joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9e75d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
add cl, bl
xchg dx, ax
lea eax, [edx + ebp]
call fcn.009e7634
pop es
xchg dh, al
dec eax
jbe 0x9e79b8
ja 0x9e79b8
mov byte [0x34c5a22c], al
cmp dword [ecx - 0x752d0468], 0xffffffc4
cmc
ja 0x9e76d7
push edx
mov byte [esp + 2], ch
jmp 0x9e76b7
pop eax
not dl
btr eax, ebx
js 0x9e76ba
jns 0x9e76c1
push esp
les ebx, [edx + 0x3d]
int3
cmc
lea esp, [esp + 0x10]
inc dl
xchg al, ah
jmp 0x9e7687
pop eax
jmp 0x9e7696
clc
jmp 0x9e76de
clc
xchg al, ah
xchg al, ah
btc eax, edi
mov eax, 0x9d18a024
jmp 0x9e76f0
push edx
mov byte [esp + 2], ch
jmp 0x9e7695
xchg al, ah
xchg al, ah
btc eax, edi
jmp 0x9e76eb
mov eax, 0x9d18a024
mov eax, 0x7a94796c
jmp 0x9e77ca
bsf ax, si
sub esp, 0x10
jmp 0x9e76ac
lea eax, [eax + 0xd9]
rol ax, cl
jmp 0x9e7751
bsf ax, si
lea eax, [esi*4]
mov al, byte [esp]
mov al, byte [esp]
rol eax, 0x1d
jmp 0x9e7767
mov al, 0xa0
not ax
mov al, 0x32
jmp 0x9e772d
inc dl
inc al
jno 0x9e7798
mov ax, word [esp]
jmp 0x9e7782
jb 0x9e770e
lea eax, [eax + 0xd9]
rol ax, cl
jmp 0x9e7717
not eax
jmp 0x9e7748
rcl eax, 0x15
shl ax, cl
not al
jmp 0x9e77a4
mov ax, word [esp]
rcl eax, 0x15
shl ax, cl
not al
jmp 0x9e7808
mov ax, word [esp]
jmp 0x9e77b0
push esp
setle al
lea esp, [esp + 3]
jmp 0x9e77e3
add dl, 0xc6
not eax
jne 0x9e777e
not eax
mov al, 0xa0
not ax
mov al, 0x32
bsf ax, si
jmp 0x9e7731
mov al, ah
not ah
mov ax, word [esp]
mov eax, dword [esp]
setg ah
jmp 0x9e7943
neg dl
setbe al
dec eax
jg 0x9e77a6
mov ax, word [esp]
push esp
setle al
lea esp, [esp + 3]
mov al, ah
jmp 0x9e77e5
dec ax
jg 0x9e7705
bsf ax, si
sub esp, 0x10
cmc
jmp 0x9e76ad
mov eax, 0xa4a096e
mov ax, 0x75e1
inc ebp
call 0x9e784f
inc ebp
jmp 0x9e7883
mov ax, 0x243d
jmp 0x9e783f
mov dx, bx
xchg dh, al
call fcn.009e7893
xor dword [eax + 0x4b04126], esi
sub dword [ebp + 0x4b7443d], ebp
cmp al, 0x66
not edx
not dx
jbe 0x9e786c
mov dx, bx
xchg dh, al
jmp 0x9e795c
mov byte [esp + 0x14], ah
jmp 0x9e799b
add bl, dl
xor ax, 0xb67a
jl 0x9e7866
mov ax, 0x243d
mov eax, 0xa4a096e
mov ax, 0x75e1
jmp 0x9e7848
mov al, 0xec
lea esp, [esp + 1]
jmp 0x9e78ca
add esp, 0
jl 0x9e7916
mov al, 0xec
lea esp, [esp + 1]
jmp 0x9e78ca
sub esp, 0x16
bswap eax
mov word [esp + 0xe], sp
jmp 0x9e78b5
lea esp, [esp + 0x14]
rol cl, 0
lea eax, [esp + ebp]
mov dh, 0xa2
lea edx, [eax - 0x117e5b4f]
jmp 0x9e79e7
xchg byte [esp + 6], dl
lea esp, [esp + 2]
jmp 0x9e797a
mov dl, cl
mov ax, word [esp]
jmp 0x9e782a
rcr dh, 5
jmp 0x9e79cc
mov dx, sp
mov ax, sp
mov al, ah
jmp 0x9e7a00
xchg dh, dl
xchg edx, eax
inc dl
jb 0x9e79c3
rcr dh, 5
mov dx, sp
mov ax, sp
mov al, ah
call fcn.009e7b0d
jmp dword [esi - 0x75]
mov dx, word [esp]
call fcn.009e7aa5
lea edx, [eax + 0x5c639819]
setbe ah
mov edx, 0x4a6e2308
mov ax, sp
lea edx, [ecx*4]
jmp 0x9e7a8c
sub cl, 0x3e
bswap edx
call fcn.009e7ac8
ret 0xca54

Function at 0x9e7ac8
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bsf ax, ax
jo 0x9e7aeb
pop dx
lea edx, [ecx + 0x93]
jmp 0x9e7aed
jmp 0x9e7b17
lea esp, [esp + 1]
mov edx, 0x49a7e31a
mov dx, 0x925d
jmp 0x9e7b2c
Function at 0x9e7b0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x2763abf
jmp 0x9e7e39
mov edx, dword [esp]
mov edx, esi
call fcn.009e7ae0
pop dx
lea edx, [ecx + 0x93]
lea esp, [esp + 1]
mov edx, 0x49a7e31a
mov dx, 0x925d
xchg ah, dh
jmp 0x9e7b79
lea esp, [esp + 1]
jmp 0x9e7b61
mov byte [esp], bh
jmp 0x9e7b46
ror cl, 0
sub esp, 0xe
jge 0x9e7b8a
mov word [esp + 0xa], dx
mov dh, byte [esp + 5]
jmp 0x9e7b94
mov dh, bh
bswap edx
inc dl
jl 0x9e7b5c
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x9e7b61
mov word [esp + 0xa], dx
jmp 0x9e7d90
mov dh, byte [esp + 5]
mov dx, 0xc4c7
pop word [esp + 1]
call fcn.009e7c55
pop ss
jle 0x9e7bf2
call 0xde29acbd
scasd eax, dword es:[edi]
xor dword [ecx - 0x5079cc40], esp
xor ah, byte [eax - 0x4c79cd39]
dec dx
call fcn.009e7bda
not eax
jl 0x9e7d64
neg dh
pop dword [esp + 2]
jmp 0x9e7cba
pushal
bswap eax
xchg edx, edi
mov dword [esp + 0x14], ecx
bsr ax, cx
jbe 0x9e7c95
clc
jmp 0x9e7cf6
jo 0x9e7c8b
push dword [esp + 0xe]
mov dh, byte [esp + 7]
jmp 0x9e7c93
push dword [esp + 0xe]
mov dh, byte [esp + 7]
jmp 0x9e7c57
call fcn.009e7cd7
lea eax, [ebp*4]
popal
mov al, ah
mov eax, 0x673f9652
bt eax, esp
btc eax, ebx
jmp 0x9e7df4
lea esp, [esp + 2]
jmp 0x9e7d17
lea eax, [ebp*4]
popal
mov al, ah
jmp 0x9e7dd3
lea esp, [esp + 2]
lea esp, [esp + 8]
xor cl, 0x5a
mov edx, dword [esp]
sub esp, 0x10
jmp 0x9e7c72
neg dh
pop dword [esp + 2]
jmp 0x9e7d13
mov dh, byte [esp + 5]
mov dh, byte [esp + 5]
mov dx, 0xc4c7
pop word [esp + 1]
push word [esp + 1]
jmp 0x9e7c06
bsf ax, ax
jmp 0x9e7ddd
shl edx, 2
pushal
lea esp, [esp + 0x20]
bt eax, edx
setne al
mov al, ah
jmp 0x9e7f0b
mov eax, 0x673f9652
jmp 0x9e7ca9
jno 0x9e7db5
shl edx, 2
pushal
jmp 0x9e8095
add byte [ebx + 0x2ddebb2b], ch
pushfd
into
pop ecx
mov eax, 0x7fedf29b
mov ch, 0x7e
mov bl, 0xf1
jg 0x9e7dab
jle 0x9e7dab
int1
jle 0x9e7de7
mov eax, dword [esi - 0x3cac3ec9]
cmpsb byte [esi], byte es:[edi]
push ebp
loopne 0x9e7e5e
aam 0x4a
sub eax, 0x80c118dc
inc ebx
mov edx, dword [edx - 0x1d7aeca]
mov al, 0xb8
call fcn.009e7e1e
mov al, 0x24
shl ax, cl
jl 0x9e7f7e
jge 0x9e7f38
int3
test eax, 0x6aab5839
dec eax
add edx, 0x339236e3
call fcn.009e7e98
jmp [edi - 1]
jmp 0x9e7285
shl ax, cl
jns 0x9e7ecf
js 0x9e7285
setbe al
dec ax
cmc
jmp 0x9e7f3f
cmc
jmp 0x9e7f3f
sub esp, 0x1c
bswap eax
jmp 0x9e7f83
push edx
ret
jns 0x9e7f16
setbe al
dec ax
jmp 0x9e7f22
sub esp, 0x1c
bswap eax
mov esp, edi
bsf ax, ax
jmp 0x9e7f67
lea esp, [esp + 0x20]
bt eax, edx
setne al
jmp 0x9e7dc3
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push 0x411d58
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x411d5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011d2
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411dfc
push 0x411e0c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e1c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dcc
push 0x411dec
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4011f1
lea eax, [esp + 4]
push eax
push 0x411dcc
push 0x411dec
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411ddc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40345b
pop dword [ebp - 0x18]
mov eax, 0x26d51495
add eax, 0xd96b1fc6
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x714361b9
sub dword [ebp - 0x28], 0x22f11c6e
mov dword [ebp - 0x24], 0x46222708
add dword [ebp - 0x24], 0xec11253d
mov dword [ebp - 0x20], 0x151b12fa
sub dword [ebp - 0x20], 0xc8cececc
mov dword [ebp - 0x1c], 0x5f0a63aa
sub dword [ebp - 0x1c], 0x5f0a63aa
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x20cf7852
sub dword [ebp - 0x28], 0xac5d0efc
mov dword [ebp - 0x24], 0x6cf87526
add dword [ebp - 0x24], 0xd473ec4f
mov dword [ebp - 0x20], 0x2e367b74
sub dword [ebp - 0x20], 0xcac70f08
mov dword [ebp - 0x1c], 0xe58196d8
add dword [ebp - 0x1c], 0x1a7e6928
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3843b
push 0
call eax
mov ecx, 0x6fbcc556
add ecx, 0x90438843
mov ebx, eax
mov esi, 0x408400
add esi, dword [ebp - 0x18]
mov edx, 0xee65202c
sub edx, 0xb0276110
sub dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 0x10], 0xdf4808e3
add edi, edx
add dword [ebp - 0x14], 0xcc81b88d
mov dword [ebx], edi
xor dword [ebp - 4], 0x29da55c0
add ebx, 4
add esi, 0xb03b58b2
add esi, 0x4fc4a752
loop 0x40356d
add eax, 0x12937
mov ebx, eax
add eax, 0xd0cc6ed0
sub eax, 0xd0cc6ecb
mov ecx, 0xf3d8d235
add ecx, 0xc672dcb
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4016e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494ca3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x4a71e4]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4a71c8]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [0x4a71e4]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x4a71e0]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x401760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494ca3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x4a71d4]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4a71c8]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [0x4a71e4]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x4a71e0]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4017e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494ca3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x4a71e4]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4a71d0]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [0x4a71e4]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x4a71e0]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x42f1f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49a19c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
lea eax, [edi + 8]
push eax
lea ecx, [esi + 8]
mov dword [esp + 0xc], esi
mov dword [esi], 0x4a8eac
call dword [0x4a71e4]
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
add edi, 0x38
mov dword [esi + 0x34], ecx
push edi
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], 0
call fcn.0041dfb0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x444530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49cda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
push esi
mov ecx, edi
call dword [0x4a7520]
lea eax, [esi + 4]
push eax
mov ecx, edi
call dword [0x4a7520]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [0x4a75b4]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00421a20
mov eax, dword [esi + 0xc]
test eax, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], edx
pop edi
mov dword [esi + 0x14], ecx
pop esi
je 0x4445c1
push eax
call fcn.004941a0
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x45b220
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x45c820
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49ebc9
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x14]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esp + 0x10], 0
mov dword [esi], eax
call dword [0x4a71e4]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call dword [0x4a71e0]
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x24

Function at 0x45c835
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49ebc9
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x14]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esp + 0x10], 0
mov dword [esi], eax
call dword [0x4a71e4]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call dword [0x4a71e0]
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x24

Function at 0x45ccf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49ec81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov dword [esp + 8], 0
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
cmp esi, edi
mov dword [esp + 0x14], 1
je 0x45cd44
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call dword [0x4a71e4]
lea ecx, [esp + 0x44]
call fcn.0045cb50
add esi, 0x1c
cmp esi, edi
jne 0x45cd24
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esi], eax
call dword [0x4a71e4]
lea ecx, [esp + 0x30]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call dword [0x4a71e0]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret
Function at 0x475720
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x30
mov eax, dword [0x4dde70]
mov dword [esp + 0x2c], eax
push ebp
push edi
xor eax, eax
mov byte [esp + 0xc], 0
mov ecx, 9
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x475804
mov ecx, dword [esp + 0x40]
test ecx, ecx
jle 0x475804
mov ebp, dword [esp + 0x44]
test ebp, ebp
je 0x475804
cmp byte [eax], 0x22
jne 0x475770
inc eax
sub ecx, 2
cmp byte [eax], 0x3d
jne 0x47583b
cmp byte [eax + 1], 0x3f
jne 0x47583b
cmp byte [eax + ecx - 1], 0x3d
jne 0x47583b
cmp byte [eax + ecx - 2], 0x3f
jne 0x47583b
mov cl, byte [eax + 2]
add eax, 2
cmp cl, 0x3f
mov edi, eax
je 0x4757af
mov cl, byte [edi + 1]
inc edi
cmp cl, 0x3f
jne 0x4757a6
push esi
mov esi, edi
sub esi, eax
push esi
push eax
lea eax, [esp + 0x18]
push eax
call dword [0x4a727c]
mov dl, byte [edi + 1]
lea eax, [edi + 1]
add eax, 2
add esp, 0xc
cmp byte [eax], 0x3f
mov byte [esp + esi + 0x10], 0
mov ecx, eax
pop esi
je 0x4757e6
lea ebx, [ebx]
inc ecx
cmp byte [ecx], 0x3f
jne 0x4757e0
cmp dl, 0x42
je 0x475816
cmp dl, 0x62
je 0x475816
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x10]
call 0x4917e0
test eax, eax
mov dword [ebp], eax
jne 0x47582a
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x2c]
call fcn.0049446e
add esp, 0x30
ret
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x10]
call 0x491670
test eax, eax
mov dword [ebp], eax
je 0x475804
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
call fcn.0049446e
add esp, 0x30
ret
mov ecx, dword [esp + 0x34]
pop edi
mov eax, 1
pop ebp
call fcn.0049446e
add esp, 0x30
ret

Function at 0x476cf6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a06c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
xor edi, edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esp + 8], esi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], edi
mov dword [esi], 0x4ba0fc
call dword [0x4a71b8]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call dword [0x4a71b8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x476d68
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a0750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
or eax, 0xffffffff
xor ebp, ebp
mov dword [esi + 8], eax
mov dword [esi + 4], eax
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0xc], ebp
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esp + 0x1c], ebp
mov dword [esi], 0x4ba0fc
call dword [0x4a71b8]
lea ebx, [esi + 0x30]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call dword [0x4a71b8]
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
mov byte [esp + 0x20], 2
call dword [0x4a71cc]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebx
call dword [0x4a71cc]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], ebp
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x434080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x434098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x434176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x434171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43414a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43414a
xor eax, eax
jmp 0x434176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43408f
mov esp, ebp
pop ebp
ret

Function at 0x434a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x434a85
xor eax, eax
jmp 0x434a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret
Function at 0x40622b
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004063db
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x406329
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4062cc
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40630f
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4062e3
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4062fe
test al, 0x40
je 0x4062f5
mov ecx, dword [edi + 0x20]
jmp 0x4062fc
test al, 0x80
je 0x40630f
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40630f
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40629b
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40e700
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46db6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004624c2
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e782
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046030d
mov eax, dword [eax]
push 0x4a71f0
push eax
call fcn.00452834
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046274d
test bl, bl
je 0x40e782
push 0x4a71f0
lea ecx, [esp + 0xc]
call fcn.00462add
push 0x4aad70
lea ecx, [esp + 0xc]
call fcn.00462add
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e7be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046274d
jmp 0x40e889
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e842
lea edx, [esp + 0x7c]
push 0x4aad6c
push edx
call fcn.00452834
add esp, 8
test eax, eax
je 0x40e842
lea eax, [esp + 0x7c]
push 0x4aad68
push eax
call fcn.00452834
add esp, 8
test eax, eax
je 0x40e842
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e7d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046274d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f080
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f0e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc