b5
push ebp
call sym.MSVCR71.dll_malloc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7c3410b5
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x7c34803d
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x7c348050
jmp 0x7c341044
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c348026
mov eax, ebp
mov dword [0x7c38b2ac], eax
jmp 0x7c3410c5
mov eax, dword [0x7c38b2ac]
jmp 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c348058
jmp 0x7c34104c
push dword [esp + 0x10]
call sym.MSVCR71.dll_free
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x7c3410b1
cmp eax, ebp
je 0x7c34805f
cmp eax, ebx
je 0x7c34805f
xor eax, eax
jmp 0x7c3410be
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x7c348058
cmp byte [esi], bl
je 0x7c348079
inc eax
cmp byte [eax], bl
jne 0x7c34806f
inc eax
cmp byte [eax], bl
jne 0x7c34806f
sub eax, esi
inc eax
mov ebp, eax
push ebp
call sym.MSVCR71.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x7c34808f
xor edi, edi
jmp 0x7c34809a
push ebp
push esi
push edi
call fcn.7c35c2a2
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x7c3410be
Function at 0x7c3410d3
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x7c38b2a8]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_GetCommandLineW]
jne 0x7c3410ff
call esi
test eax, eax
je 0x7c347f99
mov dword [0x7c38b2a8], 1
call esi
pop esi
pop ebp
ret
cmp eax, 1
jne 0x7c347fb7
jmp 0x7c3410fa
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c347fb0
mov dword [0x7c38b2a8], 2
jmp 0x7c347fbc
xor eax, eax
jmp 0x7c3410fc
cmp eax, 2
jne 0x7c347fb0
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov edi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x7c348002
lea eax, [esi + esi]
push eax
call sym.MSVCR71.dll_malloc
mov ebp, eax
test ebp, ebp
pop ecx
je 0x7c348002
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x7c348006
push ebp
call sym.MSVCR71.dll_free
pop ecx
xor eax, eax
jmp 0x7c348008
mov eax, ebp
pop edi
pop ebx
jmp 0x7c3410fc

Function at 0x7c341aed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7c38b118]
jne 0x7c34c229
ret
push 8
push 0x7c37f6d0
call fcn.7c34230b
and dword [ebp - 4], 0
push 0
push 1
call sym.MSVCR71.dll___security_error_handler
pop ecx
pop ecx
jmp 0x7c34c24d
or dword [ebp - 4], 0xffffffff
push 3
call dword [sym.imp.kernel32.dll_ExitProcess]