joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5311c1
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [esi]
pop esi
mov ebp, 0x2dc94248
call fcn.00531139
add byte [eax], al
jnp 0x531110
xchg edx, eax
cmc
add al, 0xb4
dec ecx
call 0xf1de6729
push esi
mov esi, ecx
add esi, 4
jmp 0x531105
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
dec ebp
bsr ebx, ebx
not ebp
and edi, 0xff0000
jmp 0x53111b
pop ebx
shr bl, cl
jmp 0x531158

Function at 0x5312e8
Capabilities:
Encrypt data using aes

Disassembly:
sbb edi, eax
xchg ecx, eax
mov dword [esp + 4], edx
push esp
lea esp, [esp + 8]
jmp 0x5312fa
popal
and ecx, esi
jmp 0x53138d
mov edx, edi
jmp 0x531354
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
push edx
jmp 0x53131b
and ecx, 0xff0000
sub esp, 2
lea esp, [esp + 2]
jmp 0x531366
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [edx]
pop edx
jmp 0x53133e
and edi, 0xff000000
sub esp, 0xb
lea esp, [esp + 3]
xor ecx, edi
jmp 0x5313b1
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamOut]
shr edi, 0x10
and edi, esi
jmp 0x531332
mov edi, edx
push ebp
and edx, esi
call fcn.00531377
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5313f4
xor ecx, edi
jmp 0x53142c
shr edi, 0x18
clc
stc
movzx edi, byte [edi*4 + 0x4fe030]
jmp 0x5313de
bswap edi
lea esp, [esp + 0xc]
xor ecx, dword [ebx]
not edi
jmp 0x531438
mov dx, ax
mov dl, 0xcb
push ebx
mov ebx, edi
jmp 0x531443
and edx, ebp
xor ecx, edx
mov dx, cx
xchg dx, di
jmp 0x531403
lea edi, [eax + 0x10]
dec edx
xor ecx, dword [eax]
add ebx, 4
jmp 0x53140f
mov dword [ebx], ecx
pop ebx
mov dh, byte [esp]
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x53179e
lea esp, [esp + 2]
mov dword [eax + 0x18], ecx
lea edx, [ebx + 0xb4]
call fcn.0053153d
mov ecx, dword [ebp]
pop ebp
xor ecx, edx
mov dl, ah
push ax
jmp 0x5315b1
push ebp
mov ebp, eax
add ebp, 8
jmp 0x531652
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
jmp 0x5316d4

Function at 0x531377
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
jmp 0x53139b
cmc
lea esp, [esp + 2]
jmp 0x5313bb

Function at 0x53185a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 2], dh
shr edi, 0x18
push ax
push word [esp]
jmp 0x5318a4
and edi, ecx
push eax
mov eax, edi
jmp 0x53188e
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_midiStreamOut
mov edi, dword [eax]
pop eax
jmp 0x531a4e
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531869
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
movzx ebx, byte [esi + 2]
call fcn.005318e8
push eax
cmc
push word [esp + 1]
lea esp, [esp + 2]
and ebx, ecx
jmp 0x5319f9
Function at 0x5318e8
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531989
lea esp, [esp]
jmp 0x5318d0
and edx, ecx
call fcn.00531916
xchg edi, eax
sbb al, 0xb2
aad 0x24
lcall 0xd66b, 0x98f969e3
or byte [ebx - 0x7c35de3e], ch
in al, dx
push ds
and edx, ecx
sub esp, 0x1e
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
jmp 0x5318ed
lea ebx, [eax + esi]
rcl bh, 2
movzx ebx, byte [esi + 5]
clc
jmp 0x531903
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov bh, cl
jmp 0x531930

Function at 0x531916
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
bswap edx
jmp 0x53195b
mov dword [eax], edi
pop eax
xor di, bx
lea edi, [eax*4]
jmp 0x531963
mov edx, dword [esi + 4]
push eax
mov eax, esi
jmp 0x53193d
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, 0x61d9
mov edi, edx
stc
jmp 0x5319b0
and edi, ecx
jmp 0x53199a
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5319d3
shr edi, 0x18
push ebx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531973
not bx
mov bx, dx
mov bl, 0x8b
jmp 0x5319e3
and ebx, ecx
pushal
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5319bd
movzx ebx, byte [esi + 6]
cmc
push esp
jmp 0x531a23
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
cmc
and ebx, ecx
call fcn.00531a0d

Function at 0x531a0d
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], bp
jmp 0x531a32
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov bh, 0x9b
jmp 0x531a8b
and edx, ecx
push esp
jmp 0x531aa9
movzx ebx, byte [edx]
pop edx
jmp 0x531a5d
push edx
mov edx, esi
add edx, 9
jmp 0x531a73
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
cmc
and edx, ecx
pushfd
call fcn.00531a93
mov edx, dword [esi + 8]
jmp 0x531afb
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, 0xc532
mov di, 0xb3f3
jmp 0x531e46
mov dword [esi + 4], edi
mov di, 0xecc2
jmp 0x531ae5
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and edi, ecx
call fcn.00531b6f
bts edi, eax
mov edi, edx
pushfd
shr edi, 0x18
jmp 0x531cea

Function at 0x531a93
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x531ad0
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
setge dh
dec dl
mov edx, dword [esp]
jmp 0x531ab9

Function at 0x531b15
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
mov ecx, 0xff
jmp 0x4f34da
jle 0x4f3489
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
sub esp, 3
jmp 0x531802
lea esp, [esp + 4]
jmp 0x5318bc
Function at 0x531b1e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x531b50
mov bl, byte [esp]
mov ebx, dword [esp]
movzx ebx, byte [esi + 0xa]
jmp 0x531cae
push dword [esp]
mov word [esp + 2], cx
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
btr ebx, esi
jmp 0x531b20
cmc
call fcn.00531b8e
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531c1f
mov edi, edx
stc
stc
jmp 0x531c69
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [edx]
pop edx
sub esp, 1
jmp 0x531c87
shr edi, 0x18
push edx
mov edx, edi
jmp 0x531c40
lea esp, [esp + 2]
jmp 0x531c97
sub esp, 9
lea esp, [esp + 2]
and edi, ecx
push di
mov byte [esp], ah
jmp 0x531c71
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531cc3
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x1b
lea esp, [esp + 3]
and ebx, ecx
jmp 0x531bf7
and ebx, ecx
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bswap ebx
jmp 0x531d48
and edx, ecx
jmp 0x531d13
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.00531cf8
movzx ebx, byte [esi + 0xe]
pushfd
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531cd4

Function at 0x531b6f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
add esp, 0
and ebx, ecx
call fcn.00531b1e
add esp, 2
lea esp, [esp + 2]
jmp 0x531b3e

Function at 0x531b8e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0xd]
clc
jmp 0x531bc7
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
setg bh
jmp 0x531b78
cmc
call fcn.00531bd9
and edx, ecx
sub esp, 0xb
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531ba1

Function at 0x531bd9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 9
pop dword [esp]
xchg dword [esp], edx
mov dx, word [esp]
lea esp, [esp + 1]
jmp 0x531c38
mov word [esp + 1], bx
and edx, ecx
lea esp, [esp + 0xc]
jmp 0x531ba7
add ebp, 8
mov dword [ebp], edi
pop ebp
mov edi, dword [esp]
jmp 0x531bfd
mov edx, dword [esi + 0xc]
push ebp
mov ebp, esi
jmp 0x531c13
Function at 0x531cf8
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x531d32
push eax
jmp 0x5317e4
mov eax, esi
add eax, 0x11
movzx ebx, byte [eax]
pop eax
jmp 0x531882
mov dx, word [esp]
mov dx, word [esp]
jmp 0x531851
mov esi, ebx
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [esi]
pop esi
jmp 0x531810
mov edi, edx
call fcn.0053185a
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x72
cmp al, 0xc3
push ebx
lds eax, ss:[eax]
push es
mov cl, 0xb0
add esi, 0x10
mov edx, dword [esi]
neg edi
jmp 0x53183b
add edi, edi
rcr edi, cl
mov edx, 0x788f4b96
push esi
jmp 0x531827
and ebx, ecx
lea esp, [esp + 8]
jmp 0x531d1f
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
and edx, ecx
stc
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x531d6f
mov edi, dword [esp]
mov bx, di
jmp 0x531d59
lea esp, [esp + 4]
pop esi
jmp 0x531da2
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x4f34da
je 0x4f3489

Function at 0x5490f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, eax
lea esp, [esp + 0x14]
jmp 0x54a325
jne 0x548ac9
je 0x548b2f

Function at 0x5e45bf
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push dword [esp + 2]
mov word [esp + 2], si
jmp 0x5e45e7

Function at 0x5e4600
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
call fcn.005e4008
pushal
lea esp, [esp + 0x1d]
lea esp, [esp + 3]
mov dword [esp + 0x24], esi
call fcn.005e45bf
lea esp, [esp]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x5e4624
jmp 0x5e45d5
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x5e4003
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x5e4602
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401c66
pop dword [ebp - 0x14]
mov eax, 0x401c66
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2a681d4
add dword [ebp - 0x24], 0x4babc377
mov dword [ebp - 0x20], 0xa7d44bee
sub dword [ebp - 0x20], 0x75a0ffa9
mov dword [ebp - 0x1c], 0xee6fcba9
add dword [ebp - 0x1c], 0x5ddc7885
mov dword [ebp - 0x18], 0x54b2fd10
add dword [ebp - 0x18], 0xab4d02f0
lea eax, [ebp - 0x24]
push eax
mov eax, 0x4abdda56
sub eax, 0x4a7daa02
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xc7af0027
add dword [ebp - 0x24], 0xacc3692f
mov dword [ebp - 0x20], 0x578fc83c
sub dword [ebp - 0x20], 0x162366c7
mov dword [ebp - 0x1c], 0x2ad2eafd
add dword [ebp - 0x1c], 0x389c816f
mov dword [ebp - 0x18], 0x5a820ba
add dword [ebp - 0x18], 0xfa57df46
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x2ab60b74
sub eax, 0x2a75db48
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34992
push 0
call eax
mov ecx, 0xd083396c
add ecx, 0x2f7d070c
mov edx, eax
mov ebx, 0xaa1d6d02
add ebx, 0x562302fe
add ebx, dword [ebp - 0x14]
mov edi, 0x8678378b
add edi, 0x5dc477e8
add dword [ebp - 4], ecx
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0x13baa37b
xor esi, edi
mov dword [edx], esi
add dword [ebp - 0x10], edi
add edx, 4
add ebx, 0xf8eaf342
sub ebx, 0xf8eaf33e
loop 0x401d83
add eax, 0x8cd89d5
add eax, 0xf7336ade
mov ebx, eax
add eax, 0x5f14ba87
sub eax, 0x5f14ba82
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x138c00f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jb 0x1382fb2
pushal
mov word [esp + 4], cx
cmp ah, 0x5a
call fcn.0137846f
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40673a
pop dword [ebp - 0x28]
mov eax, 0x8271a03d
add eax, 0x7dcec6fd
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xf8525485
add dword [ebp - 0x38], 0x55fff0c6
mov dword [ebp - 0x34], 0xc17921bc
add dword [ebp - 0x34], 0x70ba2a89
mov dword [ebp - 0x30], 0xd6f2b83
add dword [ebp - 0x30], 0x3edd18ab
mov dword [ebp - 0x2c], 0xd7ecb735
add dword [ebp - 0x2c], 0x281348cb
lea eax, [ebp - 0x38]
push eax
mov eax, 0x32c593bd
sub eax, 0x328512b9
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb9c1ef46
sub dword [ebp - 0x38], 0x454f85f0
mov dword [ebp - 0x34], 0x17dade7f
add dword [ebp - 0x34], 0x299182f6
mov dword [ebp - 0x30], 0xc19d797
sub dword [ebp - 0x30], 0xa8aa6b2b
mov dword [ebp - 0x2c], 0x817c5bf4
add dword [ebp - 0x2c], 0x7e83a40c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x61af41f2
add eax, 0x9e913f0e
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36955
push 0
call eax
mov ecx, 0x3c21e31d
sub ecx, 0x3c219ed8
mov edi, eax
mov esi, 0x72f51020
add esi, 0x8d51d3e0
add esi, dword [ebp - 0x28]
mov ebx, 0xf6e3f6a2
mov edx, dword [esi]
xor dword [ebp - 0x20], 0x83a2db9f
sub edx, ebx
sub dword [ebp - 0x20], eax
mov dword [edi], edx
add dword [ebp - 8], ecx
add edi, 0xc665d9ce
add edi, 0x399a2636
add esi, 4
loop 0x406856
add eax, 0xdd3a3495
sub eax, 0xdd3930ae
mov ebx, eax
add eax, 0x55c1b42f
add eax, 0xaa3e4bd6
mov ecx, 0x44d212f2
add ecx, 0xbb6ded0e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40633c
pop dword [ebp - 0x38]
mov eax, 0x3eef4945
add eax, 0xc15119f7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa01b0994
add dword [ebp - 0x48], 0xae373bb7
mov dword [ebp - 0x44], 0x6a84cf90
add dword [ebp - 0x44], 0xc7ae7cb5
mov dword [ebp - 0x40], 0x8d4608b3
sub dword [ebp - 0x40], 0x40f9c485
mov dword [ebp - 0x3c], 0x53c9b0d1
add dword [ebp - 0x3c], 0xac364f2f
lea eax, [ebp - 0x48]
push eax
mov eax, 0x4d4af7ed
add eax, 0xb2f57873
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x703cf351
add dword [ebp - 0x48], 0x4357605
mov dword [ebp - 0x44], 0x633bace2
add dword [ebp - 0x44], 0xde30b493
mov dword [ebp - 0x40], 0x5a160a7a
add dword [ebp - 0x40], 0x95961f2
mov dword [ebp - 0x3c], 0x9bfa5337
add dword [ebp - 0x3c], 0x6405acc9
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x538b3e
add eax, 0xffece5c2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38bf1
push 0
call eax
mov ecx, 0xf6fc49d8
sub ecx, 0xf6fbf955
xor ebx, ebx
add ebx, eax
mov esi, 0xbd9d4870
sub esi, 0xbd5c4870
add esi, dword [ebp - 0x38]
mov edx, 0xe5cc62e9
add edx, 0xb0176549
xor dword [ebp - 4], esi
mov edi, dword [esi]
add dword [ebp - 0x28], eax
sub edi, edx
add dword [ebp - 0x1c], 0xc6b09682
mov dword [ebx], edi
add dword [ebp - 0x2c], 0x72276273
add ebx, 4
add esi, 0x4db2c157
sub esi, 0x4db2c153
loop 0x406460
add eax, 0x134df
mov ebx, eax
add eax, 5
mov ecx, 0x9510be09
sub ecx, 0x94d0be09
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3bd009c4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x70c97c53
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x10045cb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x34
xor edx, edx
lea eax, [esi + 0x24]
pop edi
mov cx, word [eax]
xor cx, dx
and cx, 0x7fff
xor word [eax], cx
mov ebx, dword [esi + 8]
mov cx, word [eax]
mov dword [eax + 4], ebx
mov ebx, dword [esi + 0xc]
and cx, 0x7fff
mov dword [eax + 8], ebx
mov word [eax], cx
inc edx
add eax, 0xc
cmp edx, edi
jl 0x10045da
mov dword [esi + 0x1c], edi
xor edi, edi
push edi
push edi
push 0x1a
push esi
call dword [esi + 4]
push edi
push edi
push 0x15
push esi
call dword [esi + 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x1004fb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x64], ebx
jle 0x1004fe0
lea esi, [edi + 0x6c]
mov eax, dword [esi]
push 0
push 0
push 3
push eax
call dword [eax + 4]
inc ebx
add esi, 4
cmp ebx, dword [edi + 0x64]
jl 0x1004fcb
mov dword [ebp - 4], 2
lea esi, [edi + 0x74]
and dword [ebp - 8], 0
mov dword [ebp + 8], 0x24
mov ecx, dword [esi]
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add dword [ebp + 8], 0xc
add eax, ecx
add edx, 0xfffffffe
shl ebx, 2
or edx, ebx
xor dx, word [eax]
and dx, 0x7fff
xor word [eax], dx
mov ebx, dword [ecx + 8]
mov dx, word [eax]
or dx, 0x8000
inc dword [ebp - 8]
cmp dword [ebp + 8], 0xc0
mov dword [eax + 4], ebx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 8], ecx
mov word [eax], dx
jl 0x1004ff5
mov ecx, dword [esi]
inc dword [ebp - 4]
push 0xd
pop eax
add esi, 4
cmp dword [ebp - 4], 6
mov dword [ecx + 0x1c], eax
jl 0x1004fea
push 0
push 0
push eax
push edi
call dword [edi]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40260f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004086d8
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004086d8
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.004086d8
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x409210
call fcn.004086e4
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x4026c8
mov eax, 0
jmp 0x40280c
cmp dword [ebp + 0xc], 0
jne 0x4026f4
mov dword [ebp - 0x18], esp
mov eax, 5
call fcn.004086f0
cmp dword [ebp - 0x18], esp
je 0x4026f1
push 6
call fcn.004086ea
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x40271c
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x402716
push ebx
call fcn.004086de
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 6
call fcn.004086f0
cmp dword [ebp - 0x18], esp
je 0x402747
push 6
call fcn.004086ea
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x4aa883
mov eax, 7
call fcn.004086f0
cmp dword [ebp - 0x18], esp
je 0x402773
push 6
call fcn.004086ea
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 8
call fcn.004086f0
cmp dword [ebp - 0x18], esp
je 0x402807
push 6
call fcn.004086ea
add esp, 4
jmp 0x40280c
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004086de
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004086de
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004086de
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40eec0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48d3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00482186
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40ef42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047fbda
mov eax, dword [eax]
push 0x56fca0
push eax
call fcn.00471e24
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00482411
test bl, bl
je 0x40ef42
push 0x56fca0
lea ecx, [esp + 0xc]
call fcn.004827a1
push 0x56fcac
lea ecx, [esp + 0xc]
call fcn.004827a1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ef7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00482411
jmp 0x40f049
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40f002
lea edx, [esp + 0x7c]
push 0x56fca8
push edx
call fcn.00471e24
add esp, 8
test eax, eax
je 0x40f002
lea eax, [esp + 0x7c]
push 0x56fca4
push eax
call fcn.00471e24
add esp, 8
test eax, eax
je 0x40f002
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ef92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00482411
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f840
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f8a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc