joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499ee8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov esi, 0x4beeb8
mov edx, dword [esp + 0xc]
movzx eax, byte [esp + 8]
mov ebx, eax
add ebx, ebx
lea ebx, [ebx + ebx*2]
mov eax, dword [esi + ebx*8]
mov ecx, dword [esp]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esi + ebx*8 + 4]
mov edi, dword [esp]
mov eax, dword [edi + eax*4]
mov ebx, dword [esi + ebx*8 + 8]
mov edi, dword [esp]
mov ebx, dword [edi + ebx*4]
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add eax, ecx
add ecx, eax
mov edi, eax
shr edi, 0x11
xor eax, edi
add ebx, eax
add eax, ebx
mov edi, ebx
shl edi, 9
xor ebx, edi
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
mov edx, ecx
shl edx, 7
xor ecx, edx
add eax, ecx
mov edx, ebx
shr edx, 0xf
xor eax, edx
add ebx, eax
mov eax, ebx
shl eax, 0xb
xor ebx, eax
mov eax, dword [esp + 0x10]
xor eax, ebx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
add esi, 0xc
dec dword [esp + 0x14]
jne 0x499f1b
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x49a020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
dec ecx
test ecx, ecx
jl 0x49a11f
inc ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov edx, dword [eax]
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx]
xor byte [eax + edx + 4], cl
inc dword [eax]
cmp dword [eax], 0x100
jne 0x49a053
xor edx, edx
mov dword [eax], edx
mov edx, dword [eax + 0x104]
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx]
xor byte [eax + edx + 0x108], cl
inc dword [eax + 0x104]
cmp dword [eax + 0x104], 8
jne 0x49a112
mov ecx, dword [eax + 0x114]
mov ebx, dword [eax + 0x110]
mov esi, dword [eax + 0x10c]
mov edx, dword [eax + 0x108]
mov edi, 4
add ecx, edx
add edx, ecx
mov ebp, ecx
shr ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shl ebp, 0xd
xor ebx, ebp
add esi, ebx
add ebx, esi
mov ebp, esi
shr ebp, 0x11
xor esi, ebp
add edx, esi
add esi, edx
mov ebp, edx
shl ebp, 9
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shr ebp, 3
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shl ebp, 7
xor ebx, ebp
add esi, ebx
add ebx, esi
mov ebp, edx
shr ebp, 0xf
xor esi, ebp
add edx, esi
add esi, edx
mov ebp, edx
shl ebp, 0xb
xor edx, ebp
dec edi
jne 0x49a097
mov dword [eax + 0x108], ecx
mov dword [eax + 0x10c], ebx
mov dword [eax + 0x110], esi
mov dword [eax + 0x114], edx
xor edx, edx
mov dword [eax + 0x104], edx
inc dword [esp + 4]
dec dword [esp]
jne 0x49a038
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49b468
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x49b484
add esp, 0xfffffff0
call fcn.00403f9c
mov edi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x49b56e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0xe0], 0x2af9
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040325c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409b2c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 4]
call fcn.00404cb4
lea edx, [ebp - 4]
mov eax, 0x49b5a0
call fcn.0040f2c0
push dword [ebx + 4]
push 0x49b5b0
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ff4
mov eax, dword [ebp - 0x14]
call fcn.004050f0
push eax
push 0x49b5b8
call sub.kernel32.dll_SetEnvironmentVariableA
push dword [ebx + 4]
push 0x49b5c8
push 0x49b5d8
lea eax, [ebx + 0x1c]
mov edx, 3
call fcn.00404ff4
mov dword [ebx + 0xfc], 0x55
xor ecx, ecx
mov dl, 1
mov eax, dword [0x43551c]
call fcn.004364f0
mov esi, eax
mov dword [ebx + 0xe4], esi
mov eax, esi
mov edx, edi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov edx, dword [0x4bef30]
mov eax, ebx
call fcn.0049c4bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b575
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c84
lea eax, [ebp - 4]
call fcn.00404c60
ret
Function at 0x49c4d8
Capabilities:
Check for time delay via gettickcount
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x49c65b
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebp - 9]
mov esi, dword [ebx + eax*4 + 0xc]
lea eax, [ebp - 8]
mov ecx, 0x49c674
mov edx, dword [ebx + 4]
call fcn.00404f78
mov eax, dword [ebp - 8]
call fcn.00409a5c
test al, al
je 0x49c633
cmp byte [esi + 0x50], 0
jne 0x49c55a
movzx edx, byte [ebp - 9]
mov eax, ebx
call fcn.0049bcb0
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov eax, dword [0x4bf90c]
mov eax, dword [eax]
call fcn.00468ac0
push 0xa
call sub.kernel32.dll_Sleep_2
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x1770
jbe 0x49c539
cmp byte [esi + 0x50], 0
je 0x49c633
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x49c688
mov edx, dword [ebx + 4]
call fcn.00404f78
mov eax, dword [ebp - 0x10]
call fcn.004050f0
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x49c6a0
mov edx, dword [esi + 0x54]
call fcn.00404f78
mov eax, dword [ebp - 0x14]
call fcn.004050f0
push eax
call sub.kernel32.dll_CopyFileA
movzx eax, byte [ebp - 9]
add eax, eax
lea eax, [eax + eax*2]
lea edi, [ebx + eax*8 + 0x20]
mov eax, dword [esi + 0x64]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x20], eax
push dword [ebx + 4]
push 0x49c6b4
push dword [edi + 0x10]
push 0x49c6c8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404ff4
lea edx, [edi + 4]
mov eax, dword [ebp - 4]
call fcn.0046b140
mov eax, dword [edi]
mov edx, dword [ebp - 8]
call fcn.004807b4
push dword [ebp - 8]
push 0x49c6d8
lea edx, [ebp - 0x18]
movzx eax, byte [ebp - 9]
call fcn.0040953c
push dword [ebp - 0x18]
push 0x49c6d8
push dword [ebp - 4]
mov eax, dword [edi]
add eax, 8
mov edx, 5
call fcn.00404ff4
mov eax, dword [edi]
call fcn.00480744
movzx eax, byte [ebp - 9]
mov eax, dword [ebx + eax*4 + 0xec]
call fcn.0049b33c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c662
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404c84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c84
ret

Function at 0x4a00f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00425ef4
cmp ebx, dword [ebp - 8]
jge 0x4a015b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00426358
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00426358
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00426384
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4a0121
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a0164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00425ef4
cmp ebx, dword [ebp - 8]
jge 0x4a01c7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00426358
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00426358
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00426384
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4a018d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4fa66d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4fa68a
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fa67b
add dl, dl
jne 0x4fa695
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fa6e1
xor eax, eax
add dl, dl
jne 0x4fa6a2
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4fa77e
add dl, dl
jne 0x4fa6b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fa6bc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fa6c7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fa6d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4fa6dc
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4fa681
mov eax, 1
add dl, dl
jne 0x4fa6ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4fa6fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fa6e6
sub eax, 2
jne 0x4fa729
mov ecx, 1
add dl, dl
jne 0x4fa70f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4fa71a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fa706
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fa681
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4fa740
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4fa74b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4fa737
cmp eax, 0x7d00
jae 0x4fa76e
cmp eax, 0x500
jb 0x4fa769
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fa681
cmp eax, 0x7f
ja 0x4fa771
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fa681
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4fa79a
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4fa681
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x11c1763
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt cx, ax
ror edi, 0xd
pushfd
mov edi, dword [edx + 0x1c]
bt di, 3
add edi, eax
push ebx
mov edi, dword [edi + ecx*4]
call fcn.011a21ee
cmpsb byte [esi], byte es:[edi]
push esp
dec ebx
aaa
aas
mov edi, 0x4333cbce
cld
dec edi
sbb ecx, eax
clc
sub byte [ebx], bh
mov edi, esp
mov dr6, ebx
call 0xd1663c6e
add byte [ebx], 0x10
clc
call 0xe49b4fc2
stc
push ecx
mov byte [ebx - 0xf], dl
pop edi
cmpsd dword [esi], dword es:[edi]
mov bh, 0x7c
das
add cl, byte [0x34918e20]
adc dl, byte [ebp + 0x40]
jmp 0x346154ff
jle 0x162eb52
add ecx, edx
push edi
cmp bl, 0xc1
mov dword [ebp - 0x10], ecx
btr cx, sp
sar cl, cl
shrd ecx, eax, cl
bsf cx, dx
mov ecx, dword [ebp + 0xc]
cmp dl, 0x9c
mov byte [esp], 0x40
cmp ecx, 0xffff
jmp 0x11c9215
or al, 0x41
shld eax, ebp, 0xf
aaa
add al, ah
push ebp
shr ebp, cl
shrd bp, cx, cl
shrd bp, si, 1
mov ebp, esp
bts ax, 3
sub esp, 0x18
inc ah
daa
push esi
aad 0xa0
aad 0xe3
push edi
shl al, cl
shrd ax, ax, cl
push ebx
bsf ax, bx
push edx
test al, cl
aad 0xf9
btc ax, bp
mov eax, dword [ebp + 8]
stc
cmc
test eax, eax
jmp 0x12884ac
push edi
stc
pushfd
cmp bh, dl
sub ecx, dword [edx + 0x10]
cmp dx, si
pushal
stc
cmp ecx, dword [edx + 0x14]
mov word [esp], 0x8356
jmp 0x162fc33
mov word [esp], bx
call fcn.011ce867
ret
push 0xf9e97ffe
mov word [esp], 0xa9c4
lea esp, [esp + 4]
je 0x11a25ab
add edx, ecx
pushal
add dl, cl
mov esi, dword [eax + 0x3c]
shrd edx, esp, 0x1e
movzx dx, bl
not dh
add esi, eax
or edx, 0x3867a856
bts dx, 7
pushal
neg dh
mov edx, dword [esi + 0x78]
cmp esi, edx
cmp bp, 0x1bb1
jmp 0x1630572
lea esp, [esp + 0x48]
je 0x11a25ab
and cx, bp
sbb ch, cl
test bh, bh
sub cx, cx
add edx, eax
cmc
mov ecx, dword [esi + 0x7c]
jmp 0x11a1f72
pushfd
test bh, 0x4a
pushfd
mov byte [esp + 4], ah
add ecx, edx
pushal
stc
shl dword [eax - 7], 1
cmc
bt ax, 1
mov dword [ebp - 0x10], ecx
stc
bsf cx, bx
bswap ecx
btc ecx, edx
mov ecx, dword [ebp + 0xc]
mov ebx, 0xc4d8bd1
pushfd
cmp ecx, 0xffff
pushfd
lea esp, [esp + 0x30]
jbe 0x11c5307
add byte [ebp + ecx*4 + 0xf302464], bl
xchg byte [eax - 0x79004699], al
out dx, eax
xchg bh, ch
mov edi, dword [edx + 0x24]
bts cx, ax
cmc
add cx, di
btr cx, sp
add edi, eax
rol ecx, cl
ror cl, cl
movsx ebx, al
call fcn.011c173f
jnp 0x162eb70
int1
pop esi
push eax
jbe 0x162eb7b
xchg esp, eax
insb byte es:[edi], dx
pop esp
mov ebx, 0xab9b48e8
pop eax
je 0x162eb5c
mov bh, 0x84
inc eax
push eax
wait
retf
lea esp, [esp + 0x28]
jae 0x11a25ab
pushal
push dword [esp + 0x10]
pushal
lea esp, [esp + 0x44]
jmp 0x119fc60
test edx, edx
mov byte [esp + 0xc], 0x57
pushfd
pushfd
jmp 0x129041b
Function at 0x154c0115
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x154c0143
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x154c014a
cmp ebx, dword [eax + 4]
jae 0x154c014a
xor eax, eax
jmp 0x154c033a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x154c015b
xor eax, eax
inc eax
jmp 0x154c0339
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x154c0171
cmp ecx, edx
jae 0x154c02b6
cmp dword [eax + 4], 0
je 0x154c017a
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x154c0162
cmp dword [ebp + 8], 0
je 0x154c019c
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x154c02b6
cmp eax, esi
jae 0x154c02b6
mov eax, dword [0x154f3308]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x154c01c1
cmp dword [esi*4 + 0x154f3310], edi
je 0x154c02ba
inc esi
cmp esi, eax
jl 0x154c01af
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x154d9138]
test eax, eax
je 0x154c0336
cmp dword [ebp - 8], 0x1000000
jne 0x154c0336
test byte [ebp - 0xc], 0xcc
je 0x154c023f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x154c0336
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x154c0336
cmp word [eax + 0x18], 0x10b
jne 0x154c0336
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x154c0336
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x154c023f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x154c023f
test byte [ecx + 0x27], 0x80
jne 0x154c02b6
push 1
push 0x154f3350
call dword [0x154d9284]
test eax, eax
jne 0x154c0153
mov ecx, dword [0x154f3308]
test ecx, ecx
mov edx, ecx
jle 0x154c0273
lea eax, [ecx*4 + 0x154f330c]
cmp dword [eax], edi
je 0x154c0273
dec edx
sub eax, 4
test edx, edx
jg 0x154c0267
test edx, edx
jne 0x154c02a4
push 0xf
pop ebx
cmp ecx, ebx
jg 0x154c0280
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x154c0298
lea eax, [edx*4 + 0x154f3310]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x154c0286
cmp ecx, 0x10
jge 0x154c02a4
inc ecx
mov dword [0x154f3308], ecx
push 0
push 0x154f3350
call dword [0x154d9284]
jmp 0x154c0153
xor eax, eax
jmp 0x154c0339
test esi, esi
jle 0x154c0153
mov ebx, dword [0x154d9284]
push 1
push 0x154f3350
call ebx
test eax, eax
jne 0x154c0153
cmp dword [esi*4 + 0x154f3310], edi
je 0x154c0310
mov eax, dword [0x154f3308]
lea esi, [eax - 1]
test esi, esi
jl 0x154c02fe
cmp dword [esi*4 + 0x154f3310], edi
je 0x154c02fa
dec esi
jns 0x154c02ee
test esi, esi
jge 0x154c030e
cmp eax, 0x10
jge 0x154c0309
inc eax
mov dword [0x154f3308], eax
lea esi, [eax - 1]
jmp 0x154c0310
je 0x154c0328
xor ecx, ecx
test esi, esi
jl 0x154c0328
lea eax, [ecx*4 + 0x154f3310]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x154c0316
push 0
push 0x154f3350
call ebx
jmp 0x154c0153
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x154ca963
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x154d730e
call fcn.154bda40
sub esp, 0x11c
mov eax, dword [0x154ed66c]
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x128], esi
call fcn.154cbe79
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFileDialog.0
call fcn.15472350
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
jne 0x154ca9f4
mov edi, 0x114
push edi
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.154bd9e0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], edi
call dword [0x154d9274]
cmp dword [ebp - 0x114], 2
jne 0x154ca9ed
cmp dword [ebp - 0x120], 5
mov dword [ebp + 0x20], 0x58
jae 0x154ca9f4
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.154bba65
cmp eax, ebx
pop ecx
mov dword [esi + 0x70], eax
jne 0x154caa09
call fcn.154ca6e0
push dword [ebp + 0x20]
push ebx
push eax
call fcn.154bd9e0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x74], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x304], ebx
lea ecx, [esi + 0x7c]
mov word [ecx], bx
lea edi, [esi + 0xfc]
mov word [edi], bx
mov dword [eax], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0x104
mov eax, dword [esi + 0x70]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x70]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x70]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x154caa88
mov eax, dword [esi + 0x70]
and byte [eax + 0x36], 0x7f
call fcn.154d4ce9
cmp dword [ebp + 0x10], ebx
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x44], 0x154cad14
je 0x154caab4
push 0x104
push dword [ebp + 0x10]
push edi
call dword [0x154d9234]
cmp dword [ebp + 0x18], ebx
je 0x154caaed
push dword [ebp + 0x18]
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.154744c0
push ebx
mov ecx, edi
call fcn.15472370
jmp 0x154caad6
mov word [eax], bx
add eax, 2
push 0x7c
push eax
call fcn.154bc29a
cmp eax, ebx
pop ecx
pop ecx
jne 0x154caad0
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.154bbb2d
leave
ret 0x1c
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x11a17fa5
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2fbb6079
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x413320
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47a4bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046ec54
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4133a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046cadd
mov eax, dword [eax]
push 0x4ba200
push eax
call fcn.0045f954
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046eedf
test bl, bl
je 0x4133a2
push 0x4ba200
lea ecx, [esp + 0xc]
call fcn.0046f26f
push 0x4bdd7c
lea ecx, [esp + 0xc]
call fcn.0046f26f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4133de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046eedf
jmp 0x4134a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x413462
lea edx, [esp + 0x7c]
push 0x4bdd78
push edx
call fcn.0045f954
add esp, 8
test eax, eax
je 0x413462
lea eax, [esp + 0x7c]
push 0x4bdd74
push eax
call fcn.0045f954
add esp, 8
test eax, eax
je 0x413462
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4133f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046eedf
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x413ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x413d02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc