joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ad29
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f0
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x64], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44ad57
push 0x64
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44ad5b
mov byte [ebp - 0x80], 0
push edi
push 0x1f
mov byte [ebp - 0x1c], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x44ad95
cmp byte [edi + 0x11], 0
je 0x44ad92
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x1c]
push 0x459d08
push 0x7d
push eax
call fcn.00409cc2
add esp, 0x10
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x44ad75
cmp byte [ebp - 0x1c], 0
je 0x44add6
lea eax, [ebp - 0x1c]
push eax
call fcn.00454b10
cmp eax, 0x7b
pop ecx
jbe 0x44adca
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x1c]
push 0x459098
push eax
call fcn.004388bd
add esp, 0xc
jmp 0x44add6
lea eax, [ebp + eax - 0x1d]
cmp byte [eax], 0x20
jne 0x44add6
mov byte [eax], 0
mov eax, dword [0x46441c]
cmp eax, 1
mov dword [ebp + 0x78], 0x459cc8
jg 0x44aebe
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x78], 0x4575d8
cmp dword [0x4643fc], 0
mov edi, 0x458a64
mov eax, 0x458a68
mov dword [ebp + 0x68], edi
je 0x44ae0f
mov dword [ebp + 0x68], eax
cmp dword [0x4643f8], 0
je 0x44ae1a
mov edi, eax
lea eax, [ebp - 0x180]
push eax
push 1
call fcn.0040fd4e
pop ecx
push eax
call fcn.00410b5b
push eax
push dword [0x464418]
lea eax, [ebp - 0x1c]
push dword [0x46441c]
push dword [0x464420]
push dword [ebp + 0x78]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x80]
push dword [esi + 0x478]
push dword [ebp + 0x68]
push edi
push eax
push 0x459c10
push dword [ebp + 0x7c]
push ebx
call fcn.00409c27
mov esi, dword [ebp + 0x64]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.00443de5
push ebx
call fcn.00454b10
add esp, 0xc
add ebx, eax
cmp dword [0x464cf4], 0
pop edi
mov eax, 0x459bf4
jne 0x44aea3
mov eax, 0x459bc0
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.00409c27
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x44adf6
Function at 0x44afa5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x46208c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00438b79
test eax, eax
pop ecx
pop ecx
je 0x44b029
cmp byte [eax], 0x3d
jne 0x44b022
cmp eax, esi
jbe 0x44b034
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44b022
mov eax, ecx
cmp eax, esi
jbe 0x44b034
dec eax
jmp 0x44b034
push esi
call fcn.00454b10
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00438ac5
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44b060
cmp byte [ebp + 0x10], 0
je 0x44b05c
push esi
push 0x45a660
mov ecx, ebx
call fcn.0044a3b9
xor eax, eax
jmp 0x44b070
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.004388bd
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44d838
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c58
call fcn.004550b0
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44d8b6
lea ecx, [ebp - 0x8c58]
call fcn.0043ab2f
mov al, byte [ebp + 8]
mov byte [ebp - 0x8414], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8410], eax
lea eax, [ebp - 0x8c58]
push eax
push 0x44de7e
mov dword [ebp - 0x8418], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8428], 0
je 0x44d8b6
mov eax, dword [0x46424c]
cmp eax, 0xffffffff
jle 0x44d8b6
cmp eax, 0x19
jge 0x44d8ac
cmp byte [0x465401], 0
je 0x44d8ac
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44d8b6
push 1
push eax
call fcn.0040b58c
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x44dd38
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c5c
call fcn.004550b0
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x44de75
push ebx
call fcn.0044e082
test eax, eax
je 0x44de78
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x4641f8
push eax
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.0044daba
test eax, eax
je 0x44dd87
xor esi, esi
mov dword [0x46802c], esi
jmp 0x44dd8d
mov esi, dword [0x46802c]
lea ecx, [ebp - 0x8c5c]
call fcn.0043ab2f
cmp byte [ebp + 8], bl
je 0x44dda7
cmp esi, ebx
mov byte [ebp - 0x8434], bl
je 0x44ddae
mov byte [ebp - 0x8434], 1
mov eax, dword [0x468028]
mov dword [ebp - 0x8424], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x841c], eax
lea eax, [ebp - 0x8c5c]
push eax
push 0x44df84
mov dword [ebp - 0x8420], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x842c], ebx
je 0x44de4a
push dword [ebp - 0x842c]
call fcn.0043ba7a
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44de06
push dword [ebp - 0x842c]
call fcn.0044e050
pop ecx
mov dword [ebp - 0x842c], esi
push dword [ebp - 0x842c]
call fcn.0043b3e0
push dword [ebp - 0x842c]
call fcn.0044e050
mov eax, dword [0x46424c]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x44de74
cmp eax, 0x19
jge 0x44de3e
cmp byte [0x465401], bl
je 0x44de3e
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44de74
push 1
push eax
call fcn.0040b58c
pop ecx
pop ecx
jmp 0x44de74
mov eax, dword [0x46802c]
cmp eax, ebx
je 0x44de74
cmp eax, 1
setg al
cmp al, bl
mov dword [0x46802c], ebx
je 0x44de74
push dword [ebp - 4]
call fcn.0044e050
pop ecx
push ebx
mov ecx, edi
call fcn.0044dd38
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x44e174
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x466a18], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x466058
jne 0x44e194
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00413546
pop ecx
mov dword [0x4631d8], 0x270
mov dword [0x466050], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e1b3
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e1e9
mov edx, dword [0x466058]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e3b5
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x44e4e0
cmp byte [eax], bl
je 0x44e4e0
push 0x10
call fcn.0044ba5d
cmp eax, ebx
pop ecx
je 0x44e403
mov dword [eax], 0x4575d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x44e405
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x44e4e0
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004465f1
cmp eax, 1
jne 0x44e4e0
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449691
test eax, eax
je 0x44e4e0
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b1e2
test eax, eax
je 0x44e4e0
push dword [0x464cec]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449691
test eax, eax
je 0x44e4e0
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449691
test eax, eax
je 0x44e4e0
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b541
test eax, eax
je 0x44e4e0
push ebx
push ebx
push ebx
push 0x45a6c0
mov ecx, esi
call fcn.0041bdf6
cmp eax, ebx
mov dword [0x464be0], eax
je 0x44e4e0
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
mov ecx, eax
call fcn.00401592
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00413546
mov eax, dword [esi + 8]
pop ecx
jmp 0x44e4e3
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x44e6ed
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00413546
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x44e717
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00413464
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x44e701
pop esi
pop edi
ret 0xc

Function at 0x44eb89
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x44ebb2
add edx, edx
xor edx, 0x4c11db7
jmp 0x44ebb4
shl edx, 1
dec ecx
jne 0x44eba0
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x44eb98
pop edi
pop esi
ret
Function at 0x454a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x468084], esi
push edi
jne 0x454a60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x468080], esi
mov byte [0x46807c], al
jne 0x454ac6
mov ecx, dword [0x46964c]
test ecx, ecx
je 0x454aa7
mov eax, dword [0x469648]
sub eax, 4
cmp eax, ecx
jmp 0x454aa0
mov eax, dword [eax]
test eax, eax
je 0x454a92
call eax
mov eax, dword [0x469648]
sub eax, 4
cmp eax, dword [0x46964c]
mov dword [0x469648], eax
jae 0x454a8a
mov eax, 0x462040
mov esi, 0x462048
cmp eax, esi
mov edi, eax
jae 0x454ac6
mov eax, dword [edi]
test eax, eax
je 0x454abf
call eax
add edi, 4
cmp edi, esi
jb 0x454ab7
mov eax, 0x46204c
mov esi, 0x462050
cmp eax, esi
mov edi, eax
jae 0x454ae5
mov eax, dword [edi]
test eax, eax
je 0x454ade
call eax
add edi, 4
cmp edi, esi
jb 0x454ad6
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x454aff
push dword [ebp + 8]
mov dword [0x468084], 1
call fcn.0043d021
pop ebp
ret
Function at 0x1332e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push edx
sub edx, edi
and dh, dh
cmp dl, ah
mov edx, 0x165c
cmp dl, dl
add edx, ecx
and edx, edx
pop edx
push eax
push edx
sub ah, al
xor dx, 0x355b
pop edx
pop eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x13474
cmp dword [ebp + 0xc], 0
je 0x13474
js 0x13378
add byte [eax], al
mov bh, bh
jns 0x13378
xchg dword [ebx + 0x448d3c46], ecx
xor byte [eax + 0xf], bh
xchg byte [edx], bl
add byte [eax], al
add byte [ebx + 0x12870fc9], cl
add byte [eax], al
add bh, bh
cmp byte [ecx - 0x55], dl
loop 0x1336d
mov eax, dword [esi + 0x3c]
lea eax, [eax + esi + 0x78]
jbe 0x1339f
mov ecx, ecx
ja 0x1339f
invalid
retf 0x8265
mov edx, dword [eax]
add edx, esi
jp 0x133be
nop
nop
mov dh, dh
jnp 0x133be
notrack jmp 0x20f8bee
mov eax, dword [edx + 0x18]
mov edi, dword [edx + 0x20]
mov dword [ebp - 4], eax
add edi, esi
push eax
push ebx
and ax, si
and eax, eax
xor ah, 0x5a
and ah, 0x3d
xor ax, di
or ah, dl
test bx, 0x262d
test ah, bl
test ah, 0x34
pop ebx
pop eax
push ecx
or ch, ch
xor cx, si
cmp cx, ax
pop ecx
mov ebx, dword [edx + 0x24]
mov edx, dword [edx + 0x1c]
add edx, esi
add ebx, esi
mov dword [ebp - 8], edx
jp 0x1341c
xchg cx, cx
jnp 0x1341c
mov gs, esi
jae 0x1343a
test eax, 0x4ae9aff1
test eax, 0x3fe7e9fa
and dword cs:[ebp + 8], 0
and dword [ebp + 8], 0
cmp dword [ebp - 4], 0
jbe 0x1346a
mov eax, dword [edi]
add eax, esi
jle 0x1344f
mov bx, bx
xchg si, si
xchg dl, dl
jg 0x1344f
adc dword [eax], eax
add byte [eax], al
lahf
fdivr qword [ecx + 0x14]
pushfd
call 0xfea7b8d2
call 0xc9694a11
pop es
fdivp st(7)
jne 0x1345e
push dword [ebp + 0xc]
push eax
call fcn.000107ce
cmp al, 1
je 0x1347d
inc dword [ebp + 8]
add edi, 4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
or byte [ebx + 0x458b04c7], al
or byte [ebx], bh
inc ebp
cld
jb 0x13426
push edi
add di, dx
cmp edi, edx
add di, cx
pop edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
movzx eax, word [ebx + eax*2]
mov eax, dword [ecx + eax*4]
jmp 0x13476
Function at 0x13f16
Capabilities:
Map section object

Disassembly:
cli
jo 0x13f2b
inc byte [eax]
out 0x60, al
lahf
dec esi
stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
leave
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push edx
cmp dh, 0x1f
test bx, dx
cmp dx, bx
xor dh, 0x74
or dh, bl
xor dl, ah
xor dl, ah
dec dh
pop edx
push edx
push ax
push bx
xor dh, 0x61
and dl, cl
inc edx
test cl, dh
test al, 0x79
xor al, bl
cmp dh, 0x50
or bx, ax
pop bx
pop ax
pop edx
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jle 0x13fcd
jb 0x13f6e
push edi
mov di, 0xf403
pop edi
jae 0x13f6e
jecxz 0x13fbe
out dx, al
jb 0x13f06
cwde
sbb al, byte [ebx + 0x4ad860f0]
aam 0x8b
dec ebp
adc byte [ebx + 0x348dfc45], cl
or byte [edx + 0x6657080c], cl
add edi, edx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
lea esi, [eax + ecx]
mov cl, byte [eax + ecx]
push edi
add di, dx
cmp edi, edx
add di, cx
pop edi
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor cl, byte [edx + eax]
jl 0x13fa0
push ax
mov al, 0x22
pop ax
jge 0x13fa0
popal
test al, 0x7f
out 0x1a, eax
scasb al, byte es:[edi]
sbb eax, 0x5350663e
push ax
push ebx
inc bh
cmp ax, 0x7871
inc bx
add bx, di
test ax, 0x5a1d
cmp bh, 0x5e
inc bx
cmp ah, dh
pop ebx
pop ax
mov eax, dword [ebp + 0x14]
mov dl, al
xor dl, cl
inc dword [ebp - 4]
adc al, 0x8a
sal byte [edx], 1
sar edi, 1
inc ebp
cld
cmp dword [ebp - 4], eax
mov byte [esi], dl
jl 0x13f57
je 0x13fe8
push bx
mov bl, 0xd
pop bx
jne 0x13fe8
jbe 0x1404f
fisub word [ecx + eax*8 - 0x642a330]
fdiv dword [esi - 0x11]
lodsd eax, dword [esi]
push ss
and byte [edi], cl
xchg byte [eax], dl
add byte [eax], al
add byte [edi + 0x5f], dl
jbe 0x13ffe
push edi
pop edi
ja 0x13ffe
sbb ah, ch
cmp edi, esp
inc edi
pop ecx
inc eax
sub dword [edi + 0x5e], ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
invalid
Function at 0x14006
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
push 0x7f
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x22a]
mov word [ebp - 0x22c], si
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edi
inc di
test di, 0x3f60
xor di, 0x5177
sub edi, esi
pop edi
push 0x16b8c
lea eax, [ebp - 0x22c]
push 0x200
push eax
call fcn.000152e2
test eax, eax
jl 0x1419b
push dx
push ecx
mov dl, bh
cmp cx, bx
sub dh, 0x32
pop ecx
pop dx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
push edx
push ax
push bx
xor dh, 0x61
and dl, cl
inc edx
test cl, dh
test al, 0x79
xor al, bl
cmp dh, 0x50
or bx, ax
pop bx
pop ax
pop edx
push esi
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x21
push 0x16b90
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x1419b
push edi
push dx
and dx, ax
test bx, dx
inc di
and edi, 0x4f89
or dx, si
xor di, bx
inc dh
test di, 0x2805
and dh, 0x48
pop dx
pop edi
push dword [0x16b90]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
push 0x16b80
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
jl 0x1418f
jo 0x14158
push ax
pop ax
jno 0x14158
mov byte [ebx - 0x10], ch
inc edx
pop edx
fld xword [edx]
cmp edi, dword [ebx + 0x412fb812]
cwde
sbb dword [ebp + 0x75], esi
push 4
push 0x100000
lea eax, [ebp - 4]
push 1
push eax
push esi
push 0x1000
push esi
push 0x16b88
push 0xffffffffffffffff
push dword [0x16b80]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jge 0x1419f
push dword [0x16b80]
call dword [0x16bd4]
push dword [0x16b90]
call dword [0x16bd4]
xor al, al
jmp 0x141c1
jbe 0x141bf
mov ecx, ecx
ja 0x141bf
invalid
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x152e2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 7]
mov byte [ebp - 8], dl
push 0x3f
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jl 0x1531d
push dx
mov dx, 0xbfd0
pop dx
jge 0x1531d
cmp dword [ebp + 8], edx
je 0x15494
cmp word [ebp + 0xc], dx
je 0x15494
cmp dword [ebp + 0x10], edx
je 0x15494
pushal
dec bx
test di, cx
or si, bx
and ch, dh
sub cx, 0x3744
or ah, 0x2d
xor bl, cl
and ah, 0x28
and al, ch
cmp cx, bx
popal
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push 4
push eax
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x15499
retf
je 0x1538c
push si
pop si
jne 0x1538c
fisttp qword [ecx + 0x47c63860]
idiv dword [edi]
mov word [eax - 0x10f6f707], gs
xor dword [edi - 0x79], edi
push 0x206b6444
push dword [ebp - 4]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x15494
jb 0x153bd
push edi
mov di, 0xf403
pop edi
jae 0x153bd
jecxz 0x1540d
out dx, al
jb 0x15355
cwde
sbb al, byte [ebx + 0x4ad860f0]
aam 0x8d
inc ebp
cld
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edi, eax
test edi, edi
jge 0x153de
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
jmp 0x15490
jp 0x153fc
xchg cx, cx
jnp 0x153fc
mov gs, esi
jae 0x1541a
test eax, 0x4ae9aff1
test eax, 0x3fe7e9fa
mov ecx, dword cs:[ebp + 0x10]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
movzx eax, word [esi + 0x1e]
lea eax, [eax + esi + 0x20]
push eax
push 0x16554
lea eax, [ebp - 0x108]
push 0x100
push eax
call sub.ntoskrnl.exe__snprintf
add esp, 0x10
jb 0x1543c
add dword [eax], eax
add byte [eax - 0x18], dl
mov dword [edi], 0xc4830000
adc byte [edi], cl
adc byte [eax], 0
add byte [eax], al
mov cx, cx
nop
nop
nop
nop
jae 0x1543c
out dx, eax
sbb edi, edi
jne 0x1544b
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push eax
call fcn.00015790
mov edi, eax
test edi, edi
jl 0x153d2
add eax, dword [eax]
add byte [ebx + 0xfff85f8], cl
invalid
push bx
push ecx
push edx
test al, cl
sub ch, 0x6b
inc bx
cmp bx, cx
and cl, 0x5a
mov bx, di
test ax, dx
pop edx
pop ecx
pop bx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
jb 0x15490
mov cx, cx
nop
nop
nop
nop
jae 0x15490
out dx, eax
sbb ecx, dword [ebx - 0x47fa1439]
add dword [eax], eax
add al, al
mov eax, edi
jmp 0x15499
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1594c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
mov esi, 0xff
push edi
xor edx, edx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x806]
mov word [ebp - 0x808], dx
mov byte [ebp - 0x408], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x407]
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jle 0x159a3
mov cx, cx
jg 0x159a3
retf 0x8ef7
cmp dword [ebp + 8], edx
je 0x15aa4
push ax
push ebx
inc bh
cmp ax, 0x7871
inc bx
add bx, di
test ax, 0x5a1d
cmp bh, 0x5e
inc bx
cmp ah, dh
pop ebx
pop ax
lea eax, [ebp - 8]
push edx
push eax
push edx
push edx
push edx
push dword [ebp + 8]
call dword [0x16c00]
test eax, eax
jl 0x15aa4
push cx
push eax
and ch, dl
test dl, cl
test eax, 0x5d9b
add cl, ah
dec al
test cx, 0x16a6
test ebx, eax
pop eax
pop cx
and word [ebp - 0x408], 0
mov word [ebp - 0x406], 0x3fe
pushal
inc bh
popal
lea eax, [ebp - 4]
mov esi, 0x3fe
push eax
lea eax, [ebp - 0x408]
push esi
push eax
push dword [ebp - 8]
call sub.ntoskrnl.exe_ObQueryNameString
mov ecx, dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
jl 0x15aa4
jle 0x15a51
mov esi, esi
nop
jg 0x15a51
jns 0x15aa4
test al, 0x40
out dx, eax
insd dword es:[edi], dx
test ebx, esi
aaa
mov al, 0xa7
adc dword [ebp + 0x61e7cb6], edx
iretd
cmp dword [ebp - 4], esi
ja 0x15aa4
js 0x15a72
push di
pop di
jns 0x15a72
jg 0x159f1
clc
mov bh, 0x48
pop ebx
not dword ds:[ebp - 0x74b16772]
dec ebp
cld
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x404]
mov eax, ecx
lea edi, [ebp - 0x808]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x808]
and ecx, 3
push 0x16240
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0001518c
test eax, eax
jne 0x15aa8
xor al, al
jmp 0x15ab1
push edx
or dh, 0xe
cmp dh, ch
pop edx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xd75058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd751a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd7507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7506a
add dl, dl
jne 0xd75089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd750dc
xor eax, eax
add dl, dl
jne 0xd75096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7517d
add dl, dl
jne 0xd750a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd750d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd75075
mov eax, 1
add dl, dl
jne 0xd750ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd750e1
sub eax, ebx
mov ebx, 1
jne 0xd75128
mov ecx, 1
add dl, dl
jne 0xd7510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd75119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd75105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd7513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd7514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd75136
cmp eax, 0x7d00
jae 0xd7516d
cmp eax, 0x500
jb 0xd75168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
cmp eax, 0x7f
ja 0xd75170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd7519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd75075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10