joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011b44
Capabilities:
Check os version
Packed with generic packer

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
pop esi
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001c150
push ecx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
or ecx, dword [esp]
push ebx
push dword [esp + 0xc]
push dword [esp + 4]
push 0x10000c70
push 0xfff5bcd
jmp loc.1002b8e7

Function at 0x10011d2f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20c], eax
mov eax, dword [ecx + 0x14]
adc al, 0x85
invalid
jne 0x10011cea
jmp loc.1002f12a

Function at 0x10011d94
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push 0x1001c7d7
push 0x1001c864
pop eax
push 0x10000c5d
push 0x100009d2
push 0xffffffffffffffa3
push eax
push 0xfffe841
call fcn.10003abc
push 0x1001d05d
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov eax, dword [esp + 8]
test eax, eax
seta al
mov byte [0x1000d59c], al
mov eax, esi

Function at 0x10011deb
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
push 0
push 0
push 0x1001c63b
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
mov ebp, eax
push 0
push ebp
push ecx
push 0x1e
push 0x10004b68
call 0x10011e3f
call fcn.10009033
mov ecx, edi
xor esi, esi
call fcn.100115cc
cmp eax, 2
jne fcn.10011deb
push 0x1001d244
mov esi, 0x1001ce8a
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push 0x10003f78
push 0xffffffffffffffff
push dword [esp - 0x31]
push 0xffffffffffffffcc
call fcn.10011e6e
push eax
push esi
push 0x1001c852
call fcn.1000303c
jmp loc.1002e1a4

Function at 0x10011e3f
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
push 0
push 0
push 0x1001c63b
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
mov ebp, eax
push 0
push ebp
push ecx
push 0x1e
push 0x10004b68
call 0x10011e3f
call fcn.10009033
mov ecx, edi
xor esi, esi
call fcn.100115cc
cmp eax, 2
jne fcn.10011deb
push 0x1001d244
mov esi, 0x1001ce8a
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push 0x10003f78
push 0xffffffffffffffff
push dword [esp - 0x31]
push 0xffffffffffffffcc
call fcn.10011e6e
push eax
push esi
push 0x1001c852
call fcn.1000303c
jmp loc.1002e1a4
Function at 0x100121eb
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push 0x10005288
push 0x10004388
call 0x100121eb
push ebx
mov ebx, dword [esp + 0xc]
cmp ecx, ebx
je 0x100121df
push ebp
mov ebp, dword [eax + 0x14]
test ebp, ebp
mov dword [eax + 0xc], ebx
je 0x1001225f
push esi
push edi
lea ecx, [ecx]
mov eax, dword [ebp + 4]
test eax, eax
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0x100028d8
push 0xffffffffffffffda
push dword [esp - 0x5c]
push 0x10002390
call fcn.10012218
jmp 0x1002dca3
lea eax, [esp]
push eax
push 0x1001d347
push dword [ebp - 0xc]
rol dword [ecx], cl
adc bh, bh
jne 0x10012259
push esi
push ebp
push 0x100008a6
push 0xffffffffffffffe7
push 0xfff73a9
call fcn.10003731
push esi
jmp 0x1002db21

Function at 0x100122ac
Capabilities:
Packed with generic packer

Disassembly:
push esi
push eax
push dword [esp - 0x69]
push dword [esp + 8]
call fcn.100122cd
mov eax, dword [esi + 0x14]
cmp eax, ebx
jmp loc.1002bc81

Function at 0x10012aa7
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
mov eax, esi
sub eax, edi
cmp eax, 0x1000
jae 0x10012adc
push 2
add esi, 0x1001c40e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
jmp 0x1002f8d0
mov ebx, eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call fcn.10009e99
mov byte [ebp - 4], 0
jmp 0x1002d373

Function at 0x10012afc
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push ecx
call fcn.10012b38
mov eax, 0x1001c89d
mov ecx, 0x1001d205
mov ecx, 0x1001d116
call fcn.1000e28d
push 0x1001c8ea
call fcn.10004ea6
pop ecx
mov ecx, 0x1001c826
jmp loc.1002f397

Function at 0x10012bf8
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0xc]
push eax
jmp loc.1002f1ad
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x10012bc4
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10012bee
xor eax, eax
push eax
push dword [esp + 0x4a]
push 0xffffffffffffffa8
push 0x10003a78
push 0xffffffffffffffc1
push 0x66
call 0x10012c33
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x10012bb9
pop edi
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
cmp ebx, 3
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push dword [esp - 0x5a]
push esp
push ecx
push esp
call fcn.10012c70
cmp eax, 0xffffffff
jmp loc.1002cdb9
Function at 0x10012c33
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0xc]
push eax
jmp loc.1002f1ad
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x10012bc4
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10012bee
xor eax, eax
push eax
push dword [esp + 0x4a]
push 0xffffffffffffffa8
push 0x10003a78
push 0xffffffffffffffc1
push 0x66
call 0x10012c33
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x10012bb9
pop edi
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
cmp ebx, 3
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push dword [esp - 0x5a]
push esp
push ecx
push esp
call fcn.10012c70
cmp eax, 0xffffffff
jmp loc.1002cdb9

Function at 0x10012c70
Capabilities:
Query environment variable

Disassembly:
test eax, eax
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push esp
push dword [esp + 0x58]
push eax
push ebp
push ecx
call 0x10012ca4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10012c6e
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [0x1001c0b4]
call fcn.10010742
lea esp, [esp + 0x18]
pop eax
ret 8

Function at 0x100134e8
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push 0x1001c780
push edx
call dword [sym.imp.WINSPOOL.DRV_OpenPrinterA]
test eax, eax
push ebx
push esi
push 0xffffffffffffffe4
push 0x10005a58
call 0x100134e8
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp]
push edx
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x74]
mov eax, dword [esp]
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push 0x10005bb8
push 0x10002308
push dword [esp - 0x4f]
call 0x10013513
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push 0x1001d309
push 0
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x4d
push eax
call fcn.10013546
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
dec eax
cmp eax, 9
jmp loc.1002cf5b

Function at 0x10013513
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push 0x1001c780
push edx
call dword [sym.imp.WINSPOOL.DRV_OpenPrinterA]
test eax, eax
push ebx
push esi
push 0xffffffffffffffe4
push 0x10005a58
call 0x100134e8
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp]
push edx
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x74]
mov eax, dword [esp]
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push 0x10005bb8
push 0x10002308
push dword [esp - 0x4f]
call 0x10013513
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push 0x1001d309
push 0
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x4d
push eax
call fcn.10013546
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
dec eax
cmp eax, 9
jmp loc.1002cf5b
Function at 0x1001364b
Capabilities:
Packed with generic packer

Disassembly:
inc eax
test cl, cl
jne 0x10013639
push esi
push edi
mov edi, 0x1001c37e
sub eax, edx
dec edi
mov cl, byte [edi + 1]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [esp + 0x10]
push eax
push esi
call fcn.10006d77
and ecx, 0xff
push esi
push 0x10000e26
push dword [esp + 4]
push 0x10000a67
push 0x100028e8
call fcn.10003abc
mov eax, dword [ecx]
call dword [eax + 4]
push eax
push 0x1001caa1
call fcn.10004090
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001363a
dec dword [eax]
jne 0x100136c4
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 0x18]
jbe 0x10013699
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x10005c7c
jmp 0x1002f6c5

Function at 0x100141a1
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push 0x71
push 0xfffef39
call fcn.10003cc0
mov eax, dword [edi + 4]
mov ecx, dword [0x1001c783]
cmp eax, ecx
je 0x1001420f
push ecx
push eax
call esi
test eax, eax
je 0x100141fa
mov eax, dword [0x1001ca66]
push 0x56
push 0x8a5
push 0x22
call fcn.1000cfbe
add esp, 0xc
ret
push sym.imp.KERNEL32.dll_GetModuleHandleA
push 0xffffffffffffffd7
push 0xffffffffffffffc4
push 0x13ae
push esp
push 0x1001c113
push edx
jmp loc.1002c00e

Function at 0x10015b30
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov dword [edi], 0x100066a8
mov dword [esp + 0x20], ebp
call fcn.1000e91b
mov ecx, dword [esp + 0x14]
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
xor edi, edi
mov edx, dword [esp + 0x10]
push 0x4e
call fcn.1000730c
push dword [esp + 0xc]
push 5
push ecx
push 0x10000c5a
push 0xfff90f5
call fcn.10003abc
pop ebx
mov eax, dword [ecx + 0xd4]
sub esp, 0xc
test eax, eax
push esi
lea esi, [ecx + 0xd4]
jne 0x10015ab6
push esi
push 0xffffffffffffff8b
push 0x1ea3
push edx
push ebx
push sym.imp.USER32.dll_GetForegroundWindow
push 0x1715
push sym.imp.USER32.dll_GetMenuItemCount
call fcn.10004656
push 0x26
push dword [esp + 4]
push dword [esp + 0xc]
push 0x67
push 0xfff9d50
call fcn.10003731
pop esi
pop ebp
pop ebx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push 0x14
push 0xffffffffffffffbd
push 0x25
call fcn.1000e63a
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001c891
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
add esp, 0xc
test eax, eax
push ecx
call fcn.1000c2b2
push 0xffffffffffffff80
push 0x100009b9
push dword [esp + 4]
push ecx
push 0xfff8d03
call fcn.10003cc0
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.100093ab
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esp
and al, 0x14
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
jne 0x10015ad6
jmp loc.1000ca71
Function at 0x1002b6c9
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
push dword [ebp - 8]
push dword [ebp - 4]
jmp loc.1000c423

Function at 0x1002b835
Capabilities:
Read file on windows

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
call fcn.100082dd
jmp loc.100082bb

Function at 0x1002c811
Capabilities:
Set thread local storage value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, 0x10007000
push 0x719533b1
push 0x40
push 0x3000
push 0x107b
push 0
mov ebx, 0x323
mov edi, eax
push eax
add esp, 0x18
leave
popal
popfd
mov ecx, 0x1001c62d
jmp loc.10006ecc

Function at 0x1002caa3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
pop edi
push ebx
dec edi
pop edi
dec edi
add ch, ch
aas
mov ah, 2
push ebx
dec ecx
nop
cmp al, 0
leave
popal
popfd
call fcn.100056b1
jmp fcn.100031e1

Function at 0x1002d947
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.10010739
jmp loc.10014198

Function at 0x1002da47
Capabilities:
Set thread local storage value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov eax, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
jne 0x10013df1
jmp loc.10008f83

Function at 0x1002dc10
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
sbb eax, 0x48000004
add al, ch
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 0
aas
add al, 0
push ebx
leave
popal
popfd
push 0x100014a4
jmp fcn.1000558f

Function at 0x1002dc34
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
sbb eax, 0x48000004
add al, ch
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 0
aas
add al, 0
push ebx
leave
popal
popfd
mov eax, dword [esi + 0x2018]
jmp loc.1000646c

Function at 0x1002e21c
Capabilities:
Set thread local storage value

Disassembly:
mov esi, dword [eax]
call esi
push 0x10000232
push dword [esp + 0xc]
push dword [esp + 8]
push dword [esp + 0xc]
push 0x1000a5df
call fcn.10003abc
xor eax, eax
test edx, edx
je loc.10006e4f
push edi
jmp loc.1002c80f
pushfd
pushal
push ebp
mov ebp, esp
dec eax
push ebx
push edx
dec ecx
dec ecx
add al, 1
dec ecx
and al, 0
add al, 0
add esp, 8
leave
popal
popfd
jne 0x10006ea1
jmp fcn.10010c65

Function at 0x1002e3ce
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
aas
popal
popfd
push 0x709
jmp loc.10015ebd
Function at 0x1002e451
Capabilities:
Query environment variable

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
cmp eax, 0x5b100080
jmp fcn.1000eee2

Function at 0x1002ea35
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403070
push 0x402410
push eax
push ebx
push edi
push 1
pop ecx
mov ecx, dword [0x1001124f]
mov ecx, dword [0x1002136b]
add esp, 0x18
leave
popal
popfd
call fcn.100038e6
jmp loc.1000a668

Function at 0x1002eea3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404100
push 0x403260
push eax
push ebx
push edi
push 1
pop ecx
mov ecx, dword [0x1001942f]
mov ecx, dword [0x10002d07]
add esp, 0x18
leave
popal
popfd
push 0x100070e0
jmp loc.1000d87f

Function at 0x1002f1ca
Capabilities:
Write file on windows

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add ah, ch
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 0
popal
popfd
call fcn.1000d7d9
jmp loc.100114cf

Function at 0x1002f2c5
Capabilities:
Query environment variable

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x409264
push 0x40924c
push 0x46adc0
push eax
mov edi, 0x4c30a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
push 0x1001cbd9
jmp fcn.1000e936

Function at 0x1002fb35
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x4156e0
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x10024921]
push eax
add esp, 0x18
leave
popal
popfd
call fcn.100040fb
jmp fcn.10004ace

Function at 0x1002fb64
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x4156e0
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x10024921]
push eax
add esp, 0x18
leave
popal
popfd
call fcn.100038e6
jmp fcn.1000c6ad

Function at 0x100302fd
Capabilities:
Set thread local storage value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050c0
push 0x404740
push eax
push ebx
push edi
push 1
pop ecx
mov ecx, dword [0x10002394]
mov ecx, dword [0x100033e5]
add esp, 0x18
leave
popal
popfd
push ecx
mov ecx, dword [esp + 0x18]
jmp fcn.1001063c

Function at 0x100306cf
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40931c
push 0x409304
push 0x46adc0
push eax
mov edi, 0x4c30a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
call fcn.100038e6
jmp fcn.1000be86
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x668a6396
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6e466ef7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403901
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4861f4]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x320], 0
je 0x40396d
push 0x110
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004463b0
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x40395e
mov ecx, esi
call fcn.004035c1
jmp 0x40396f
cmp dword [esp + 0xc], 6
jb 0x40396d
push esi
call fcn.00402be4
jmp 0x40396f
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.004428bd
mov esp, ebp
pop ebp
ret
Function at 0x40963c
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x45ce8e
call fcn.0044684c
mov ebx, ecx
cmp dword [ebx + 0x3c], 0
mov dword [ebp - 0x38], ebx
je 0x409751
cmp byte [ebx + 0x41], 0
je 0x409751
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x409674
xor al, al
jmp 0x409753
push 0
push 8
pop edi
lea esi, [ebp - 0x30]
call fcn.00408f66
and dword [ebp - 4], 0
lea eax, [ebx + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.00424029
mov esi, eax
call fcn.004082a1
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.00424029
mov esi, eax
call fcn.004082a1
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add edi, esi
push edi
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x4096e9
dec eax
je 0x4096ed
dec eax
dec eax
je 0x40974d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0040917d
mov al, bl
jmp 0x409753
mov byte [ebx + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.00424029
mov esi, eax
call fcn.004082a1
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x40972b
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.00424029
mov esi, eax
call fcn.004082a1
push dword [ebx + 0x4c]
push edi
push 1
push eax
call fcn.0044358c
add esp, 0x10
cmp edi, eax
jne 0x4096d7
cmp byte [ebx + 0x41], 0
je 0x40974d
test edi, edi
jne 0x40968b
push edi
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00408fca
mov ebx, dword [ebp - 0x38]
jmp 0x40968b
mov bl, 1
jmp 0x4096d9
mov al, 1
call fcn.004468cf
ret

Function at 0x40c69e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c702
cmp dword [ebp + 0xc], 1
je 0x40c6da
cmp dword [ebp + 0xc], 2
je 0x40c6da
push 0xd
pop eax
jmp 0x40c702
mov eax, dword [ebp - 4]
test edi, edi
je 0x40c6fc
test eax, eax
je 0x40c6f7
test al, 1
jne 0x40c6d5
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40c6fc
jmp 0x40c6d5
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x41216b
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x4c
mov eax, 0x461312
call fcn.004467e3
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x30]
push ecx
push 4
push eax
push 0x43b6bd
xor esi, esi
push esi
push esi
call fcn.0044573c
add esp, 0x18
cmp eax, esi
je 0x4121bf
mov ecx, dword [edi]
xor edx, edx
add ecx, 4
inc edx
lock xadd dword [ecx], edx
mov ecx, dword [edi]
push eax
lea esi, [ecx + 8]
call fcn.00411ec2
mov edi, dword [edi]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.004468bb
ret
lea eax, [ebp - 0x58]
call fcn.00401a52
push eax
mov dword [ebp - 4], esi
call fcn.0040ae7f
int3

Function at 0x412fad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4612a0
mov eax, dword fs:[0]
push eax
mov eax, 0x107c
call fcn.00455890
mov eax, dword [0x4861f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
push edi
push str.Bootstrapper::CreateProcess_module___S__args___S
lea esi, [eax + 0x188]
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edx
call fcn.00408d03
add esp, 0xc
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x1080]
push ebx
push eax
call fcn.004463b0
add esp, 0xc
xor eax, eax
push 0xffe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov dword [ebp - 0x1084], 0x44
call fcn.004463b0
add esp, 0xc
cmp word [edi], 0x22
mov esi, 0x800
lea eax, [ebp - 0x1014]
je 0x413083
push 0x46c578
push esi
push eax
call fcn.00444bd8
add esp, 0xc
push edi
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00444c47
add esp, 0xc
push 0x46c578
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00444c47
jmp 0x41308b
push edi
push esi
push eax
call fcn.00444bd8
add esp, 0xc
push 0x46c57c
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00444c47
add esp, 0xc
push dword [ebp - 0x101c]
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00444c47
add esp, 0xc
push edi
push str.CreateProcess__S_failed
lea esi, [ebp - 0x1038]
call fcn.004276d3
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0x1018]
lea eax, [ebp - 0x1084]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1014]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4130fe
mov eax, esi
call fcn.004255a9
push ebx
push 1
lea ecx, [ebp - 0x1038]
call fcn.0040917d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004428bd
leave
ret 4