joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3502e0d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x35092c54
call fcn.3505b82d
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edi
cmp dword [ebp + 8], edi
je 0x3502e136
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
cmp esi, 0x400
jg 0x3502e11f
push esi
call fcn.35028319
test al, al
je 0x3502e11f
mov eax, esi
call fcn.3505bc40
mov eax, esp
jmp 0x3502e128
push esi
lea ecx, [ebp - 0x14]
call fcn.3502a1fe
push esi
push dword [ebp + 8]
push eax
call fcn.35028449
cmp eax, edi
jne 0x3502e154
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.350298a7
mov eax, esi
lea esp, [ebp - 0x30]
call fcn.3505b8bf
ret 0x10
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, edi
jne 0x3502e181
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jg 0x3502e175
mov esi, eax
jmp 0x3502e13b
and eax, 0xffff
or eax, 0x80070000
jmp 0x3502e171
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, edi
jne 0x3502e1ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x3502e228
and eax, 0xffff
or eax, 0x80070000
jmp 0x3502e228
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x3502e194
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp byte [esi + ebx], 0
mov edi, ebx
je 0x3502e218
lea edi, [esi + 1]
cmp edi, 0x400
ja 0x3502e1f0
push edi
call fcn.35028319
test al, al
je 0x3502e1f0
mov eax, edi
call fcn.3505bc40
mov edi, esp
jmp 0x3502e1fb
push edi
lea ecx, [ebp - 0x14]
call fcn.3502a1fe
mov edi, eax
test edi, edi
jne 0x3502e206
mov esi, 0x8007000e
jmp 0x3502e22a
lea eax, [esi + 1]
push eax
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
test edi, edi
je 0x3502e1ff
push dword [ebp + 0x14]
lea ecx, [ebp - 0x20]
push edi
call fcn.3502c359
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x3502e13b

Function at 0x35045ce0
Capabilities:
Inspect section memory permissions

Disassembly:
add eax, esi
cmp dword [eax], ebx
je 0x35045d39
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x35045d34
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x35045d1e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x35045d26
cmp edx, ebx
jne 0x35045e74
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x35045cf5
add eax, dword [eax + 4]
jmp 0x35045ce2
mov dword [ebp + 0xc], ebx
jmp 0x35045d44
push es
Function at 0x35045d96
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x35045d5c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x35045d7a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x35045dd8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x35045dbf
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x35045dc8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x35045dd2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x35045db4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x35045d3e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x35045e25
dec eax
je 0x35045e1c
sub eax, 3
je fcn.35045e13
mov dword [ebp - 4], 0x40
jmp 0x35045e42
mov dword [ebp - 4], 0x20
jmp 0x35045e28
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x35045e74
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x35045df4
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.35045685
stosb byte es:[edi], al
rcr byte [esi + 0x6e], 1
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x35045e80
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3504978c
Capabilities:
Copy file
Get common file path
Set file attributes

Disassembly:
push 0x298
mov eax, 0x35095bb7
call fcn.3505b82d
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
test byte [0x350aba40], 1
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x220], esi
jne 0x350497d1
or dword [0x350aba40], 1
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x350aba3c], eax
or dword [ebp - 4], 0xffffffff
or dword [esi], 0xffffffff
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jne 0x35049808
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35049802
and eax, edi
or eax, esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x114]
push eax
push 0x350aba38
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x350aba3c]
shl ecx, 8
add eax, ecx
push eax
push 0x350a3b64
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x35049850
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x3504984a
and eax, edi
or eax, esi
mov dword [ebp - 0x21c], eax
push ebx
lea ecx, [ebp - 0x2a4]
call fcn.3503309b
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2a0]
cmp dword [ebp - 0x2a4], eax
je 0x3504989a
push dword [ebp - 0x2a4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test bl, bl
je 0x350498b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x350498ac
and eax, edi
or eax, esi
mov dword [ebp - 0x21c], eax
push 0x100
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x350498dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x350498d6
and eax, edi
or eax, esi
mov dword [ebp - 0x21c], eax
push 0
push 0x4000080
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x220]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x3504991c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x35049916
and eax, edi
or eax, esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
call fcn.3505b8bf
ret 8
Function at 0x3504eb79
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x27c
mov eax, 0x35096358
call fcn.3505b82d
xor ebx, ebx
cmp dword [0x350aba50], ebx
jne 0x3504ed87
mov eax, 0x350ac25c
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x74], 1
cmp dword [0x350aba50], ebx
jne 0x3504ed7b
push 0x3f
lea eax, [ebp - 0x5f]
push ebx
push eax
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x60], bl
call sub.msvcrt.dll_memset
mov byte [ebp - 0x20], bl
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x64], ebx
mov dword [0x350aba54], ebx
mov esi, SysReAllocString
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x68], 8
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0xea
je 0x3504ed43
cmp eax, ebx
jne 0x3504ed56
cmp byte [ebp - 0x20], 0x2e
jne 0x3504ed43
lea eax, [ebp - 0x6c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x3504ed56
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push 0x35007318
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x6c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x3504ed43
push 0xa0
call fcn.35027d7c
pop ecx
mov ecx, dword [0x350aba54]
mov dword [ecx*4 + 0x350aba58], eax
cmp eax, ebx
je 0x3504ed56
cmp byte [ebp - 0x20], 0x2e
lea edi, [ebp - 0x1f]
je 0x3504ecaa
lea edi, [ebp - 0x20]
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x184]
call fcn.35033046
mov byte [ebp - 4], 1
mov eax, dword [eax]
push 0x3f
push eax
mov eax, dword [0x350aba54]
mov eax, dword [eax*4 + 0x350aba58]
push 0x40
add eax, 0x20
push eax
call fcn.3501f117
mov byte [ebp - 4], bl
lea eax, [ebp - 0x180]
cmp dword [ebp - 0x184], eax
je 0x3504ecf7
push dword [ebp - 0x184]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push edi
lea ecx, [ebp - 0x288]
call fcn.35033046
mov byte [ebp - 4], 2
mov eax, dword [eax]
push 0xf
push eax
mov eax, dword [0x350aba54]
push 0x10
push dword [eax*4 + 0x350aba58]
call fcn.3501f117
mov byte [ebp - 4], bl
lea eax, [ebp - 0x284]
cmp dword [ebp - 0x288], eax
je 0x3504ed3d
push dword [ebp - 0x288]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
inc dword [0x350aba54]
inc dword [ebp - 0x64]
cmp dword [0x350aba54], 0x200
jb 0x3504ebef
push 0x3504eab8
push 4
push dword [0x350aba54]
push 0x350aba58
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
mov dword [0x350aba50], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.3501f3f4
xor eax, eax
call fcn.3505b8bf
ret
Function at 0x3505a84d
Capabilities:
Encode data using base64

Disassembly:
push 4
mov eax, 0x35097544
call fcn.3505b7ba
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x10]
xor edx, edx
push 3
pop ecx
div ecx
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
and ecx, 4
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.35027db0
mov esi, dword [ebp + 0x14]
pop ecx
push eax
mov ecx, esi
call fcn.35032539
cmp dword [esi + 4], ebx
jne 0x3505a8ab
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], bl
je 0x3505a8a1
push dword [ebp + 0xc]
call fcn.35027dd5
pop ecx
mov eax, 0x8007000e
jmp 0x3505a9b4
xor eax, eax
xor dl, dl
xor ecx, ecx
mov dword [ebp + 0x14], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x3505a995
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
sub ebx, 0
je 0x3505a940
sub ebx, 4
je 0x3505a903
dec ebx
dec ebx
jne 0x3505a964
movzx edi, byte [edi + ecx]
mov ebx, dword [esi + 4]
movzx edx, dl
shl edx, 4
shr edi, 4
or edi, edx
mov dl, byte [edi + 0x35007ad0]
mov byte [ebx + eax], dl
mov edi, dword [ebp + 0xc]
mov dl, byte [edi + ecx]
inc eax
and dl, 0xf
mov dword [ebp + 0x14], 4
jmp 0x3505a964
movzx edi, byte [edi + ecx]
mov ebx, dword [esi + 4]
movzx edx, dl
shl edx, 2
shr edi, 6
or edi, edx
mov dl, byte [edi + 0x35007ad0]
mov byte [ebx + eax], dl
mov edx, dword [ebp + 0xc]
movzx edx, byte [edx + ecx]
mov edi, dword [esi + 4]
and edx, 0x3f
mov dl, byte [edx + 0x35007ad0]
inc eax
mov byte [edi + eax], dl
mov edi, dword [ebp + 0xc]
inc eax
xor edx, edx
mov dword [ebp + 0x14], edx
jmp 0x3505a964
movzx edi, byte [edi + ecx]
mov edx, dword [esi + 4]
shr edi, 2
mov bl, byte [edi + 0x35007ad0]
mov byte [edx + eax], bl
mov edi, dword [ebp + 0xc]
mov dl, byte [edi + ecx]
inc eax
and dl, 3
mov dword [ebp + 0x14], 6
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x3505a8c0
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
cmp ecx, ebx
je 0x3505a995
mov edi, dword [esi + 4]
movzx edx, dl
add ecx, 0xfffffffe
shl edx, cl
mov cl, byte [edx + 0x35007ad0]
mov byte [edi + eax], cl
jmp 0x3505a994
mov ecx, dword [esi + 4]
mov byte [ecx + eax], 0x3d
inc eax
cmp eax, dword [ebp - 0x10]
jb 0x3505a98d
mov esi, dword [esi + 4]
mov byte [esi + eax], bl
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], bl
je 0x3505a9b2
push dword [ebp + 0xc]
call fcn.35027dd5
pop ecx
xor eax, eax
call fcn.3505b8a6
ret 0x10

Function at 0x3505f4ca
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0x10], 0x4b0
push edi
jne 0x3505f502
shr dword [ebp + 0xc], 1
je 0x3505f526
mov edx, dword [ebp + 8]
movzx ecx, word [edx]
dec dword [ebp + 0xc]
mov edi, eax
shr edi, 6
lea eax, [edi + eax*8]
inc edx
xor eax, ecx
inc edx
and eax, 0x1ff
cmp dword [ebp + 0xc], 0
jne 0x3505f4e3
jmp 0x3505f526
cmp dword [ebp + 0xc], eax
je 0x3505f526
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
dec dword [ebp + 0xc]
mov edi, eax
shr edi, 6
lea eax, [edi + eax*8]
xor eax, ecx
inc edx
and eax, 0x1ff
cmp dword [ebp + 0xc], 0
jne 0x3505f50a
pop edi
pop ebp
ret 0xc
Function at 0x3505f6ad
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x350a672c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 4
pop eax
call fcn.3505bbb0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 0xc], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x3505f720
mov edi, dword [ebp - 0x28]
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x3505f720
mov eax, dword [ebp - 0x28]
cmp edi, eax
jne 0x3505f7e8
test dword [ebp - 0x1c], 0x2000
je 0x3505f72c
mov ecx, dword [ebp - 0x20]
lea edi, [ecx + eax]
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
call esi
test eax, eax
jne 0x3505f72c
mov dword [ebp - 8], 0x80004005
jmp 0x3505f7ef
mov ebx, 0x1000
test dword [ebp - 0x1c], ebx
je 0x3505f7e8
cmp dword [ebp - 0xc], edi
jb 0x3505f7e8
mov eax, dword [ebp - 0x20]
add eax, edi
cmp dword [ebp - 0xc], eax
jae 0x3505f7e8
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x50]
lea esi, [eax - 1]
not esi
and esi, dword [ebp - 0xc]
mov edi, eax
sub esi, eax
mov eax, dword [ebp - 0x10]
cmp esi, eax
jb 0x3505f7e8
jbe 0x3505f799
push 0x4000
mov ecx, esi
sub ecx, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x3505f799
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x3505f7e8
jg 0x3505f7b4
mov dword [ebp - 8], eax
jmp 0x3505f7ef
push 4
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, eax
je 0x3505f7c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x3505f7c0
jle 0x3505f794
and eax, 0xffff
or eax, 0x80070000
jmp 0x3505f794
mov dword [ebp - 8], 0x8007000e
jmp 0x3505f7ef
lea eax, [ebp - 0x30]
push eax
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3505f7ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x3505f7b2
mov dword [ebp - 8], 0x8000ffff
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3505b7a5
leave
ret
Function at 0x35060a60
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], 0x4b0
push edi
jne 0x35060aa1
shr dword [ebp + 0xc], 1
je 0x35060acd
mov edi, dword [ebp + 8]
movzx eax, word [edi]
dec dword [ebp + 0xc]
inc edi
push eax
inc edi
call fcn.3505f9d2
mov ecx, esi
shr ecx, 6
lea ecx, [ecx + esi*8]
xor eax, ecx
and eax, 0x1ff
cmp dword [ebp + 0xc], 0
mov esi, eax
jne 0x35060a7a
jmp 0x35060acd
cmp dword [ebp + 0xc], esi
je 0x35060acd
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
dec dword [ebp + 0xc]
push eax
inc edi
call fcn.3505f9d2
mov ecx, esi
shr ecx, 6
lea ecx, [ecx + esi*8]
xor eax, ecx
and eax, 0x1ff
cmp dword [ebp + 0xc], 0
mov esi, eax
jne 0x35060aa9
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x35061e13
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [0x350ac7ec], esi
je 0x35061e32
cmp dword [0x350ac7f0], esi
jne 0x35061fc6
mov ecx, dword [ebp + 8]
cmp ecx, esi
je 0x35061fca
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x35061fca
mov dword [0x350ac7f0], eax
mov eax, dword [ebp + 0x10]
mov dword [0x350ac7ec], ecx
cmp eax, esi
je 0x35061e5f
mov dword [0x350aa60c], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x350ac7d0
call edi
push 0x350ac7b8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp + 8]
push eax
push 0x350ac80c
push esi
push 0x20019
push esi
push esi
push esi
push 0x35008ec4
push SysReAllocString
call ebx
test eax, eax
je 0x35061ea6
mov ebx, 0x80040605
jmp 0x35061fc0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push 1
push esi
call edi
mov dword [0x350ac814], eax
cmp eax, esi
jne 0x35061ec6
mov ebx, 0x8007000e
jmp 0x35061fc0
cmp dword [ebp + 0x14], esi
je 0x35061efb
lea eax, [ebp + 8]
push eax
push 0x350ac808
push esi
push 0x20019
push esi
push esi
push esi
push dword [ebp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x35061efb
push esi
push esi
push 1
push esi
call edi
mov dword [0x350ac810], eax
cmp eax, esi
je 0x35061ebc
push 0x350ac6f8
mov dword [0x350ac6f8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x35061f2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x35061f28
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x35061fbc
push 1
call fcn.3506036f
mov ebx, eax
cmp ebx, esi
jne 0x35061fc0
push esi
call fcn.35061c6e
mov ebx, eax
cmp ebx, esi
jne 0x35061fc0
push 0x35008eb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x350ac818], eax
cmp eax, esi
je 0x35061f97
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x35008ea8
push eax
call edi
push 0x35008e9c
push dword [0x350ac818]
mov dword [0x350ac7f4], eax
call edi
push 0x35008e88
push dword [0x350ac818]
mov dword [0x350ac7f8], eax
call edi
mov dword [0x350ac7fc], eax
cmp dword [0x350ac7e8], esi
jne 0x35061fbc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x350aa608], eax
cmp eax, 0xffffffff
je 0x35061ebc
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp ebx, esi
je 0x35061fc5
call fcn.35061513
pop edi
mov eax, ebx
jmp 0x35061fcf
mov eax, 0x80070057
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x35066f38
Capabilities:
Set thread local storage value

Disassembly:
push 8
push 0x350a0848
call fcn.3505b9b4
mov esi, ecx
mov dword [esi], 0x35011718
and dword [ebp - 4], 0
cmp dword [0x350ac7e8], 0
jne 0x35066f67
push 1
push dword [0x350aa608]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x35066f80
dec eax
mov dword [esi + 0x40], eax
mov ecx, dword [esi + 0x3c]
push dword [ecx + eax*4]
call dword [0x350ac7f0]
jmp 0x35066f67
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x35066f8e
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x35066f9c
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x35066faa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x35066fb8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x35066fc5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x35066fed
mov dword [ebp - 4], 0xfffffffe
call fcn.3505b9f9
ret
Function at 0x350719f7
Capabilities:
Set thread local storage value

Disassembly:
push 0xc
push 0x350a0a48
call fcn.3505b9b4
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [esi], 0x3501b7b8
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x350ac7e8], edi
jne 0x35071a29
push 1
push dword [0x350aa608]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0x1600]
cmp ecx, edi
je 0x35071a38
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esi + 0x1604]
cmp ecx, edi
je 0x35071a47
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esi + 0x15fc]
cmp ecx, edi
je 0x35071a56
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [esi + 0x1608]
cmp eax, edi
je 0x35071a66
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x160c]
cmp eax, edi
je 0x35071a76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x15ec]
cmp eax, edi
je 0x35071a87
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x15f4]
cmp eax, edi
je 0x35071a98
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x1658]
cmp eax, edi
je 0x35071aa9
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x165c]
cmp eax, edi
je 0x35071aba
push eax
call dword [0x350ac7f0]
mov eax, dword [esi + 0x1664]
cmp eax, edi
je 0x35071acb
push eax
call dword [0x350ac7f0]
cmp dword [esi + 0x15d4], edi
je 0x35071b0b
lea ecx, [esi + 0x15d8]
mov eax, dword [ecx]
cmp eax, edi
je 0x35071aff
dec eax
mov dword [ecx], eax
imul eax, eax, 0xdc
mov ecx, dword [esi + 0x15d0]
mov eax, dword [eax + ecx + 0xc]
cmp eax, edi
je 0x35071ad3
push eax
call dword [0x350ac7f0]
jmp 0x35071ad3
push dword [esi + 0x15d0]
call dword [0x350ac7f0]
mov ecx, esi
cmp dword [esi + 0x15e8], edi
je 0x35071b1c
call fcn.3507165f
jmp 0x35071b0b
call fcn.35070084
cmp dword [esi + 0x15e0], edi
je 0x35071b35
push dword [esi + 0x15dc]
call dword [0x350ac7f0]
mov dword [ebp - 4], 0xfffffffe
jmp 0x35071b65
lea ecx, [esi + 0x1634]
call fcn.35081911
lea ecx, [esi + 0x1624]
call fcn.35081911
mov ecx, esi
call fcn.350898a3
call fcn.3505b9f9
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x49394cfe
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3f0f48d4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4010b1
Capabilities:
Terminate process

Disassembly:
push 0x24
push 0x401116
push 0x40112c
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov ebx, 6
cmp eax, ebx
sete al
and eax, 0xff
test eax, eax
je 0x40110e
push 0
push 0
push 0
push 0x401157
call dword [sym.imp.winmm.dll_mciSendStringA]
push 0
push 0
push 0
push 0x401164
call dword [sym.imp.winmm.dll_mciSendStringA]
push 0
push 0
push 0
push 0x40117a
call dword [sym.imp.winmm.dll_mciSendStringA]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]