joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b23e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6055c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], esi
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x5b242a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x5b2443
lea eax, [esi + 0x28]
push eax
call fcn.005e2732
add esp, 4
test eax, eax
je 0x5b2443
push eax
call fcn.005e277c
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
push dword [edi + 0x48]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005cbdbd
add esp, 0x10
mov edi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x5b2481
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x5b249a
lea eax, [esi + 0x28]
push eax
call fcn.005e275b
add esp, 4
test eax, eax
je 0x5b249a
push eax
call fcn.005e277c
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5b25a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e838
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x5b25eb
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x5b2604
lea eax, [edi + 0x28]
push eax
call fcn.005e2732
add esp, 4
test eax, eax
je 0x5b2604
push eax
call fcn.005e277c
add esp, 4
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
sub esp, 8
lea esi, [ebx + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.0054b1c0
mov byte [ebp - 4], 1
mov ecx, dword [0x740c00]
mov byte [ebp - 4], 0
call fcn.0050d000
push dword [ebx + 0x48]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005cc5fb
add esp, 8
mov ecx, esp
mov dword [ebp + 0xc], esp
push esi
mov ebx, eax
call fcn.0054b1c0
mov byte [ebp - 4], 2
mov ecx, dword [0x740c00]
mov byte [ebp - 4], 0
call fcn.0050d0d0
mov dword [ebp - 4], 0xffffffff
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x5b2684
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x5b269d
lea eax, [edi + 0x28]
push eax
call fcn.005e275b
add esp, 4
test eax, eax
je 0x5b269d
push eax
call fcn.005e277c
add esp, 4
mov dword [ebp - 0x18], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5b2b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60eaaf
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x6a4108]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
mov dword [ebp - 0x26c], 0
push 0x65ace0
mov ecx, edi
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x264], edi
call fcn.004f8040
mov dword [ebp - 4], 1
mov ecx, edi
call fcn.004fc100
mov dword [ebp - 4], 2
mov dword [edi + 8], 2
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x26c], 1
mov ebx, dword [eax]
cmp ebx, 0xffffffff
je 0x5b2d0e
push 0x250
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.005c8040
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
call ebx
test eax, eax
je 0x5b2d0e
mov edi, edi
mov eax, dword [ebp - 0x260]
and eax, 0x10
je 0x5b2c21
test byte [esi + 0x24], 2
jne 0x5b2c33
test eax, eax
jne 0x5b2cc0
test byte [esi + 0x24], 1
je 0x5b2cc0
push 0xffffffffffffffff
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x274]
call fcn.004f80a0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x268]
call fcn.004f7ed0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x268]
call fcn.004fc100
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x274]
call fcn.004f8230
lea eax, [ebp - 0x268]
push 0x62fe24
push eax
call fcn.004f83d0
add esp, 8
test al, al
je 0x5b2cae
lea eax, [ebp - 0x268]
push 0x64b780
push eax
call fcn.004f83d0
add esp, 8
test al, al
jne 0x5b2cd8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.004f8230
lea eax, [ebp - 0x260]
push eax
mov eax, dword [esi + 0x30]
push dword [eax]
call ebx
test eax, eax
jne 0x5b2c10
jmp 0x5b2d0e
lea eax, [ebp - 0x268]
push eax
mov ecx, edi
call fcn.004f8250
mov ecx, dword [ebp - 0x260]
shr ecx, 4
and ecx, 1
mov dword [edi + 8], ecx
mov dword [edi + 0xc], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.004f8230
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c7124
mov esp, ebp
pop ebp
ret 4
Function at 0x5c22c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
movq mm7, qword [edx]
mov edi, esi
add edi, eax
movq mm2, qword [edi + eax*2]
movq mm1, qword [esi + eax*2]
movq mm6, mm1
psubusb mm1, mm2
psubusb mm2, mm6
por mm1, mm2
psubusb mm1, mm7
movq mm4, qword [esi + eax]
movq mm3, mm4
psubusb mm4, mm6
psubusb mm6, mm3
por mm4, mm6
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi]
movq mm0, mm4
psubusb mm4, mm3
psubusb mm3, mm0
por mm4, mm3
movq qword [esp], mm4
psubusb mm4, mm7
por mm1, mm4
neg eax
movq mm2, qword [esi + eax*4]
movq mm4, qword [edi + eax*4]
movq mm5, mm4
psubusb mm4, mm2
psubusb mm2, mm5
por mm4, mm2
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi + eax*2]
movq mm3, mm4
psubusb mm4, mm5
psubusb mm5, mm3
por mm4, mm5
psubusb mm4, mm7
por mm1, mm4
movq mm2, mm3
movq mm4, qword [esi + eax]
movq mm5, mm4
psubusb mm4, mm3
psubusb mm3, mm5
por mm4, mm3
movq qword [esp + 0x10], mm4
psubusb mm4, mm7
por mm1, mm4
movq mm3, qword [edi]
movq mm4, mm3
psubusb mm3, mm2
psubusb mm2, mm4
por mm2, mm3
pand mm2, qword [0x75f860]
psrlw mm2, 1
movq mm6, mm5
movq mm3, qword [esi]
psubusb mm5, mm3
psubusb mm3, mm6
por mm5, mm3
paddusb mm5, mm5
paddusb mm5, mm2
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
por mm1, mm5
pxor mm5, mm5
pcmpeqb mm1, mm5
mov edx, dword [ebp + 0x18]
movq mm7, qword [edx]
movq mm4, qword [esp]
psubusb mm4, mm7
movq mm3, qword [esp + 0x10]
psubusb mm3, mm7
paddb mm4, mm3
pcmpeqb mm4, mm5
pcmpeqb mm5, mm5
pxor mm4, mm5
movq mm2, qword [esi + eax*2]
movq mm7, qword [edi]
pxor mm2, qword [0x75f870]
pxor mm7, qword [0x75f870]
psubsb mm2, mm7
pand mm2, mm4
pxor mm6, qword [0x75f870]
pxor mm0, qword [0x75f870]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm1, mm2
movq mm2, mm1
paddsb mm1, qword [0x75f8a0]
paddsb mm2, qword [0x75f890]
pxor mm0, mm0
pxor mm5, mm5
punpcklbw mm0, mm2
punpckhbw mm5, mm2
psraw mm0, 0xb
psraw mm5, 0xb
packsswb mm0, mm5
movq mm2, mm0
pxor mm0, mm0
movq mm5, mm1
punpcklbw mm0, mm1
psraw mm0, 0xb
pxor mm1, mm1
punpckhbw mm1, mm5
psraw mm1, 0xb
movq mm5, mm0
packsswb mm0, mm1
paddsw mm5, qword [0x75f8b0]
paddsw mm1, qword [0x75f8b0]
psraw mm5, 1
psraw mm1, 1
packsswb mm5, mm1
pandn mm4, mm5
paddsb mm6, mm2
pxor mm6, qword [0x75f870]
movq qword [esi + eax], mm6
movq mm6, qword [esi + eax*2]
pxor mm6, qword [0x75f870]
paddsb mm6, mm4
pxor mm6, qword [0x75f870]
movq qword [esi + eax*2], mm6
psubsb mm3, mm0
pxor mm3, qword [0x75f870]
movq qword [esi], mm3
psubsb mm7, mm4
pxor mm7, qword [0x75f870]
movq qword [edi], mm7
add esi, 8
neg eax
dec ecx
jne 0x5c22db
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x5c2eac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, 2
mov edx, dword [ebp + 0x10]
movq mm3, qword [edx]
mov edi, esi
add edi, eax
neg eax
movq mm1, qword [esi + eax*2]
movq mm0, qword [edi]
movq mm2, mm1
movq mm7, mm0
movq mm4, mm0
psubusb mm0, mm1
psubusb mm1, mm4
por mm1, mm0
pand mm1, qword [0x75f860]
psrlw mm1, 1
movq mm5, qword [esi + eax]
movq mm4, qword [esi]
movq mm0, mm4
movq mm6, mm5
psubusb mm5, mm4
psubusb mm4, mm6
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm1
psubusb mm5, mm3
pxor mm3, mm3
pcmpeqb mm5, mm3
pxor mm2, qword [0x75f870]
pxor mm7, qword [0x75f870]
psubsb mm2, mm7
pxor mm6, qword [0x75f870]
pxor mm0, qword [0x75f870]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm5, mm2
paddsb mm5, qword [0x75f8a0]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm1, mm5
psraw mm1, 0xb
psllw mm1, 8
por mm0, mm1
psubsb mm3, mm0
pxor mm3, qword [0x75f870]
movq qword [esi], mm3
psubsb mm5, qword [0x75f880]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x75f870]
movq qword [esi + eax], mm6
add esi, 8
neg eax
dec ecx
jne 0x5c2ebc
pop edi
pop esi
pop ebp
ret
Function at 0x5c2fb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4 - 2]
mov ecx, 2
lea edi, [esi + eax]
movd mm0, dword [edi + eax*2]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm0
movd mm0, dword [esi + eax]
movd mm4, dword [esi]
punpcklbw mm4, mm0
movq mm5, mm4
punpcklwd mm4, mm6
punpckhwd mm5, mm6
neg eax
movd mm7, dword [esi + eax]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm7
movd mm1, dword [edi + eax*4]
movd mm0, dword [esi + eax*4]
punpcklbw mm0, mm1
movq mm2, mm0
punpcklwd mm0, mm6
punpckhwd mm2, mm6
movq mm1, mm0
punpckldq mm0, mm4
movq mm3, mm2
punpckhdq mm1, mm4
punpckldq mm2, mm5
punpckhdq mm3, mm5
movq mm6, mm0
movq mm7, mm3
psubusb mm7, mm6
psubusb mm6, mm3
por mm6, mm7
pand mm6, qword [0x75f860]
psrlw mm6, 1
movq mm5, mm1
movq mm4, mm2
psubusb mm5, mm2
psubusb mm4, mm1
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm6
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
pxor mm7, mm7
pcmpeqb mm5, mm7
movq qword [esp], mm0
movq qword [esp + 0x10], mm3
pxor mm0, qword [0x75f870]
pxor mm3, qword [0x75f870]
psubsb mm0, mm3
movq mm6, mm1
movq mm7, mm2
pxor mm6, qword [0x75f870]
pxor mm7, qword [0x75f870]
movq mm3, mm7
psubsb mm7, mm6
paddsb mm0, mm7
paddsb mm0, mm7
paddsb mm0, mm7
pand mm5, mm0
paddsb mm5, qword [0x75f8a0]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm7, mm5
psraw mm7, 0xb
psllw mm7, 8
por mm0, mm7
psubsb mm3, mm0
pxor mm3, qword [0x75f870]
psubsb mm5, qword [0x75f880]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x75f870]
movq mm0, qword [esp]
movq mm4, qword [esp + 0x10]
movq mm1, mm0
punpcklbw mm0, mm6
punpckhbw mm1, mm6
movq mm2, mm3
punpcklbw mm2, mm4
movq mm5, mm1
punpckhbw mm3, mm4
movq mm6, mm0
punpcklwd mm0, mm2
punpckhwd mm6, mm2
movd dword [esi + eax*4], mm0
punpcklwd mm1, mm3
psrlq mm0, 0x20
punpckhwd mm5, mm3
movd dword [edi + eax*4], mm0
movd dword [esi + eax*2], mm6
psrlq mm6, 0x20
movd dword [esi], mm1
movd dword [esi + eax], mm6
neg eax
movd dword [esi + eax*2], mm5
psrlq mm1, 0x20
movd dword [edi], mm1
psrlq mm5, 0x20
movd dword [edi + eax*2], mm5
lea esi, [esi + eax*8]
dec ecx
jne 0x5c2fd3
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x5d6c56
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6a4108]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.005d0cbf
mov dword [ebp - 0x14], eax
cmp dword [0x75bfd0], edi
jne 0x5d6d47
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x5d6cd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5d6e27
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x5d6e27
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5d6e27
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x75bfd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x75bfd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x75bfd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x75bfe0], eax
test eax, eax
je 0x5d6d44
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x75bfdc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5d6d6c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5d6d5f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x5d6d81
push 4
pop eax
jmp 0x5d6e29
cmp dword [ebp - 0x14], edi
je 0x5d6d81
push dword [0x75bfd0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5d6d66
mov eax, dword [0x75bfdc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x5d6ddf
cmp dword [0x75bfe0], esi
je 0x5d6ddf
push eax
call ebx
push dword [0x75bfe0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5d6ddf
test eax, eax
je 0x5d6ddf
call ecx
test eax, eax
je 0x5d6dd4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5d6dd4
test byte [ebp - 8], 1
jne 0x5d6ddf
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x5d6e0f
mov eax, dword [0x75bfd4]
cmp eax, esi
je 0x5d6e0c
push eax
call ebx
test eax, eax
je 0x5d6e0c
call eax
mov edi, eax
test edi, edi
je 0x5d6e0c
mov eax, dword [0x75bfd8]
cmp eax, esi
je 0x5d6e0c
push eax
call ebx
test eax, eax
je 0x5d6e0c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x75bfd0]
call ebx
test eax, eax
je 0x5d6e27
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x5d6e29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c7124
leave
ret
Function at 0x5dc57d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.005ceeda
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x5dc5b5
xor eax, eax
jmp 0x5dc5e1
cmp esi, dword [ebp - 4]
je 0x5dc5de
cmp dword [ebp + 0xc], 0
je 0x5dc5de
push dword [edi + 0x9c]
call fcn.005dc18b
push dword [edi + 0x9c]
mov esi, eax
call fcn.005d6b7f
pop ecx
pop ecx
cmp esi, eax
je 0x5dc5b1
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x40193b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
xor esi, esi
call fcn.00407266
push eax
call fcn.00407429
sub byte [esi + 0x435a80], 0x79
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x9d
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x62
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x2a
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x58
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x85
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xaf
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x98
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0xfb
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0xfb
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x76
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xb
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xa5
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x5c
inc esi
pop ecx
cmp esi, 0x2b800
jb 0x401945
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a61
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, 0x14d
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x14], 0x10
jb 0x401a84
mov esi, dword [esi]
shr edi, 2
push esi
push edi
push str._x_and__p
mov dword [esp + 0x20], edi
call fcn.004010d6
add esp, 0xc
test edi, edi
je 0x401ae1
mov ebp, esi
push 4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0040a920
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x10], eax
sub edi, 1
jne 0x401aa0
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401b0a
sub eax, 1
je 0x401b00
sub eax, 1
jne 0x401b18
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret
Function at 0x10028ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008ea40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.10083f4a
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10029970
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10028b24
jmp dword [ecx*4 + 0x10028c8c]
mov al, byte [esi]
test al, al
je 0x10028b52
cmp al, 0x20
je 0x10028b3e
cmp al, 0xa1
jne 0x10028b52
cmp byte [esi + 1], al
jne 0x10028b52
test al, 0x80
je 0x10028b4a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10028b52
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10028b31
test ecx, ecx
je case.default.0x10028b24
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10028b24
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10028b98
cmp dl, 0xa1
jne 0x10028b8c
cmp byte [eax + 1], 0xa1
jne 0x10028b8c
test ecx, ecx
jne 0x10028b84
mov edi, eax
mov ecx, 1
inc eax
jmp 0x10028bac
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10028bc6
jmp 0x10028bac
cmp dl, 0x20
jne 0x10028baa
test ecx, ecx
jne 0x10028ba3
mov edi, eax
mov ecx, 1
jmp 0x10028bac
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10028b6c
cmp ecx, 1
jne case.default.0x10028b24
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10028b24
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10028b24
mov al, byte [esi]
test al, al
je 0x10028c1e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10028c04
mov cl, byte [esi + 1]
test cl, cl
je 0x10028c1e
cmp al, 0xa1
jne 0x10028bf4
cmp cl, al
je 0x10028c01
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10029c40
inc esi
jmp 0x10028c16
cmp al, 0x20
je 0x10028c16
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10029c80
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10028bdd
push 0
lea ecx, [esp + 0x14]
call fcn.10029c80
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100355e0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10028c51
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100af7d0
call fcn.10029b70
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10083edc
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1002fcb0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1008f05b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.10083c51
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1002fd32
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100819d0
mov eax, dword [eax]
push 0x100bf220
push eax
call fcn.10074624
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.10083edc
test bl, bl
je 0x1002fd32
push 0x100bf220
lea ecx, [esp + 0xc]
call fcn.1008426c
push 0x100c2d7c
lea ecx, [esp + 0xc]
call fcn.1008426c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1002fd6e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.10083edc
jmp 0x1002fe39
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1002fdf2
lea edx, [esp + 0x7c]
push 0x100c2d78
push edx
call fcn.10074624
add esp, 8
test eax, eax
je 0x1002fdf2
lea eax, [esp + 0x7c]
push 0x100c2d74
push eax
call fcn.10074624
add esp, 8
test eax, eax
je 0x1002fdf2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002fd82
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.10083edc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10030630
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10030692
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc