joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc05e84
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0xc060b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0xc05f07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0xc060b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0xc05f07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0xc060d0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0xc05f90
xor eax, eax
push ebp
push 0xc05f89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00c05ccc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0xc05f6e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0xc060f0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0xc05f6e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc05f90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0xc060aa
cmp byte [ebp - 0xd], 0
jne 0xc05fd7
cmp byte [ebp - 0x12], 0
je 0xc060aa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0xc05ff0
dec ebx
cmp byte [ebx], 0x2e
je 0xc05fff
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0xc05fef
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0xc060aa
inc ebx
cmp byte [ebp - 0x12], 0
je 0xc0603c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0xc060aa
cmp byte [ebp - 0xd], 0
je 0xc060aa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0xc060aa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc083b4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00c04a08
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0xc083d6
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0xc094f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0xc09531
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00c04648
jmp 0xc0953a
mov eax, ebx
mov edx, esi
call fcn.00c045ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xc09544
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0xc09565
mov al, byte [esp]
jmp 0xc09567
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xc09bec
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0xc09a64
mov eax, dword [0xc35f6c]
cmp byte [eax], 0
je 0xc09c54
mov eax, dword [0xc35db0]
call fcn.00c02ca0
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00c084d8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0xc09c9c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0xc09c8a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0xc35d70]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0xc37710]
call fcn.00c05c90
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0xc0a728
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0xc0a78c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00c047c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00c08018
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc0a793
lea eax, [ebp - 0xc]
call fcn.00c04558
ret

Function at 0xc19d74
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00c19c14
dec esi
jne 0xc19d96
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0xc29218
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, ecx
mov dword [esp], edx
mov esi, eax
test esi, esi
jne 0xc29236
mov eax, 0xc292e8
call fcn.00c2bb80
jmp 0xc29257
cmp dword [esp], 0
jne 0xc29248
mov eax, 0xc29310
call fcn.00c2bb80
jmp 0xc29257
cmp ebx, 5
jae 0xc29257
mov eax, 0xc2933c
call fcn.00c2bb80
lea ebp, [ebx + 5]
mov eax, ebp
call fcn.00c02700
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x40
push ebp
push edi
call sub.kernel32.dll_VirtualProtect
lea eax, [esp + 4]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov ecx, ebx
mov edx, esi
mov eax, edi
call fcn.00c06cc8
mov ebp, edi
add ebp, ebx
mov byte [ebp], 0xe9
mov edx, esi
mov eax, edi
call fcn.00c30b6c
inc ebp
mov dword [ebp], eax
cmp ebx, 5
jbe 0xc292b3
mov edx, ebx
sub edx, 5
mov eax, esi
add eax, 5
call fcn.00c29210
mov byte [esi], 0xe9
mov edx, dword [esp]
mov eax, esi
call fcn.00c30b6c
mov edx, esi
inc edx
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, edi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xc2b6ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
je 0xc2b711
test ecx, ecx
je 0xc2b711
push ebx
push edi
mov ebx, 0
mov edi, 0xc2b714
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0xc2b700
pop edi
pop ebx
ret
xor eax, eax
ret
Function at 0xc320a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov al, byte [0xc321d4]
cmp al, byte [0xc35244]
je 0xc321ce
push 0x2b
push 0x2b
mov ecx, 0xc35b1c
mov edx, dword [0xc3772c]
mov eax, dword [0xc37724]
call fcn.00c30c10
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
je 0xc320f7
mov eax, 0xc321d8
call fcn.00c2e2e8
mov esi, ebx
test byte [0xc35244], 2
je 0xc3211e
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
test byte [0xc35244], 1
je 0xc32166
sub ebx, 0x28
sub ebx, 0x2b
mov edi, ebx
cmp word [edi], 0xd74
jne 0xc32154
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [edi], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc32166
mov dl, byte [0xc321e8]
mov eax, 0xc321f4
call fcn.00c2e55c
jmp 0xc321ce
test byte [0xc35244], 4
je 0xc321ce
push 0x27
push 0x11
mov ecx, 0xc35b70
mov edx, dword [0xc3772c]
mov eax, esi
call fcn.00c30c10
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
je 0xc321b2
mov dl, byte [0xc321e8]
mov eax, 0xc32240
call fcn.00c2e55c
jmp 0xc321ce
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0xc32284
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov al, byte [0xc323b4]
cmp al, byte [0xc35244]
je 0xc323ae
push 0x26
push 0x26
mov ecx, 0xc35b48
mov edx, dword [0xc3772c]
mov eax, dword [0xc37724]
call fcn.00c30c10
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
je 0xc322d6
mov eax, 0xc323b8
call fcn.00c2e2e8
mov esi, ebx
test byte [0xc35244], 2
je 0xc322fd
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
test byte [0xc35244], 1
je 0xc32346
sub ebx, 0x25
sub ebx, 0x26
mov eax, ebx
dec eax
cmp word [eax], 0x7401
jne 0xc32334
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc32346
mov dl, byte [0xc323c8]
mov eax, 0xc323d4
call fcn.00c2e55c
jmp 0xc323ae
test byte [0xc35244], 4
je 0xc323ae
push 0x27
push 0x11
mov ecx, 0xc35b70
mov edx, dword [0xc3772c]
mov eax, esi
call fcn.00c30c10
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
je 0xc32392
mov dl, byte [0xc323c8]
mov eax, 0xc32420
call fcn.00c2e55c
jmp 0xc323ae
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret

Function at 0xc32464
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc32550
call fcn.00c2af3c
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c2afb4
mov eax, dword [ebx + 8]
add eax, 0xab
xor edx, edx
mov dl, byte [0xc350f4]
lea edx, [edx + edx*2]
sub eax, edx
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
jne 0xc324c0
xor ecx, ecx
mov dx, 0xc085
mov eax, ebx
call fcn.00c30c30
test al, al
je 0xc324ca
mov eax, 0xc32560
call fcn.00c2bb80
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 4
mov eax, ebx
call fcn.00c29210
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ecx, 9
mov edx, 0x840fc085
mov eax, ebx
call fcn.00c30c3c
test al, al
je 0xc3250e
mov eax, 0xc3259c
call fcn.00c2bb80
add ebx, 0xb
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
mov eax, ebx
mov edx, eax
add edx, 2
movzx edx, byte [edx]
inc edx
mov ecx, eax
inc ecx
mov dword [ecx], edx
add eax, 5
mov byte [eax], 0x90
push esp
mov eax, dword [esp + 4]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc325d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push 0xf
push 0xf
mov ecx, 0xc35b98
mov edx, dword [0xc3772c]
mov eax, dword [0xc35114]
call fcn.00c30c10
mov ebx, eax
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
je 0xc32610
mov eax, 0xc326a4
call fcn.00c2bb80
mov al, byte [ebx]
sub al, 0x5e
je 0xc32620
sub al, 0x8a
je 0xc32625
dec al
je 0xc32628
jmp 0xc32634
add ebx, 2
jmp 0xc3263e
inc ebx
jmp 0xc3263e
mov eax, 0xc326e4
call fcn.00c2bb80
jmp 0xc3263e
mov eax, 0xc32714
call fcn.00c2bb80
mov eax, ebx
call fcn.00c30b5c
mov dword [0xc35188], eax
push 1
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, dword [0xc35188]
call fcn.00c30b74
test al, al
je 0xc32670
mov eax, 0xc32754
call fcn.00c2bb80
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc2ff78
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc32ad8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov ebx, dword [0xc35120]
add ebx, 0x80
xor ecx, ecx
mov dl, 0x74
mov eax, ebx
call fcn.00c30c28
test al, al
jne 0xc32b07
mov ecx, 2
mov dl, 0xa1
mov eax, ebx
call fcn.00c30c28
test al, al
je 0xc32b11
mov eax, 0xc32b38
call fcn.00c2bb80
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc32c68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
cmp byte [0xc35220], 1
jne 0xc32d2c
mov dl, 1
mov eax, 0xc32de0
call fcn.00c2af3c
mov esi, eax
mov cl, 1
xor edx, edx
mov eax, esi
call fcn.00c2afb4
mov ebx, dword [esi + 8]
add ebx, 0x5b
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c30c28
test al, al
je 0xc32cb1
mov eax, 0xc32df0
call fcn.00c2bb80
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc37898]
mov edx, dword [eax + 0x28]
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [esi + 8]
add ebx, 0x87
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c30c28
test al, al
je 0xc32cff
mov eax, 0xc32e44
call fcn.00c2bb80
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc37898]
mov edx, dword [eax + 0x28]
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc32d7b
mov ebx, dword [0xc35154]
add ebx, 7
xor eax, eax
mov al, byte [0xc350f4]
add eax, eax
add ebx, eax
mov ecx, 0xfffffffd
mov edx, 0x752a3880
mov eax, ebx
call fcn.00c30c3c
test al, al
je 0xc32d5f
mov eax, 0xc32e98
call fcn.00c2bb80
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov dl, 1
mov eax, 0xc32eec
call fcn.00c2af3c
mov esi, eax
mov cl, 1
xor edx, edx
mov eax, esi
call fcn.00c2afb4
mov ebx, dword [esi + 8]
add ebx, 0x49
or ecx, 0xffffffff
mov dx, 0x752a
mov eax, ebx
call fcn.00c30c30
test al, al
je 0xc32db6
mov eax, 0xc32f00
call fcn.00c2bb80
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret
Function at 0xc330b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
cmp byte [0xc350e8], 0x30
jne 0xc330e8
push esp
push 0x40
push 1
mov eax, dword [0xc351a0]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc351a0]
mov byte [eax], 0xc3
push esp
mov edx, dword [esp + 4]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
mov ebx, dword [0xc351a0]
add ebx, 0xb
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*8]
add ebx, eax
xor ecx, ecx
mov dl, 0xf
mov eax, ebx
call fcn.00c30c28
test al, al
je 0xc33153
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*2]
add eax, dword [0xc351a0]
cmp byte [eax], 0x8b
je 0xc3312b
mov eax, 0xc33190
call fcn.00c2bb80
push esp
push 0x40
push 1
mov eax, dword [0xc351a0]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc351a0]
mov byte [eax], 0xc3
push esp
mov edx, dword [esp + 4]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc33184
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
mov eax, ebx
mov edx, eax
add edx, 2
mov edx, dword [edx]
inc edx
mov ecx, eax
inc ecx
mov dword [ecx], edx
add eax, 5
mov byte [eax], 0x90
push esp
mov eax, dword [esp + 4]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc331cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc33294
call fcn.00c2af3c
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c2afb4
mov eax, dword [ebx + 8]
add eax, 0x28
mov ebx, eax
xor ecx, ecx
mov dl, 0x75
mov eax, ebx
call fcn.00c30c28
test al, al
jne 0xc33212
mov ecx, 0xfffffffe
mov dx, 0xc085
mov eax, ebx
call fcn.00c30c30
test al, al
je 0xc3321c
mov eax, 0xc332a8
call fcn.00c2bb80
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 0x13
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c30c28
test al, al
je 0xc33255
mov eax, 0xc332e8
call fcn.00c2bb80
mov eax, ebx
call fcn.00c30b5c
mov dword [0xc351a4], eax
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc302a8
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc33378
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, esp
mov ebx, dword [0xc35184]
add ebx, 0x1f
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*2]
add ebx, eax
mov eax, ebx
sub eax, 3
cmp word [eax], 0xc4f6
je 0xc333a8
mov eax, 0xc33568
call fcn.00c2bb80
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc35184]
mov ecx, eax
add ecx, 0x44
xor edx, edx
mov dl, byte [0xc350f4]
lea edx, [edx + edx*2]
add ecx, edx
cmp byte [ecx], 0xd9
jne 0xc333fb
mov ebx, eax
add ebx, 0x55
add ebx, edx
mov eax, ebx
sub eax, 2
cmp word [eax], 0x41c4
je 0xc333fb
mov eax, 0xc335a8
call fcn.00c2bb80
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [0xc350e8], 0x2f
jne 0xc33438
mov ebx, dword [0xc35184]
add ebx, 0x9c
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*2]
add ebx, eax
jmp 0xc33450
mov ebx, dword [0xc35184]
add ebx, 0xd0
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*2]
add ebx, eax
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x8b
jg 0xc33469
je 0xc3347a
sub eax, 0xe
je 0xc3347f
sub eax, 0x2d
je 0xc33485
jmp 0xc33488
sub eax, 0xc7
je 0xc33482
sub eax, 0x30
jne 0xc33488
sub ebx, 3
jmp 0xc33488
sub ebx, 2
jmp 0xc33488
dec ebx
jmp 0xc33488
inc ebx
jmp 0xc33488
add ebx, 2
mov eax, ebx
sub eax, 2
cmp word [eax], 0xc73b
je 0xc3349e
mov eax, 0xc335e8
call fcn.00c2bb80
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [0xc350e8], 0x2f
jne 0xc334db
mov ebx, dword [0xc35184]
add ebx, 0xad
xor eax, eax
mov al, byte [0xc350f4]
lea eax, [eax + eax*2]
add ebx, eax
jmp 0xc334f2
mov ebx, dword [0xc35184]
add ebx, 0xe5
xor eax, eax
mov al, byte [0xc350f4]
add eax, eax
add ebx, eax
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x8b
jg 0xc3350b
je 0xc3351c
sub eax, 0x3b
je 0xc33527
sub eax, 0x11
je 0xc33521
jmp 0xc3352a
sub eax, 0xcb
je 0xc33524
sub eax, 0x28
jne 0xc3352a
sub ebx, 3
jmp 0xc3352a
sub ebx, 2
jmp 0xc3352a
dec ebx
jmp 0xc3352a
inc ebx
jmp 0xc3352a
add ebx, 2
mov eax, ebx
sub eax, 2
cmp word [eax], 0xcb3b
je 0xc33540
mov eax, 0xc33628
call fcn.00c2bb80
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret
Function at 0xc33980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov ebx, dword [0xc351a8]
add ebx, 7
mov ecx, 0xfffffffc
mov edx, 0xe856006a
mov eax, ebx
call fcn.00c30c3c
test al, al
je 0xc339aa
mov eax, 0xc339e0
call fcn.00c2bb80
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc30300
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc33d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, dword [0xc37724]
mov edi, dword [0xc3772c]
sub edi, 0xf
sub edi, esi
jb 0xc33de3
inc edi
mov edx, 0xc35c70
mov ecx, 0x10
mov eax, esi
call fcn.00c30b98
test al, al
je 0xc33ddf
lea eax, [esi + 1]
mov ebx, dword [eax]
push 0
mov ecx, dword [0xc3772c]
mov edx, dword [0xc37724]
mov eax, ebx
call fcn.00c30b74
test al, al
jne 0xc33ddf
mov edx, 0xc33df4
mov ecx, 0xb
mov eax, ebx
call fcn.00c2bdb0
test eax, eax
jne 0xc33ddf
mov ebx, esi
sub ebx, 5
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc2f850
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc33ded
inc esi
dec edi
jne 0xc33d68
mov eax, 0xc33e00
call fcn.00c2e2e8
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xc33e18
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc33e9c
call fcn.00c2af3c
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c2afb4
cmp byte [0xc35250], 0
je 0xc33e7c
mov eax, dword [ebx + 8]
add eax, 0xe
xor edx, edx
mov dl, byte [0xc350f4]
lea edx, [edx + edx*2]
add eax, edx
mov ebx, eax
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc306bc
mov eax, ebx
dec eax
call fcn.00c30b64
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
call fcn.00c30a3c
mov eax, dword [ebx + 8]
mov dword [0xc35198], eax
mov eax, 0xc309d4
mov dword [ebx + 8], eax
pop edx
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4bba5062
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4ea611dc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219