joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac0e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00483350
test eax, eax
je 0x4ac27a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
cmp dword [esi + 0x158], 8
mov dword [ebp - 4], eax
lea eax, [esi + 0x144]
jb 0x4ac114
mov eax, dword [eax]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push 0x4fec78
push eax
call fcn.00483270
add esp, 0x14
cmp dword [esi + 0x16c], 0
je 0x4ac18e
cmp dword [esi + 0x184], 0
je 0x4ac18e
cmp dword [esi + 0x19c], 0
je 0x4ac18e
cmp dword [esi + 0x1a0], 8
lea eax, [esi + 0x18c]
jb 0x4ac158
mov eax, dword [eax]
cmp dword [esi + 0x188], 8
lea ecx, [esi + 0x174]
jb 0x4ac169
mov ecx, dword [ecx]
cmp dword [esi + 0x170], 8
lea edx, [esi + 0x15c]
jb 0x4ac17a
mov edx, dword [edx]
push eax
push ecx
push edx
lea eax, [ebp - 4]
push str.___icon__s____iconIndex__s____server_mark__s_
push eax
call fcn.0048bf60
add esp, 0x14
push 0
push str.UserServer_LoginServer_Class
call dword [sym.imp.USER32.dll_FindWindowW]
or ebx, 0xffffffff
mov dword [ebp + 8], eax
test eax, eax
je 0x4ac20d
call fcn.00483350
test eax, eax
je 0x4ac27a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add esi, 0x12c
add eax, 0x10
mov dword [ebp + 0xc], eax
cmp dword [esi + 0x14], 8
jb 0x4ac1cd
mov esi, dword [esi]
mov edi, dword [ebp - 4]
lea eax, [ebp + 0xc]
push edi
push esi
push str.__s___s
push eax
call fcn.0048bf60
mov esi, dword [ebp + 0xc]
push esi
push 0x402
push dword [ebp + 8]
call fcn.004a5c60
add esp, 0x1c
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ac25c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4ac25c
push dword [esi + 4]
lea eax, [ebp - 4]
push str.___ipc_d
push eax
call fcn.0048bf60
add esi, 0x12c
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4ac231
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ac259
cmp dword [esi + 0x14], 8
jb 0x4ac244
mov esi, dword [esi]
mov edi, dword [ebp - 4]
push 5
push 0
push edi
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4ac25c
mov edi, dword [ebp - 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4ac271
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004831b0
int3
Function at 0x4ad830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
sub eax, 0x3e9
je 0x4ad8d0
sub eax, 1
jne 0x4ad879
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 1
call esi
push 2
movzx edi, ax
call esi
or ax, di
mov ecx, 0xf
bt ax, cx
jb 0x4ad881
push 0x3ea
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx esi, ax
sub esi, dword [ebx + 0x40]
shr eax, 0x10
push 0xfffffffffffffff0
push dword [ebx + 4]
movsx edi, ax
sub edi, dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4ad8b3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x4ad8b6
mov eax, dword [ebx + 4]
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
push 0x3e9
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x18]
call dword [eax + 0x74]
test eax, eax
jne 0x4ad879
cmp dword [ebx + 0x38], 5
je 0x4ad879
mov eax, dword [0x543020]
test eax, eax
jne 0x4ad91d
push 0x543eb0
push 0x2c
call fcn.004c211f
add esp, 8
test eax, eax
je 0x4ad916
mov ecx, eax
call fcn.00485620
jmp 0x4ad918
xor eax, eax
mov dword [0x543020], eax
push 5
push str.switch_panel__mode:__d
push str.web_view_base
push eax
call fcn.00486aa0
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x18]
add esp, 0x10
call dword [eax + 8]
test eax, eax
je 0x4ad94a
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x18]
push 0
call dword [eax + 0x20]
mov ecx, dword [ebx + 0x50]
push str.core_error
mov eax, dword [ecx]
call dword [eax + 0x1a0]
mov ecx, dword [ebx + 0x50]
push 1
mov eax, dword [ecx]
call dword [eax + 0x4c]
pop esi
mov dword [ebx + 0x38], 5
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x4adda0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00483350
test eax, eax
je 0x4adf9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push dword [ebp + 0x14]
add eax, 0x10
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__user_server___user_pay___window_d___show_d___where_d___from_s
push eax
call fcn.00483270
mov eax, dword [ebp + 0x18]
add esp, 0x18
test eax, eax
je 0x4addf9
push eax
lea eax, [ebp - 4]
push str.___sub_url_s
push eax
call fcn.0048bf60
add esp, 0xc
cmp dword [esi + 0x16c], 0
je 0x4ade5b
cmp dword [esi + 0x184], 0
je 0x4ade5b
cmp dword [esi + 0x19c], 0
je 0x4ade5b
cmp dword [esi + 0x1a0], 8
lea eax, [esi + 0x18c]
jb 0x4ade25
mov eax, dword [eax]
cmp dword [esi + 0x188], 8
lea ecx, [esi + 0x174]
jb 0x4ade36
mov ecx, dword [ecx]
cmp dword [esi + 0x170], 8
lea edx, [esi + 0x15c]
jb 0x4ade47
mov edx, dword [edx]
push eax
push ecx
push edx
lea eax, [ebp - 4]
push str.___icon__s____iconIndex__s____server_mark__s_
push eax
call fcn.0048bf60
add esp, 0x14
cmp dword [esi + 0x10c], 0
je 0x4ade87
cmp dword [esi + 0x110], 8
lea eax, [esi + 0xfc]
jb 0x4ade75
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push str.___ochannel__s_
push eax
call fcn.0048bf60
add esp, 0xc
cmp dword [esi + 0x124], 0
je 0x4adeb3
cmp dword [esi + 0x128], 8
lea eax, [esi + 0x114]
jb 0x4adea1
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push str.___channel__s_
push eax
call fcn.0048bf60
add esp, 0xc
push 0
push str.UserServer_LoginServer_Class
call dword [sym.imp.USER32.dll_FindWindowW]
or ebx, 0xffffffff
mov dword [ebp + 0x10], eax
test eax, eax
je 0x4adf32
call fcn.00483350
test eax, eax
je 0x4adf9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add esi, 0x12c
add eax, 0x10
mov dword [ebp + 0x14], eax
cmp dword [esi + 0x14], 8
jb 0x4adef2
mov esi, dword [esi]
mov edi, dword [ebp - 4]
lea eax, [ebp + 0x14]
push edi
push esi
push str.__s___s
push eax
call fcn.0048bf60
mov esi, dword [ebp + 0x14]
push esi
push 0x402
push dword [ebp + 0x10]
call fcn.004a5c60
add esp, 0x1c
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4adf81
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4adf81
push dword [esi + 4]
lea eax, [ebp - 4]
push str.___ipc_d
push eax
call fcn.0048bf60
add esi, 0x12c
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4adf56
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4adf7e
cmp dword [esi + 0x14], 8
jb 0x4adf69
mov esi, dword [esi]
mov edi, dword [ebp - 4]
push 5
push 0
push edi
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4adf81
mov edi, dword [ebp - 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4adf96
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.004831b0
int3
Function at 0x4be1a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4be1f2
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4be1f2
cmp esi, dword [ebp + 0x10]
je 0x4be1ed
push 0x50f730
push 1
push edi
push edi
call fcn.004bd836
jmp 0x4be200
xor eax, eax
inc eax
jmp 0x4be205
mov eax, 0x50f730
push eax
push eax
push edi
push edi
call fcn.004bd883
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4bf3f2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4bf41c
mov eax, 0x50f730
push eax
push eax
push 0
push 0
call fcn.004bd883
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x4c015e
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4c04be
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4c077d
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4f5c1b
call fcn.004c2d78
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004c0f4e
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4c08c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4c07f6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004c0dad
test eax, eax
je 0x4c082b
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4c08c9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c08c9
push 0x5c0
call fcn.004c0a88
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4c084e
push edi
mov ecx, eax
call fcn.004c090a
jmp 0x4c0850
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4c08d1
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004c0eed
pop ecx
test eax, eax
jne 0x4c0804
mov dword [ebp - 0xa8], 3
push 0x533cec
lea eax, [ebp - 0xa8]
jmp 0x4c08e6
mov eax, esi
call fcn.004c2cfc
ret
mov dword [ebp - 0xa4], 1
push 0x533cec
lea eax, [ebp - 0xa4]
push eax
call fcn.004c5a22
int3
Function at 0x4c090a
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4f5c4e
call fcn.004c2d0d
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004c074e
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4c0956
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004c2ce7
ret 4
push 0x533cec
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004c5a22
int3

Function at 0x4c0b22
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004c0cb6
mov edi, eax
test edi, edi
je 0x4c0bad
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4c0b5d
mov esi, edi
jmp 0x4c0b99
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4c0b92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c0b85
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004c0c51
jmp 0x4c0b99
push 0x502a00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4c0b99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004c0cb6
mov edi, eax
test edi, edi
jne 0x4c0b52
test esi, esi
jne 0x4c0bc2
mov ecx, dword [ebx]
add ecx, 8
call fcn.004c0e3e
mov esi, eax
test esi, esi
je 0x4c0bc2
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4e5834
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e56b3

Function at 0x4e6e2f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e679d

Function at 0x4e6e3a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e69d8
Function at 0x15c4e34
Capabilities:
Encode data using xor

Disassembly:
jmp 0x15c4e3e
pushal
call 0x15c4e44
pop ebp
sub ebp, 0x10
sub ebp, 0x11c4e34
jmp 0x15c4e5a
lds ecx, [ecx - 0x73]
and edi, dword [eax + 0x11c4e34]
mov eax, 0x11c4e34
add eax, ebp
add eax, 0x4c
mov ecx, 0x5af
mov edx, 0xa779a85b
xor byte [eax], dl
inc eax
dec ecx
jne 0x15c4e71
invalid
invalid
jmp 0x15c4e84
rcl byte [esi + 0x5b67d2d0]
pop ebx
pop ebx
ficomp dword [edx + 0x5b5b5ba3]
pop eax
xchg esi, eax
jecxz 0x15c4ef4
pop ebx
pop ebx
pop ebx
loope 0x15c4f0e
pop ebx
pop ebx
pop ebx
lodsb al, byte [esi]
mov ecx, 0xdad09358
push edi
pop ebx
pop ebx
pop ebx
pop eax
sahf
or edx, esi
aas
jg 0x15c4e56
rcr byte [edi + 0x7f], cl
xor ebp, dword [edi]
loope 0x15c4efa
pop ebx
xor esp, ebp
enter 0x5ba7, 0x5a
pop ebx
pop edx
ja 0x15c4f3e
xor edx, eax
or bh, ch
jle 0x15c4e78
pop esi
pop ebx
pop ebx
pop ebx
mov dl, 0x75
pop ebx
pop ebx
pop ebx
salc
aas
jg 0x15c4e79
sal byte [edi + 0x7f], cl
sal byte [edi + 0x5b53ded0], 1
pop ebx
pop ebx
ror dh, 1
push edi
pop ebx
pop ebx
pop ebx
rcl dh, 1
dec ebx
pop ebx
pop ebx
pop ebx
lcall 0x99d8, 0x596a59b2
pop edi
adc dl, byte [esi + ebx*8 - 0x51]
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
push es
cdq
push edi
pop ebx
rcl bh, 1
jg 0x15c4f5f
pop ebx
pop ebx
pop ebx
xor ebp, dword [edi]
loope 0x15c4f4b
pop ebx
xor esp, ebp
enter 0x5ba7, 0x5a
ja 0x15c4f8f
salc
aas
jg 0x15c4ebb
rcl byte [edi + 0x7f], cl
mov bl, 0x5e
pop ebx
pop ebx
pop ebx
mov dl, 0x1e
pop ecx
pop ebx
pop ebx
salc
aas
jg 0x15c4ecc
sal byte [edi + 0x7f], cl
clts
movsb byte es:[edi], byte [esi]
push edi
movsb byte es:[edi], byte [esi]
push ebx
mov bl, 0x29
pop ebx
pop ebx
pop ebx
shl dh, 1
push ebx
pop ebx
pop ebx
pop ebx
fisubr dword [edx - 0x1b76194e]
fisubr dword [edx - 0x1b76194e]
out 0x89, al
in al, 0xda
stosb byte es:[edi], al
mov dl, 0xe6
mov esp, esp
push 0xd8896892
mov bl, 0x5e
adc edx, dword [edi + ebx*8 + 0x15]
pop ebx
pop ebx
pop ebx
push esp
fdiv dword [ebx - 0x20abeca2]
adc eax, 0x545b5b5b
rcl dword [ebx], cl
pop ebx
pop ebx
pop ebx
cmp eax, 0xdb6247d0
mov al, byte [0x41df54b3]
pop ebx
pop ebx
pop ebx
invalid
invalid
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
jb 0x15c4fa2
bound ebx, qword [ecx - 0x28]
lcall 0xb3d8, 0x5fb1d85d
pop esi
mov dl, 0xf0
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
push es
cdq
push edi
pop ebx
push cs
sal byte [edi - 0x2ff1f3f3], 1
push edi
shl byte [esi], 1
push ebx
cmpsd dword [esi], dword es:[edi]
jmp 0xdbba2194
Function at 0x534700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
jmp 0x53471a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x534721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534710
mov eax, 1
add ebx, ebx
jne 0x534733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x534744
jne 0x534763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534763
dec eax
add ebx, ebx
jne 0x534750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x534728
add ebx, ebx
jne 0x53475f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5347b5
xor ecx, ecx
sub eax, 3
jb 0x53477b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5347ea
sar eax, 1
mov ebp, eax
jmp 0x534786
add ebx, ebx
jne 0x534786
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534754
inc ecx
add ebx, ebx
jne 0x534794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534754
add ebx, ebx
jne 0x5347a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x534796
jne 0x5347b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x534796
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5347d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5347c6
jmp 0x534716
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5347d4
add edi, ecx
jmp 0x534716
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5347f2
cmp byte [edi], 0x11
jne 0x5347f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5347f7
lea edi, [esi + 0x12d000]
mov eax, dword [edi]
or eax, eax
je 0x53486f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x182f2c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1830a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x534824
mov ecx, edi
jns 0x534853
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1830ac]
or eax, eax
je 0x534869
mov dword [ebx], eax
add ebx, 4
jmp 0x534841
call dword [esi + 0x1830bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5348a0
cmp al, 0xef
ja 0x534893
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x534875
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x534882
mov ebp, dword [esi + 0x1830b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5348d4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x406a66
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00406c16
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x406b64
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x406b07
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x406b4a
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x406b1e
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x406b39
test al, 0x40
je 0x406b30
mov ecx, dword [edi + 0x20]
jmp 0x406b37
test al, 0x80
je 0x406b4a
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x406b4a
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x406ad6
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x41a7f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4876bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00479de8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41a872
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047745a
mov eax, dword [eax]
push 0x4c31d0
push eax
call fcn.0046a004
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047a073
test bl, bl
je 0x41a872
push 0x4c31d0
lea ecx, [esp + 0xc]
call fcn.0047a44f
push 0x4c6d4c
lea ecx, [esp + 0xc]
call fcn.0047a44f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41a8ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047a073
jmp 0x41a979
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41a932
lea edx, [esp + 0x7c]
push 0x4c6d48
push edx
call fcn.0046a004
add esp, 8
test eax, eax
je 0x41a932
lea eax, [esp + 0x7c]
push 0x4c6d44
push eax
call fcn.0046a004
add esp, 8
test eax, eax
je 0x41a932
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a8c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047a073
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41b170
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b1d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc