joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6aa502
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
mov cx, ax
lea edx, [esi + 0xd5]
mov ecx, edi
jmp 0x6aa4d9

Function at 0x6aa577
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror cx, cl
xor dl, ch
mov ax, cx
bswap edx
mov ax, bx
neg eax
jmp 0x6aa57c
mov word [esp + 0x10], bx
lea edx, [esi*4]
bswap eax
push edx
pop dx
mov word [esp + 8], bx
jmp 0x6aa510
xchg edx, eax
mov cl, byte [esp + 0x13]
push word [esp + 1]
mov eax, dword [esp + 0x13]
mov ecx, 0x33fb0eb0
setae ch
jmp 0x6aa52b
mov dx, di
jmp 0x6aa556
xchg ch, dl
not dx
sete ah
lea edx, [ecx*4]
bsr cx, cx
pop dx
jmp 0x6aa5cc
xchg ecx, eax
pop ecx
mov dword [esp + 0xd], eax
mov cl, ch
inc ecx
mov dx, word [esp]
jmp 0x6aa63a
cld
mov ax, 0xd471
xchg byte [esp], al
mov byte [esp + 5], bh
setno dh
jmp 0x6aa618
lea esp, [esp + 9]
mov dx, word [esp + 3]
sub cx, 0xc518
mov dl, 0x5c
bsf cx, ax
not edx
jmp 0x6aa5db

Function at 0x6aabbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
push dword [esp + 5]
lea esp, [esp + 8]
not eax
mov ecx, dword [esp]
jmp 0x6aabcf
xchg ecx, eax
inc edx
mov dx, ax
xchg word [esp + 4], dx
mov dh, byte [esp + 4]
jmp 0x6aab95
mov cl, 0x62
xchg byte [esp], ch
mov ch, byte [esp + 2]
setle dh
neg cl
mov dh, byte [esp + 2]
jmp 0x6aac37
xchg dword [esp], ecx
sub ch, ah
mov cl, 0xe2
lea esp, [esp + 1]
mov edx, ecx
sub esp, 0x14
jmp 0x6aaca8
bt edx, ebx
xchg byte [esp], cl
xchg word [esp], cx
lea edx, [esi*4]
pop dx
push esp
jmp 0x6aabfc
mov ecx, 0x4ec531c8
add esp, 0
bswap eax
mov al, 0xf6
lea eax, [esi*4]
clc
jmp 0x6aac14
setge dh
xchg byte [esp + 9], cl
mov cl, 0xfa
pop word [esp + 0xf]
mov ecx, dword [esp + 3]
jmp 0x6aac85

Function at 0x6ae5b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*4]
bsr dx, cx
rcl si, cl
mov bp, bx
jmp 0x6ae5c4
not dx
bsr bp, cx
neg ebx
mov al, 0x86
jmp 0x6ae563
lea esp, [esp + 0x14]
pushal
rol bx, cl
bswap esi
mov ecx, 0x538c120a
mov dl, byte [esp]
jmp 0x6ae57a
mov byte [esp + 1], ah
mov word [esp + 0xc], dx
mov dword [esp + 7], esi
jmp 0x6ae591
neg si
xchg esi, ebx
not ebp
rdtsc
mov dl, dh
mov bl, byte [esp]
jmp 0x6ae616
mov dl, 0xa4
bswap ebx
setp dh
mov bl, bh
xchg ecx, ebp
rdtsc
jmp 0x6ae5ed

Function at 0x6aec9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 6], eax
mov bl, 0xe0
pop edx
mov ebx, dword [esp + 5]
mov di, sp
lea esp, [esp]
jmp 0x6aec7f
sub esp, 0x1e
pop ebx
push dword [esp + 0xa]
push esp
bsf bp, ax
xchg byte [esp + 0xe], dl
jmp 0x6aec5c
rdtsc
not ch
not dx
xchg word [esp + 0x27], di
add esp, 0x14
mov di, 0x5787
jmp 0x6aebfb
mov cl, 0xb2
neg bp
xchg ecx, ebp
cpuid
pop dword [esp + 2]
rdtsc
jmp 0x6aede0
pop dword [esp + 0x20]
popal
mov ecx, 0x3c6ac806
mov di, 0x4ab3
clc
inc ebp
jmp 0x6aec3a
add esp, 7
mov byte [esp + 5], ah
cpuid
pop cx
rdtsc
mov word [esp], di
jmp 0x6aec0e
jmp 0x6aec25
Function at 0x6aef3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
jmp 0x6aef4a
xchg dword [esp], edx
xchg dword [esp], eax
inc ebp
push dword [esp]
mov byte [esp + 5], dh
cpuid
jmp 0x6aefc6
bsr ax, cx
bsf dx, si
mov si, word [esp + 2]
xchg byte [esp + 2], dl
jmp 0x6aef94
mov dword [esp + 4], ecx
btc ecx, edi
mov edx, esi
lea edx, reloc.RASAPI32.dll_RasHangUpA
xor edi, esi
pop dword [esp]
jmp 0x6aefae

Function at 0x6af088
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
push dword [esp + 0x27]
neg bh
mov dl, 0xb4
not bx
pop bp
jmp 0x6af08c
rdtsc
jmp 0x6af06f
stc
pop dx
xchg bx, ax
btc edi, edi
mov word [esp + 0x27], bx
mov dword [esp + 0x27], ecx
jmp 0x6af1f3
lea ecx, [edx + edx]
call fcn.006af113
sub esp, 0x16
mov cx, sp
xchg word [esp + 6], dx
push word [esp]
pop edx
jmp 0x6af1a1
add esp, 0xf
cpuid
push edx
cld
neg ebx
mov bx, dx
jmp 0x6af1cf
lea esp, [esp + 0x15]
add esp, 8
cpuid
mov edx, 0xd3f70ad8
bswap edi
mov ecx, 0x4cd1a8a0
jmp 0x6af346
lea ecx, [ebp*4]
rdtsc
add al, dh
sub esp, 0x1a
lea esp, [esp + 0x4b]
lea ebx, [ebp*4]
jmp 0x6af16b
cmc
call fcn.006af23f
Function at 0x6af64b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, ecx
jmp 0x6af822
mov dl, 0xb4
mov esi, 0x720812b8
mov bp, bx
push word [esp + 0x24]
jmp 0x6af763
add cx, 0xee5e
mov al, 0xe6
rdtsc
lea eax, [esi*4]
jmp 0x6af6dc
push word [esp + 1]
pushal
push word [esp + 0x1b]
neg cx
xchg word [esp + 0x13], dx
jmp 0x6af698
push word [esp + 2]
pop cx
xchg dh, al
cld
mov ch, byte [esp + 2]
rdtsc
jmp 0x6af6b0
setae ah
popal
pop edx
mov bh, byte [esp]
pop bx
inc al
jmp 0x6af713
lea esp, [esp + 1]
bswap edx
xchg byte [esp], bl
mov ebx, 0x998f90cc
not edi
rcl bx, cl
jmp 0x6af6ca
lea ebx, [edi + ebp]
stc
mov edi, dword [esp]
setge bh
add esp, 0
mov ah, byte [esp]
jmp 0x6af740
and al, 0xeb
sbb edi, dword [edi + ecx*2 - 0x2a]
inc ecx
ret
mov bh, byte [esp + 4]
add esp, 0xb
pop dx
xchg word [esp + 1], di
neg eax
setae ah
jmp 0x6af6fe
xchg byte [esp], cl
xchg byte [esp], bl
lea ebp, [edx + edi]
sub esp, 4
lea eax, [eax - 0x89]
call fcn.006af7ad
inc eax
aad 0x45
sub al, 0xdf
je 0x6af722
ja 0x6af7be
test eax, 0x6c8a6bc8
and al, 4
mov ch, byte [esp + 4]
lea eax, [eax + edx]
btr ecx, edx
add esp, 0x22
sub ebx, eax
btr ebx, esp
jmp 0x6af72b
or byte [esi + 0x25b608f9], bl
push esp
invalid
cmc
bswap edi
xchg byte [esp + 2], bl
mov dl, 0x6c
mov cx, 0x26f1
pushal
jmp 0x6af652
Function at 0x401000
Capabilities:
Create directory
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x224]
test ebx, ebx
je 0x401139
test ebp, ebp
je 0x401139
cmp dword [esp + 0x220], 3
jbe 0x401139
push esi
push 0x103
lea eax, [esp + 0x119]
push 0
push eax
mov byte [ebp], 0
mov byte [esp + 0x120], 0
call fcn.004017e0
add esp, 0xc
lea esi, [esp + 0x114]
test edi, edi
je 0x40107d
mov esi, edi
jmp 0x401094
lea ecx, [esp + 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4010e6
push 0x103
lea edx, [esp + 0x15]
push 0
push edx
mov byte [esp + 0x1c], 0
call fcn.004017e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4010e6
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4010e6
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401101
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004017d0
add esp, 0x20c
ret
push 2
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401115
sub eax, edx
mov edx, dword [esp + 0x224]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
push ebp
call fcn.0040171b
add esp, 0x10
mov al, 1
jmp 0x4010e8
mov ecx, dword [esp + 0x214]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.004017d0
add esp, 0x20c
ret

Function at 0x401160
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push 0
push 0
lea eax, [esp + 8]
push eax
push 0
mov byte [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4011b7
push 0x40b23c
lea ecx, [esp + 4]
push ecx
push str._s_s.lnk
mov edx, ecx
push 0x104
push edx
call fcn.0040185a
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004017d0
add esp, 0x108
ret
Function at 0x4011d0
Capabilities:
Check mutex on windows
Create process on windows
Delete directory
Delete file
Get common file path

Disassembly:
sub esp, 0x478
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x474], eax
push ebx
push str.simdownmutex
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x40ef00], eax
cmp eax, ebx
je 0x4013d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4013c2
push 0x40b298
push ebx
lea ecx, [esp + 0x37c]
push 0x104
push ecx
mov byte [esp + 0x384], bl
call section..text
add esp, 0x10
test al, al
je 0x4013c2
push str.KGGWSetup_1003.exe
lea edx, [esp + 0x378]
push edx
push str._s_s
lea eax, [esp + 0x27c]
push 0x104
push eax
mov byte [esp + 0x284], bl
call fcn.0040185a
add esp, 0x14
lea ecx, [esp + 0x270]
push ecx
push str.http:__downmini.kugou.com_GouWo_1201.exe
lea ecx, [esp + 0x60]
call fcn.00401530
push 1
push ebx
push ebx
push str.http:__game.kugou.com_AdsPage_2013_01_DiscMicroStartBox.htm_cid1201
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x58]
call fcn.00401650
test al, al
je 0x40139d
push esi
push 0x44
lea edx, [esp + 0x1c]
push ebx
push edx
call fcn.004017e0
xor eax, eax
add esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, 5
push 0xfffffffffffffff6
mov dword [esp + 0x1c], 0x44
mov dword [esp + 0x48], 1
mov word [esp + 0x4c], ax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x6c], eax
push ebx
lea eax, [esp + 0x294]
push eax
push ebx
call esi
test eax, eax
je 0x40139c
call fcn.00401160
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401388
push ebx
push 0x1a
lea edx, [esp + 0x178]
push edx
push ebx
mov byte [esp + 0x180], bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401388
push str.GouWo1006KGGouwo.exe
lea eax, [esp + 0x174]
push eax
push str._s_s_mini1from12
mov ecx, eax
push 0x104
push ecx
call fcn.0040185a
add esp, 0x14
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x190]
push ecx
push ebx
call esi
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
lea ecx, [esp + 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x58]
call fcn.004014c0
mov eax, dword [0x40ef00]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [0x40ef00], ebx
mov ecx, dword [esp + 0x478]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004017d0
add esp, 0x478
ret 0x10
Function at 0x4013f0
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push esi
push edi
xor edi, edi
push 0x400
lea eax, [esp + 0x18]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x18], edi
call fcn.004017e0
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x400
lea edx, [esp + 0x1c]
push edx
push eax
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4014a6
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0x110]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4014a6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4014a6
push 0x400
lea ecx, [esp + 0x18]
push 0
push ecx
add edi, eax
mov dword [esp + 0x18], 0
call fcn.004017e0
mov ecx, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x400
lea eax, [esp + 0x1c]
push eax
push ecx
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x401445
mov ecx, dword [esp + 0x414]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004017d0
add esp, 0x40c
ret

Function at 0x401530
Capabilities:
Check http status code
Create http request
Get http content length

Disassembly:
sub esp, 0xc
push esi
push 0
push 0
push 0
push 1
push 0
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
test eax, eax
je 0x40163f
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40163f
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40163e
push 0
push 0x102
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [esi + 4], eax
test eax, eax
jne 0x40159a
mov eax, dword [esi]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ebx
mov dword [esi], 0
pop esi
add esp, 0xc
ret 8
push edi
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x20000013
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 4
call edi
cmp dword [esp + 0xc], 0xc8
jne 0x40163d
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 8]
push ecx
push 0x20000005
push edx
mov dword [esp + 0x28], 4
call edi
lea edi, [esi + 0xc]
push ebx
push edi
mov byte [edi], 0
call fcn.004014f0
push str..temp
push edi
call fcn.00401510
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
jne 0x40163d
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 4], 0
pop edi
pop ebx
pop esi
add esp, 0xc
ret 8
Function at 0x401650
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4016a5
cmp dword [esi + 0x110], 0xffffffff
je 0x4016a5
push edi
call fcn.004013f0
mov edi, eax
mov eax, dword [esi + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [esi + 8]
mov dword [esi + 0x110], 0xffffffff
pop edi
jae 0x4016bd
add esi, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004017d0
add esp, 0x108
ret
push 0x103
lea ecx, [esp + 9]
push 0
push ecx
mov byte [esp + 0x10], 0
call fcn.004017e0
add esi, 0xc
push esi
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.00401906
push str..temp
push esi
call fcn.00401880
add esp, 0x20
mov byte [eax], 0
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
mov al, 1
call fcn.004017d0
add esp, 0x108
ret

Function at 0x4017d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4017da
repz ret
jmp fcn.00401d7b
Function at 0x406993
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032e6
and dword [ebp - 4], 0
cmp dword [0x40f874], 0
mov ebx, eax
jne 0x406a44
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406af5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406af5
push eax
call fcn.00403274
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f874], eax
call esi
push eax
call fcn.00403274
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f878], eax
call esi
push eax
call fcn.00403274
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f87c], eax
call esi
push eax
call fcn.00403274
pop ecx
mov dword [0x40f884], eax
test eax, eax
je 0x406a44
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403274
pop ecx
mov dword [0x40f880], eax
mov eax, dword [0x40f880]
cmp eax, ebx
je 0x406a9c
cmp dword [0x40f884], ebx
je 0x406a9c
push eax
call fcn.004032ef
push dword [0x40f884]
mov esi, eax
call fcn.004032ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406a9c
test edi, edi
je 0x406a9c
call esi
test eax, eax
je 0x406a93
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406a93
test byte [ebp - 0xc], 1
jne 0x406a9c
or dword [ebp + 0x10], 0x200000
jmp 0x406ad5
mov eax, dword [0x40f878]
cmp eax, ebx
je 0x406ad5
push eax
call fcn.004032ef
pop ecx
test eax, eax
je 0x406ad5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406ad5
mov eax, dword [0x40f87c]
cmp eax, ebx
je 0x406ad5
push eax
call fcn.004032ef
pop ecx
test eax, eax
je 0x406ad5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f874]
call fcn.004032ef
pop ecx
test eax, eax
je 0x406af5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406af7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100eeff
Capabilities:
Encode data using xor

Disassembly:
add dword [esi], eax
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add dword [esi], eax
push es
inc dword [eax]
add byte [0x40000ff], al
inc dword [eax]
add byte [edi + edi*8], al
add byte [eax], al
add eax, 0x60100ff
inc dword [eax]
add dword [0x50100ff], eax
inc dword [eax]
add dword [0x50100ff], eax
inc dword [eax]
add dword [0x50100ff], eax
inc dword [eax]
add dword [0x70200ff], eax
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add al, byte [edi]
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [edx]
add byte [esi], al
inc dword [eax]
add dword [esi], eax
inc dword [eax]
add al, byte [esi]
inc dword [eax]
add al, byte [esi]
inc dword [eax]
add al, byte [esi]
inc dword [eax]
add al, byte [esi]
inc dword [eax]
add al, byte [esi]
inc dword [eax]
add dword [0x40000ff], eax
inc dword [eax]
add byte [edi + edi*8], al
add byte [eax], al
add al, 0xff
add byte [eax], al
add al, 0xff
add byte [eax], al
add al, 0xff
add byte [eax], al
add al, 0xff
add byte [ecx], al
add edi, edi
add dword [eax], eax
add bh, bh
add eax, 0x8ff0301
or edx, dword [ecx]
push dword [ecx]
inc ebx
push ecx
dec dword [ecx + 0x71]
xchg bh, bh
dec ebp
test dword [esi + 0x6f614bff], ebx
inc dword [edi]
adc bl, byte [ecx]
inc dword [esi]
pop es
add eax, 0x307ff
dec dword [eax]
add dword [eax], eax
inc dword [esi]
add eax, dword [esi]
dec dword [0x25ff1108]
xor eax, dword [edi + edi*8 + 0x45]
jbe 0x100ef8b
invalid
pop ebx
Function at 0x40234f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push edi
xor eax, eax
push eax
xor eax, eax
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x402381
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 8
pop eax
push eax
call dword [0x5accf4]
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov dword [esi], edi
add esp, 4
mov eax, dword [edi]
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42eb10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4af92b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a3ba7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42eb92
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a156d
mov eax, dword [eax]
push 0x5b8224
push eax
call fcn.004937d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a3e32
test bl, bl
je 0x42eb92
push 0x5b8224
lea ecx, [esp + 0xc]
call fcn.004a41c2
push 0x5bbdcc
lea ecx, [esp + 0xc]
call fcn.004a41c2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42ebce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a3e32
jmp 0x42ec99
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42ec52
lea edx, [esp + 0x7c]
push 0x5bbdc8
push edx
call fcn.004937d4
add esp, 8
test eax, eax
je 0x42ec52
lea eax, [esp + 0x7c]
push 0x5bbdc4
push eax
call fcn.004937d4
add esp, 8
test eax, eax
je 0x42ec52
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42ebe2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a3e32
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42f490
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42f4f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc