joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3421119a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a62c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x342286ac
mov ecx, dword [esi + 0x1038]
mov dword [esp + 0x30], 0
test ecx, ecx
jne 0x342b224e
mov dword [esi], 0x3422866c
mov esi, dword [esi + 0x1018]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
jne 0x342b22a9
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 0
lea edx, [esp + 0x10]
push edx
push eax
mov byte [esp + 0x38], al
call fcn.342259d5
mov edi, dword [esi + 0x1038]
test edi, edi
je 0x342b2288
mov ecx, edi
call fcn.341f6bcc
push edi
call fcn.341f5892
add esp, 4
test dword [esp + 0x10], 0xfffffffe
mov byte [esp + 0x30], 0
je 0x342111e1
lea ecx, [esp + 0x10]
call fcn.341ffba8
jmp 0x342111e1
mov ecx, esi
call fcn.34216518
push esi
call fcn.341f5892
add esp, 4
jmp 0x342111fd
Function at 0x3421314b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 4]
movzx eax, word [esi + 0xc]
cmp eax, dword [ecx + 0xc]
ja 0x3421320c
movzx eax, word [esi + 0xc]
push ebx
movzx ebx, word [esi + eax*2 + 0xc]
push edi
mov edi, dword [esp + 0x10]
and ebx, 0x3fff
cmp edi, eax
jae 0x3421320a
cmp dword [esp + 0x14], 0
push ebp
mov ebp, dword [esp + 0x1c]
jne 0x34213210
movzx eax, word [esi + edi*2 + 0xe]
and eax, 0x3fff
test ebp, ebp
jge 0x34213221
cmp eax, ebx
jb 0x34213209
test ebp, ebp
jge 0x3421322b
sub eax, ebx
lea edx, [ebx + esi]
push eax
sub ebx, ebp
push edx
add ebx, esi
push ebx
call dword [sym.imp.MSVCR90.dll_memmove]
movzx eax, word [esi + 0xc]
add esp, 0xc
cmp edi, eax
jae 0x342131e8
lea ecx, [esi + edi*2 + 0xe]
movzx eax, word [ecx]
mov edx, eax
sub edx, ebp
xor edx, eax
and edx, 0x3fff
xor edx, eax
mov word [ecx], dx
movzx eax, word [esi + 0xc]
inc edi
add ecx, 2
cmp edi, eax
jb 0x342131c8
movzx eax, word [esi + 0xc]
movzx ecx, ax
mov dx, word [esi + ecx*2 + 0xc]
mov ecx, 0x3fff
and dx, cx
add eax, eax
sub dx, ax
sub dx, 0xe
mov word [esi + 2], dx
pop ebp
pop edi
pop ebx
pop esi
ret 0xc
push edi
mov ecx, esi
call fcn.342101db
test ebp, ebp
jg 0x34213221
jmp 0x342adbd9
cmp ebx, ebp
jae 0x3421319b
jmp 0x34213209
movzx ecx, word [esi + edi*2 + 0xe]
and ecx, 0x3fff
cmp ecx, ebp
jge 0x342131a7
jmp 0x34213209
add eax, ebp
jmp 0x34213193

Function at 0x34214990
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x342ae2b4
cmp dword [ecx + 0x108], 0
jne 0x342ae291
mov dword [esp + 8], edx
jmp fcn.341f64e1
mov eax, dword [ecx + 0x108]
push esi
lea esi, [esp + 0xc]
push esi
push edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
pop esi
ret 8
Function at 0x34216312
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a66e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x342286cc
test byte [esi + 0x78], 8
mov dword [esp + 0x30], 0
jne 0x342b353b
test byte [esi + 0x78], 1
jne 0x342176a8
mov edx, dword [esi + 0x14]
push edx
lea ecx, [esi + 0x1c]
call fcn.341f55b7
mov edi, dword [esi + 0x74]
test edi, edi
jne 0x342b3586
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.34216397
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov ecx, dword [esi + 0x1c]
and cl, 7
cmp cl, 4
jne 0x3421635f
jmp 0x3421636b
mov dword [esp + 0x10], 1
mov dword [esp + 0x24], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
push 0
lea edi, [esp + 0x14]
push edi
push 1
push eax
mov eax, dword [edx + 8]
mov byte [esp + 0x40], 1
call eax
test dword [esp + 0x10], 0xfffffffe
mov byte [esp + 0x30], 0
je 0x34216355
mov ecx, edi
call fcn.341ffba8
jmp 0x34216355
mov ecx, edi
call fcn.341f6d3a
push edi
call fcn.341f5892
add esp, 4
jmp 0x34216376

Function at 0x342163bb
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov dword [esp + 4], ecx
and ecx, 0xfffff000
jmp 0x342163cb
push 0xffffffffffffffff
push 0x343a4a44
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
sub eax, ecx
lea ecx, [eax - 8]
mov eax, 0x8421085
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
lea eax, [esp + 0x10]
shr ecx, 6
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.341fac18
test dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x30], 0xffffffff
jne 0x342ac70f
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
add esp, 0x30
ret 4
lea ecx, [esp + 0x10]
call fcn.341ffba8
jmp 0x3421644e
Function at 0x34216655
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a6cc6
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
cmp dword [esi + 8], 0
mov dword [esp + 0x30], 4
jg 0x342b3fc8
mov eax, dword [esi + 0xa4]
lea edi, [eax - 1]
test edi, edi
jl 0x342166b4
lea ebx, [ebx]
mov ecx, dword [esi + 0x9c]
mov ecx, dword [ecx + edi*4]
call fcn.34201945
sub edi, 1
jns 0x342166a1
mov eax, dword [esi + 0xc8]
lea edi, [eax - 1]
test edi, edi
jl 0x342166d5
mov edx, dword [esi + 0xc0]
mov ecx, dword [edx + edi*4]
push esi
dec edi
call fcn.3425f5a7
test edi, edi
jge 0x342166c1
mov ecx, dword [esi]
push esi
call fcn.341f5f46
lea ecx, [esi + 0xcc]
mov byte [esp + 0x30], 3
call fcn.341f6d3a
lea ecx, [esi + 0xc0]
mov byte [esp + 0x30], 2
call fcn.341f6d3a
lea ecx, [esi + 0xb4]
mov byte [esp + 0x30], 1
call fcn.341f6d3a
lea ecx, [esi + 0xa8]
mov byte [esp + 0x30], 0
call fcn.341f6d3a
lea ecx, [esi + 0x9c]
mov dword [esp + 0x30], 0xffffffff
call fcn.341f6d3a
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov edi, 0xfffffffe
mov edi, edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x24], 0
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x38], 5
call fcn.34263e73
mov byte [esp + 0x30], 4
test dword [esp + 0x10], edi
je 0x342b4006
lea ecx, [esp + 0x10]
call fcn.341ffba8
cmp dword [esi + 8], 0
jle 0x34216692
jmp 0x342b3fcf
Function at 0x34218d28
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x343a58f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x18], 0x80
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x50]
jne 0x34218dd6
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0x5c]
push ecx
push ebp
push edx
xor edi, edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x342b00dc
cmp dword [esp + 0x58], ebp
jne 0x342b014f
test byte [esi + 0x18], 0x80
jne 0x342b0164
call fcn.341f37b8
inc dword [eax + 0xdc]
add eax, 0xdc
mov eax, dword [esp + 0x5c]
test byte [eax], 8
jne 0x342b01e7
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
xor edi, edi
jmp 0x34218d99
mov dword [esp + 0x28], 1
mov dword [esp + 0x3c], edi
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x4c], edi
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
mov eax, dword [esp + 0x28]
test al, 1
jne 0x342b0118
cmp dword [esp + 0x2c], 0xfffffc15
jne 0x342b0118
or dword [esi + 0x18], 0x80
jmp 0x342b012e
test al, 8
je 0x342b012e
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x28]
push edx
call fcn.341f3803
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
test eax, 0xfffffffe
je 0x34218d99
lea ecx, [esp + 0x28]
call fcn.341ffba8
jmp 0x34218d99
mov ecx, dword [esp + 0x5c]
push 1
push 0xfffffc06
call fcn.341f8dac
jmp 0x34218d99
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x342b0195
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
jmp 0x342b01d9
mov eax, dword [esp + 0x54]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x5c]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x342b01c3
mov edx, dword [esp + 0x5c]
push edx
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
jmp 0x342b01d9
cmp dword [esp + 0x58], ebp
je 0x342b01d9
mov ecx, dword [esp + 0x5c]
push 1
push 0xfffffc06
call fcn.341f8dac
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x34218da3
push edi
push eax
mov ecx, esi
call fcn.3429a78b
jmp 0x34218dc0
Function at 0x34219984
Capabilities:
Get hostname

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x342b6373
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.341f8c56
jmp 0x342199a7

Function at 0x34219b41
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x34234fcc]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [0x343e4730]
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, ebx
and esi, 0x1fffeff
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
cmp ebx, eax
jne 0x34219b8f
test edi, edi
je 0x34219b79
mov dword [edi], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.341f1dd1
add esp, 0x18
ret 0xc
cmp dword [0x343e4df4], 0
je 0x342d7131
mov ecx, dword [esp + 0x28]
push ecx
call fcn.34219c36
test eax, eax
je 0x34219c1a
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
call edx
test eax, eax
jne 0x34219c1a
test edi, edi
je 0x34219be0
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x34219c32
cmp dword [0x343e4dfc], ecx
jne 0x34219c32
mov eax, dword [0x343e4730]
test eax, eax
je 0x34219c32
mov dword [edi], eax
push 0xa
lea eax, [esp + 0x18]
push eax
push 0x1004
and esi, 0xfeffffff
push esi
mov dword [0x343e4730], ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x342d7147
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
mov dword [0x343e4df8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.341f1dd1
add esp, 0x18
ret 0xc
mov dword [edi], ecx
jmp 0x34219be0
test edi, edi
je 0x342d713c
mov eax, dword [0x343e4dfc]
mov dword [edi], eax
mov dword [0x343e4dfc], ebx
jmp 0x34219c1a
mov dword [0x343e4df8], 0
jmp 0x34219c1a
Function at 0x3421c431
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x343a5068
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
cmp dword [edi + 0x44], eax
je 0x3421c4db
mov dword [esp + 0x1c], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x40]
mov ebp, dword [eax + 0x38]
mov eax, dword [eax + 0x5c]
mov dword [esp + 0x18], eax
call fcn.341f37b8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, edi
call fcn.3421c4f1
mov al, byte [esp + 0x1c]
test al, 8
jne 0x342ad130
test al, 1
je 0x342ad19f
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x1c]
push eax
call fcn.341f3803
test dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x3c], 0xffffffff
jne 0x342ad24a
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ebp, dword [esp + 0x14]
mov ecx, ebp
dec ebp
mov dword [esp + 0x14], ebp
test ecx, ecx
jbe 0x3421c4af
lea ecx, [esp + 0x1c]
call fcn.341f5f2f
call fcn.341f37b8
call ebx
mov ebp, eax
call fcn.341f37b8
mov edx, dword [esp + 0x18]
sub esi, ebp
add esi, edx
cmp esi, 0x80000000
jae 0x342ad172
call fcn.341f37b8
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.341f37b8
call ebx
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.3421c4f1
mov al, byte [esp + 0x1c]
test al, 8
je 0x3421c4af
jmp 0x342ad12c
mov ecx, dword [esp + 0x20]
cmp ecx, 0xfffffbae
jl 0x3421c4b7
cmp ecx, 0xfffffbaf
jle 0x342ad1c3
cmp ecx, 0xfffffbb2
jne 0x3421c4b7
test byte [edi + 0xf8], 0x10
je 0x342ad1f0
cmp dword [edi + 0x3ec], 0
jne 0x342ad1f0
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x342ad1df
mov eax, ecx
mov ecx, dword [esp + 0x50]
push 1
push eax
call fcn.341f8dac
jmp 0x3421c4c5
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
push ecx
mov ecx, edi
call fcn.34328dcf
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jne 0x342ad21d
mov dl, byte [esp + 0x1c]
and dl, 1
movsx ecx, dl
neg ecx
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x20]
test eax, eax
je 0x342ad239
cmp eax, dword [edi + 0x68]
je 0x342ad239
mov edx, dword [esp + 0x50]
push edx
push eax
push ecx
mov ecx, edi
call fcn.3432901a
jmp 0x3421c4c5
push 1
push ecx
mov ecx, dword [esp + 0x58]
call fcn.341f8dac
jmp 0x3421c4c5
lea ecx, [esp + 0x1c]
call fcn.341ffba8
jmp 0x3421c4db
Function at 0x34222919
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add eax, 0x100000
shl eax, 9
cmp edx, 0xffffffff
je 0x34222930
add eax, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
jmp fcn.3421c431
Function at 0x3422417d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jbe 0x342241c0
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esi]
mov ecx, eax
shr ecx, 8
movzx ecx, byte [ecx + 0x342241c8]
shl eax, 8
add eax, edi
mov edi, ecx
shl edi, 0xd
xor edi, ecx
add edi, edi
xor eax, ecx
add edi, edi
xor edi, eax
dec edx
and edi, 0xffff
inc esi
mov eax, edi
test edx, edx
ja 0x3422418d
pop edi
pop esi
ret 8

Function at 0x3423e289
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
cmp ecx, dword [esp + 8]
je 0x3423e2a7
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
inc ecx
jmp 0x3423e292
ret 8
Function at 0x3424457e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push 0x1c
push 0x64
lea eax, [ebp - 0x194]
push eax
push dword [esi + 8]
push dword [ebp + 8]
call fcn.3424463e
movsx ebx, ax
mov eax, dword [edi + 0x88]
test eax, eax
jl 0x342c3b12
test ebx, ebx
jl 0x342c3b12
push 0
push ebx
push eax
call fcn.342126bc
test eax, eax
je 0x342c3b12
mov eax, dword [edi + 0x88]
add eax, ebx
lea ecx, [edi + 0x8c]
cmp eax, dword [ecx]
jg 0x342c3b00
lea edx, [ebp - 0x194]
lea ebx, [ebp + ebx*4 - 0x194]
mov eax, edx
cmp eax, ebx
jae 0x34244639
mov ecx, dword [edi + 0x88]
mov eax, ecx
shl eax, 5
add eax, dword [edi + 0x84]
inc ecx
mov dword [edi + 0x88], ecx
mov ecx, dword [edx]
mov dword [eax + 8], ecx
mov ecx, dword [eax]
xor ecx, dword [esi]
add edx, 4
and ecx, 1
xor dword [eax], ecx
mov cl, byte [esi + 0x10]
mov byte [eax + 0x10], cl
mov cl, byte [esi + 0x11]
mov byte [eax + 0x11], cl
mov ecx, dword [eax]
xor ecx, dword [esi]
and ecx, 0x10
xor dword [eax], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
cmp edx, ebx
jb 0x342445f1
pop ebx
leave
ret 4
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call fcn.34244057
test eax, eax
jne 0x342c3b23
mov eax, dword [ebp + 8]
push 0xfffffc15
push dword [eax + 0x14]
call dword [sym.imp.MSVCR90.dll_longjmp]
push dword [ebp - 4]
lea eax, [edi + 0x84]
push eax
push dword [ebp + 8]
call fcn.3424daac
jmp 0x342445de
Function at 0x3425fa66
Capabilities:
Inspect section memory permissions

Disassembly:
and dword [ebp + 0x14], 0xffffffdf
jmp 0x3425faed
or dword [ebp + 0x14], 0x4000000
jmp 0x3425fb25
mov eax, dword [eax + 0x24]
cmp dword [eax], 2
jne 0x3425fb11
jmp 0x342c0a19
or dword [ebp + 0x14], 1
jmp 0x3425fb63
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, ecx
imul edx, edx, 0x14
push ebx
push esi
mov esi, dword [eax + 0x30]
push edi
xor edi, edi
add esi, edx
inc edi
test byte [eax + 0x2c], 1
mov ebx, 0x400
je 0x34250c3b
mov eax, dword [eax + 0x4b0]
test eax, eax
je 0x3425fae9
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x34250c3b
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0xa0]
mov edx, ecx
and edx, 0x80
jne 0x3429450a
test byte [eax + 0x110], 0x20
je 0x3429450a
test ecx, 0x300
jne 0x3429450a
cmp dword [eax + 0xf0], 0
jne 0x3425fae1
or dword [ebp + 0x14], ebx
test edi, edi
je 0x34250c3b
or dword [ebp + 0x14], 0x20
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 2
jne 0x34289cd5
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x2c]
mov edx, 0x200
test cl, 8
jne 0x3425f68e
test ecx, 0x100
jne 0x342c0a21
test edx, ecx
jne 0x3425a3eb
test ebx, ecx
jne 0x34286002
test ecx, 0x800
jne 0x342c0a2d
test ecx, 0x1000
jne 0x342c0a39
mov eax, dword [esi + 4]
cmp eax, 0x12
je 0x3425fa5d
cmp eax, 9
jb 0x3425fa5d
cmp eax, 0x10
je 0x3425fa5d
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
or dword [ebp + 0x14], 0x8000000
jmp 0x3425fb2d
xor edi, edi
jmp 0x3425fad5
cmp eax, 1
jne 0x3425fb45
or dword [ebp + 0x14], 0x400000
jmp 0x3425fb45
test edx, edx
jne 0x3428600e
test byte [eax + 0x110], 0x40
jne 0x3425fad5
jmp 0x3428600e
or dword [ebp + 0x14], edx
jmp 0x3425fb11
or dword [ebp + 0x14], 0x20000000
jmp 0x3425fb1d
or dword [ebp + 0x14], 0x40000000
jmp 0x3425fb39
or dword [ebp + 0x14], 0x10400000
jmp 0x3425fb45

Function at 0x34264ba4
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x342b6328
pop esi
ret 8
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.341f8c56
jmp 0x34264bb9
Function at 0x34266888
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xf0]
and dword [ebp - 0xc], 0
or dword [ebp + 0xc], 0xffffffff
push edi
mov edi, dword [ecx + 0xec]
test eax, eax
jne 0x342934a2
pop edi
leave
ret 8
imul eax, eax, 0x34
add eax, edi
push ebx
push esi
cmp edi, eax
jae 0x342934d2
sub eax, edi
push 0x34
dec eax
xor edx, edx
pop ebx
div ebx
lea esi, [edi + 0x30]
inc eax
mov dx, word [esi]
xor dx, word [ecx + 0xdc]
and dx, 0x3f
xor word [esi], dx
add esi, 0x34
dec eax
jne 0x342934bb
mov eax, dword [ecx + 0xdc]
test eax, eax
je 0x342935b2
mov edx, dword [ecx + 0xd8]
imul eax, eax, 0x34
and dword [ebp - 8], 0
and dword [ebp - 4], 0
add eax, edx
mov dword [ebp - 0x10], eax
cmp edx, eax
jae 0x342935a3
mov esi, dword [edx + 4]
mov al, byte [esi + 4]
cmp al, 0xa
jne 0x34293c11
cmp byte [esi + 5], 0
jne 0x34293518
mov ebx, dword [esi + 8]
mov dword [ebp - 0xc], ebx
cmp al, 0xa
jne 0x34293c11
cmp byte [esi + 5], 0
jne 0x34293c11
mov eax, dword [ebp - 0xc]
cmp byte [eax + 9], 3
jne 0x34293c11
mov eax, dword [eax + 4]
imul eax, eax, 0x34
add eax, edi
movzx esi, word [eax + 0x30]
inc dword [ebp - 8]
mov ebx, esi
shl ebx, 0xa
movsx ebx, bx
sar ebx, 0xa
cmp ebx, dword [ecx + 0xdc]
jne 0x34293594
mov ebx, esi
xor ebx, dword [ebp - 4]
and ebx, 0x3f
xor ebx, esi
mov word [eax + 0x30], bx
mov esi, dword [edx + 0x28]
mov ebx, 0x80
and esi, ebx
or dword [eax + 0x28], esi
cmp byte [eax + 0x2e], 1
jne 0x34293583
test byte [edx + 0x28], bl
jne 0x342d29dc
cmp dword [ebp + 0xc], 0xffffffff
jne 0x342d29f5
movsx eax, byte [eax + 0x2e]
mov dword [ebp + 0xc], eax
add edx, 0x34
inc dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x342934fe
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + 0xdc]
je 0x342d2a04
pop esi
pop ebx
jmp 0x342668ae
test byte [ecx + 0xb4], 0x20
je 0x342935b2
test dword [edx + 0x28], 0x1000
jne 0x342d2a13
and dword [ebp + 0xc], 0
jmp 0x34293594
cmp word [ecx + 0xbc], 6
jne 0x34293583
or dword [ecx + 0xb4], ebx
jmp 0x34293583
movsx esi, byte [eax + 0x2e]
cmp esi, dword [ebp + 0xc]
jle 0x3429358d
jmp 0x342d2a13
or dword [ecx + 0xb4], 0x400
jmp 0x342935b2
mov esi, dword [ebp + 8]
push 0
push 0
push 0xffffe071
push dword [edx + 4]
push dword [ecx + 0x80]
push esi
call fcn.3433efbb
push 0xfffff439
push dword [esi + 0x14]
call dword [sym.imp.MSVCR90.dll_longjmp]
int3
Function at 0x34270b42
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x343a7641
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
push 0
push edi
push 0
push eax
push ebp
push ecx
mov ecx, esi
call fcn.341ff330
lea ebx, [esi + 0x1ec]
mov dword [esi], 0x34228ab4
mov dword [esp + 0x20], 0
mov dword [ebx], 0x3422821c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1cc], eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [esi + 0x1d0], eax
mov eax, dword [esp + 0x34]
push eax
mov ecx, ebp
mov byte [esp + 0x24], 1
mov dword [esi + 0x1d4], 0
mov dword [esi + 0x1d8], ebp
mov dword [esi + 0x1dc], edx
mov dword [esi + 0x1e0], eax
mov dword [esi + 0x1e4], 3
call fcn.341fee81
test al, al
je 0x34270ce7
mov eax, dword [esp + 0x34]
mov ebp, dword [ebp + eax*4 + 0xf4]
mov eax, dword [ebp + 0x18]
mov word [esi + 0x1e8], ax
mov dword [esi + 0x24], ebx
test byte [edi], 8
jne 0x34270ccf
push 0x82c
call fcn.341f21e0
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], 2
test eax, eax
je 0x34270cee
mov ecx, dword [esi + 0x1d0]
mov edx, dword [ecx + 0x10]
push edi
push edx
mov ecx, eax
call fcn.341fb404
mov ebx, eax
mov byte [esp + 0x20], 1
mov dword [esi + 0x1d4], ebx
test ebx, ebx
je 0x342b690b
test byte [edi], 8
jne 0x342b691e
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [esi + 0x1d4]
push edi
push eax
call fcn.342063da
test byte [edi], 8
jne 0x34270ccf
mov ebp, 0x34270d00
test byte [edi], 8
jne 0x342b693d
mov edx, dword [ebp]
mov eax, dword [esi + 0x1d0]
push edi
lea ecx, [ebp + 4]
push ecx
mov ecx, dword [esi + 0x1d4]
push edx
push eax
call fcn.341fc9f5
add ebp, 0x24
cmp ebp, 0x34270d24
jl 0x34270c8e
test byte [edi], 8
jne 0x342b693d
mov eax, dword [esi + 0x1d4]
inc dword [eax + 0x50]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
xor ebp, ebp
jmp 0x34270c0c
xor ebx, ebx
jmp 0x34270c54
test byte [edi], 8
jne 0x34270ccf
jmp 0x34270c70
push 1
push 0xfffffc0d
mov ecx, edi
call fcn.341f8dac
jmp 0x34270cf5
mov ecx, ebx
call fcn.34200dc5
push ebx
call fcn.341f5892
add esp, 4
mov dword [esi + 0x1d4], 0
jmp 0x34270cf5
mov edi, dword [esi + 0x1d4]
test edi, edi
je 0x342b6957
mov ecx, edi
call fcn.34200dc5
push edi
call fcn.341f5892
add esp, 4
mov dword [esi + 0x1d4], 0
jmp 0x34270ccf