joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64732e34
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x64732ed2
mov eax, dword [ebx]
mov byte [eax + 0x16], 0
mov eax, dword [ebx]
mov byte [eax + 0x17], 0
mov eax, dword [ebx]
mov byte [eax + 0x18], 0
mov eax, dword [ebx]
mov byte [eax + 0x19], 0
mov ebp, dword [ebx + 4]
mov esi, dword [ebx]
test ebp, ebp
jle 0x64732ed7
mov edx, esi
add ebp, esi
xor eax, eax
nop
mov edi, eax
shl edi, 8
movzx ecx, byte [edx]
shr eax, 0x18
xor ecx, eax
mov eax, dword [ecx*4 + 0x64813ac0]
xor eax, edi
inc edx
cmp edx, ebp
jne 0x64732e6c
mov edx, eax
shr edx, 0x18
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x64732eb8
mov edx, dword [ebx + 8]
add ebp, edx
mov edi, eax
shl edi, 8
movzx ecx, byte [edx]
shr eax, 0x18
xor ecx, eax
mov eax, dword [ecx*4 + 0x64813ac0]
xor eax, edi
inc edx
cmp edx, ebp
jne 0x64732e98
mov edx, eax
shr edx, 0x18
mov byte [esi + 0x16], al
mov esi, dword [ebx]
mov ecx, eax
shr ecx, 8
mov byte [esi + 0x17], cl
mov ecx, dword [ebx]
shr eax, 0x10
mov byte [ecx + 0x18], al
mov eax, dword [ebx]
mov byte [eax + 0x19], dl
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
xor eax, eax
jmp 0x64732e8c

Function at 0x64733298
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
test eax, eax
je 0x647332d8
mov ecx, dword [eax]
test ecx, ecx
je 0x647332d8
mov ecx, dword [eax + 0x148]
test ecx, ecx
jne 0x647332dc
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x647332ca
mov ecx, dword [eax + 0x14c]
test ecx, ecx
je 0x647332e3
xor ecx, ecx
mov dword [esp + 8], ebx
pop ebx
jmp fcn.647326bc
xor eax, eax
pop ebx
ret
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x647332ca
mov ecx, 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.647326bc
Function at 0x64750cb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
test eax, eax
je 0x64750ce0
cmp dword [eax + 0x14], 0
je 0x64750ce8
fstp dword [esp + 8]
fstp dword [esp + 4]
jmp fcn.64745d50
fstp st(0)
fstp st(0)
jmp 0x64750cec
fstp st(0)
fstp st(0)
xor eax, eax
ret
Function at 0x64753604
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
fld dword [esp + 0x18]
test eax, eax
je 0x64753638
cmp dword [eax + 0x14], 0
je 0x64753640
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fstp dword [esp + 4]
jmp fcn.64747cbc
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64753646
fstp st(0)
fstp st(0)
fstp st(0)
xor eax, eax
ret
Function at 0x64756ec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
test eax, eax
je 0x64756ef0
cmp dword [eax + 0x14], 0
je 0x64756ef8
fstp dword [esp + 8]
fstp dword [esp + 4]
jmp fcn.6474aed0
fstp st(0)
fstp st(0)
jmp 0x64756efc
fstp st(0)
fstp st(0)
xor eax, eax
ret
Function at 0x64761ec8
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
fld dword [esp + 0x18]
fld dword [esp + 0x1c]
cmp ebx, 8
je 0x64761f4c
cmp ebx, 0x10
je 0x64761f30
test eax, eax
je 0x64761f04
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x64761f0c
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.64745d50
fstp st(0)
fstp st(0)
jmp 0x64761f2c
fstp st(0)
fstp st(0)
jmp 0x64761f2c
fstp st(0)
fstp st(0)
jmp 0x64761f2c
fstp st(0)
fstp st(0)
jmp 0x64761f2c
fstp st(0)
fstp st(0)
jmp 0x64761f2c
fstp st(0)
fstp st(0)
xor eax, eax
pop ebx
ret
test eax, eax
je 0x64761f14
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x64761f1c
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.6474aed0
test eax, eax
je 0x64761f22
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x64761f28
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.6474f1e0

Function at 0x64761f68
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
fld dword [esp + 0x18]
fld dword [esp + 0x1c]
fld dword [esp + 0x20]
fstp dword [esp + 0x1c]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
cmp eax, 8
je 0x64761fb8
cmp eax, 0x10
je 0x64761fb0
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_1_2
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_16_1_2
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_8_1_2

Function at 0x64761fc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
fld dword [esp + 0x18]
fld dword [esp + 0x1c]
fld dword [esp + 0x20]
cmp ebx, 8
je 0x64762058
cmp ebx, 0x10
je 0x64762038
test eax, eax
je 0x64762004
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x6476200c
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.64747cbc
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64762034
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64762034
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64762034
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64762034
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x64762034
fstp st(0)
fstp st(0)
fstp st(0)
nop
xor eax, eax
pop ebx
ret
test eax, eax
je 0x64762014
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x6476201c
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.6474c8bc
test eax, eax
je 0x64762024
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x6476202c
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
pop ebx
jmp fcn.647430f8
Function at 0x64762078
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
fld dword [esp + 0x18]
fld dword [esp + 0x1c]
fld dword [esp + 0x20]
fstp dword [esp + 0x1c]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
cmp eax, 8
je 0x647620c8
cmp eax, 0x10
je 0x647620c0
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_2_2
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_16_2_2
pop ebx
jmp sym.allegro_5.0.10_monolith_mt.dll_dumb_resample_8_2_2
Function at 0x64765bc4
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jle 0x647658fd
push ebp
push edi
push esi
push ebx
sub esp, 0x100
mov dword [esp + 0x80], 0xedb88320
lea ebx, [esp + 0x84]
lea edi, [esp + 0x100]
mov esi, 1
mov dword [ebx], esi
shl esi, 1
add ebx, 4
cmp ebx, edi
jne 0x647657e0
xor ebp, ebp
lea esi, [esi]
mov ebx, dword [esp + ebp*4 + 0x80]
xor edi, edi
test ebx, ebx
je 0x64765812
lea esi, [esp + 0x80]
test bl, 1
je 0x6476580b
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x64765804
mov dword [esp + ebp*4], edi
inc ebp
cmp ebp, 0x20
jne 0x647657f0
xor bp, bp
nop
mov ebx, dword [esp + ebp*4]
xor edi, edi
test ebx, ebx
je 0x6476583a
mov esi, esp
nop
test bl, 1
je 0x64765833
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x6476582c
mov dword [esp + ebp*4 + 0x80], edi
inc ebp
cmp ebp, 0x20
jne 0x64765820
xor ebp, ebp
lea esi, [esi]
mov ebx, dword [esp + ebp*4 + 0x80]
xor edi, edi
test ebx, ebx
je 0x6476586e
lea esi, [esp + 0x80]
test bl, 1
je 0x64765867
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x64765860
mov dword [esp + ebp*4], edi
inc ebp
cmp ebp, 0x20
jne 0x6476584c
test cl, 1
je 0x64765893
test eax, eax
je 0x64765893
xor esi, esi
mov ebx, esp
test al, 1
je 0x6476588a
xor esi, dword [ebx]
add ebx, 4
shr eax, 1
jne 0x64765884
mov eax, esi
mov ebp, ecx
sar ebp, 1
je 0x647658f1
xor edi, edi
nop
mov ecx, dword [esp + edi*4]
xor esi, esi
test ecx, ecx
je 0x647658b6
mov ebx, esp
nop
test cl, 1
je 0x647658af
xor esi, dword [ebx]
add ebx, 4
shr ecx, 1
jne 0x647658a8
mov dword [esp + edi*4 + 0x80], esi
inc edi
cmp edi, 0x20
jne 0x6476589c
test ebp, 1
je 0x647658e7
test eax, eax
je 0x647658e7
xor ebx, ebx
lea ecx, [esp + 0x80]
test al, 1
je 0x647658de
xor ebx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x647658d8
mov eax, ebx
mov ecx, ebp
sar ecx, 1
jne 0x64765847
xor eax, edx
add esp, 0x100
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x647657b0

Function at 0x64765bd8
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x647657b0
Function at 0x64767fb4
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
push esi
push ebx
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0x40000000]
cmp eax, 0x3fffffff
ja 0x64767fca
mov ecx, eax
cmp eax, 0x40000000
sbb eax, eax
not eax
and eax, 0x80000000
shr eax, 1
lea ebx, [eax + 0x10000000]
mov edx, ecx
sub edx, ebx
lea esi, [eax + 0x20000000]
cmp ecx, ebx
jae 0x64767ff0
mov edx, ecx
cmp ecx, ebx
jb 0x64767ff6
mov eax, esi
shr eax, 1
lea ebx, [eax + 0x4000000]
mov ecx, edx
sub ecx, ebx
lea esi, [eax + 0x8000000]
cmp edx, ebx
jae 0x6476800e
mov ecx, edx
cmp edx, ebx
jae 0x6476818c
mov ebx, eax
shr ebx, 1
lea eax, [ebx + 0x1000000]
mov edx, ecx
sub edx, eax
lea esi, [ebx + 0x2000000]
cmp ecx, eax
jae 0x64768030
mov edx, ecx
cmp ecx, eax
jb 0x64768036
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x400000]
mov eax, edx
sub eax, ecx
lea esi, [ebx + 0x800000]
cmp edx, ecx
jae 0x6476804e
mov eax, edx
cmp edx, ecx
jb 0x64768054
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x100000]
mov edx, eax
sub edx, ecx
lea esi, [ebx + 0x200000]
cmp eax, ecx
jae 0x6476806c
mov edx, eax
cmp eax, ecx
jb 0x64768072
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x40000]
mov eax, edx
sub eax, ecx
lea esi, [ebx + 0x80000]
cmp edx, ecx
jae 0x6476808a
mov eax, edx
cmp edx, ecx
jb 0x64768090
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x10000]
mov edx, eax
sub edx, ecx
lea esi, [ebx + 0x20000]
cmp eax, ecx
jae 0x647680a8
mov edx, eax
cmp eax, ecx
jb 0x647680ae
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x4000]
mov eax, edx
sub eax, ecx
lea esi, [ebx + 0x8000]
cmp edx, ecx
jae 0x647680c6
mov eax, edx
cmp edx, ecx
jb 0x647680cc
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x1000]
mov edx, eax
sub edx, ecx
lea esi, [ebx + 0x2000]
cmp eax, ecx
jae 0x647680e4
mov edx, eax
cmp eax, ecx
jb 0x647680ea
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x400]
mov eax, edx
sub eax, ecx
lea esi, [ebx + 0x800]
cmp edx, ecx
jae 0x64768102
mov eax, edx
cmp edx, ecx
jb 0x64768108
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x100]
mov edx, eax
sub edx, ecx
lea esi, [ebx + 0x200]
cmp eax, ecx
jae 0x64768120
mov edx, eax
cmp eax, ecx
jb 0x64768126
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x40]
mov eax, edx
sub eax, ecx
lea esi, [ebx + 0x80]
cmp edx, ecx
jae 0x6476813b
mov eax, edx
cmp edx, ecx
jb 0x64768141
mov ebx, esi
shr ebx, 1
lea ecx, [ebx + 0x10]
mov edx, eax
sub edx, ecx
lea esi, [ebx + 0x20]
cmp eax, ecx
jae 0x64768153
mov edx, eax
cmp eax, ecx
jae 0x64768188
mov eax, ebx
shr eax, 1
lea ecx, [eax + 4]
mov esi, edx
sub esi, ecx
lea ebx, [eax + 8]
cmp edx, ecx
jb 0x6476816b
mov eax, ebx
shr eax, 1
lea ebx, [eax + 1]
lea edi, [eax + 2]
cmp edx, ecx
jb 0x64768179
mov edx, esi
cmp ebx, edx
ja 0x6476817f
mov eax, edi
shr eax, 1
pop ebx
pop esi
pop edi
ret
mov eax, esi
jmp 0x64768159
mov ebx, esi
jmp 0x64768018
Function at 0x6476d868
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test eax, eax
je 0x6476d884
cmp dword [eax + 0x58], 0
je 0x6476d884
jmp fcn.6476d1f0
mov eax, 0x23
ret

Function at 0x6476d88c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
test ebx, ebx
je 0x6476d8d0
mov esi, dword [ebx + 0x5c]
test esi, esi
je 0x6476d8b8
mov eax, dword [esi + 0xc]
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x6476d8d0
mov ecx, edi
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.6476d1f0
mov eax, 0x23
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x6476f55c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
test ebx, ebx
je 0x6476f5d0
test eax, eax
je 0x6476f5d0
test byte [eax + 8], 8
je 0x6476f5d0
movzx edx, word [eax + 0x158]
cmp edx, dword [esp + 0x44]
jbe 0x6476f5d0
mov edx, dword [esp + 0x44]
lea ecx, [edx + edx*4]
mov edx, dword [eax + 0x168]
lea esi, [edx + ecx*4]
movzx ecx, word [esi + 8]
mov ebp, dword [esi + 0x10]
test cx, cx
jne 0x6476f5e0
xor ecx, ecx
mov eax, dword [esi]
mov word [ebx], ax
mov ax, word [esi + 2]
mov word [ebx + 2], ax
mov eax, dword [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ecx
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 6
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
jne 0x6476f5a4
mov edx, dword [eax + 0x64]
mov dword [esp + 0x14], edx
mov eax, dword [eax + 0x68]
mov dword [esp + 0x18], eax
movzx edx, cx
test edx, edx
jle 0x6476f684
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 0x10], edx
call dword [ecx + 4]
mov dword [esp + 0x1c], eax
test eax, eax
mov edx, dword [esp + 0x10]
je 0x6476f672
mov edi, eax
xor eax, eax
mov ecx, edx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x1c]
mov ecx, edx
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
mov edi, dword [esi + 0xc]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x14]
test eax, eax
je 0x6476f68e
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], edx
call eax
test eax, eax
je 0x6476f6c1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x6476f672
mov dword [esp + 4], eax
mov edx, dword [esp + 0x14]
mov dword [esp], edx
call dword [edx + 8]
mov dword [esi + 0x10], 0
mov word [esi + 8], 0
jmp 0x6476f5a2
mov dword [esp + 0x1c], 0
jmp 0x6476f62b
mov edx, dword [esp + 0x18]
cmp edi, dword [edx + 4]
ja 0x6476f65d
mov dword [edx + 8], edi
movzx eax, word [esi + 8]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.allegro_5.0.10_monolith_mt.dll_FT_Stream_Read
test eax, eax
jne 0x6476f65d
mov ebp, dword [esi + 0x10]
movzx ecx, word [esi + 8]
jmp 0x6476f5a4
mov edx, dword [esp + 0x18]
jmp 0x6476f697
Function at 0x647c670c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x647c6724
cmp dword [eax + 0x118], 0
jne 0x647c6720
jmp fcn.647c0148
ret
mov dword [eax + 0x118], 1
ret

Function at 0x647c6d14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 0x2d
je 0x647c6d30
cmp dword [eax + 0x118], 0
jne 0x647c6d2f
jmp fcn.647c0148
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ecx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x647c6d28
mov edx, dword [eax + 0x100]
xor ebx, ebx
jmp 0x647c6d67
mov esi, edx
inc edx
mov byte [eax + esi], cl
mov dword [eax + 0x100], edx
mov byte [eax + 0x104], cl
inc ebx
cmp edi, ebx
je 0x647c6d28
mov cl, byte [ebp + ebx]
cmp edx, 0xff
jne 0x647c6d50
mov byte [eax + 0xff], 0
mov edx, dword [eax + 0x10c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov dword [esp], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
call dword [eax + 0x108]
mov eax, dword [esp + 0x18]
inc dword [eax + 0x120]
mov edx, 1
xor esi, esi
mov cl, byte [esp + 0x1c]
jmp 0x647c6d53
Function at 0x647cb3b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x647cb3cc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x647cb47c
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x647cb470
cmp eax, 4
je 0x647cb470
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x647cb3c1
cmp eax, 4
je 0x647cb3c1
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.647cb364
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5f5112f6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6c834c07
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4057a2
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405a60
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4057e1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4237a8], eax
jmp 0x40596b
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4057fb
test eax, eax
je 0x405919
test bl, 2
je 0x405919
mov esi, 0x420d10
push edi
push esi
call fcn.00405fda
cmp dword [ebp + 8], 0
je 0x40581a
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405820
push edi
call fcn.004059b9
cmp byte [edi], 0
jne 0x40582e
cmp byte [0x420d10], 0x5c
jne 0x405839
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40590f
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.0040599d
cmp byte [eax], 0
je 0x40587f
cmp byte [ebp - 0x1c], 0
je 0x40587f
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405895
mov al, byte [esi + 1]
test al, al
je 0x4058ee
cmp al, 0x2e
jne 0x405895
cmp byte [esi + 2], 0
je 0x4058ee
push esi
push ebx
call fcn.00405fda
test byte [ebp - 0x14c], 0x10
je 0x4058ba
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4058ee
push dword [ebp + 0xc]
push edi
call fcn.004057a2
jmp 0x4058ee
push dword [ebp - 4]
push edi
call fcn.0040575a
test eax, eax
jne 0x4058e6
cmp dword [ebp - 4], eax
je 0x4058de
push edi
push 0xfffffffffffffff1
call fcn.00405101
push 0
push edi
call fcn.00405db9
jmp 0x4058ee
inc dword [0x4237a8]
jmp 0x4058ee
push edi
push 0xfffffffffffffff2
call fcn.00405101
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40585d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405919
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40596b
cmp dword [ebp - 0xc], esi
jne 0x40592d
inc dword [0x4237a8]
jmp 0x40596b
push edi
call fcn.004062dd
test eax, eax
je 0x40596b
push edi
call fcn.00405972
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040575a
test eax, eax
jne 0x405963
cmp dword [ebp - 4], esi
je 0x405925
push edi
push 0xfffffffffffffff1
call fcn.00405101
push esi
push edi
call fcn.00405db9
jmp 0x40596b
push edi
push 0xffffffffffffffe5
call fcn.00405101
pop edi
pop esi
pop ebx
leave
ret 8