joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c2ca0
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5c2cd8
jmp 0x5c2cbc
lea esp, [esp + 4]
jmp 0x5c2c83
jmp 0x5c2cf4
jmp 0x5c2d10
push ebx
jmp 0x5c2d2c
jmp 0x5c2d48
push ebp
jmp 0x5c2d64
jmp 0x5c2d80
push esi
jmp 0x5c2d9c
jmp 0x5f6d75
push edi
movzx edx, byte [eax]
shl edx, 8
jmp 0x5f6eac
movzx esi, byte [eax + 1]
jmp 0x5f6f47
xor edx, esi
jmp 0x5f6f82
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
jmp 0x5f754d
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x5cc620]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x5cc620]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5cc620]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x5cc620]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.005e3e13
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x5cc620]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x5cc620]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x5cc620]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5cc620]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x5cde48
jne 0x5f7614
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5c4de4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x5f950e
lea esp, [esp + 4]
jmp fcn.005f94f1
Function at 0x5f1aee
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
jmp 0x5f1b44
cmp word [ecx], ax
je 0x5f1b6e
xor eax, eax
pop ebp
ret
cmp dword [eax], 0x4550
jmp 0x5f1c4d
mov eax, dword [ecx + 0x3c]
add eax, ecx
jmp 0x5f1b50
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
jne 0x5f1b49
xor edx, edx
mov ecx, 0x10b
jmp 0x5f1bd0
Function at 0x64cecf
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub al, 0x80
dec ecx
push es
dec eax
dec esp
push 0x3a44d35f
cwde
fild word [ebx + esi*8 - 0x7d9fd980]
cwde
or edx, dword [edx + 0x7d]
out 0x25, eax
xchg esp, edx
aas
fistp word [esi]
jge 0x64a389
and eax, 0xdf3fd487
push ds
invalid
call 0x64a757
pop eax
sub eax, 0x64a757
cmp dword [eax + 0x5bc43d], 0
je 0x64a78c
lea esp, [esp + 8]
popal
jmp 0x64a3a0
inc dword [eax + 0x5bc43d]
push 0xd2d33487
add dword [esp], 0x2d880e7a
push 0
push 0
push 0xb6b7c6e4
add dword [esp], 0x49a37b5e
call fcn.005c99da
jmp 0x64ce0e
push eax
jmp 0x64a752
call 0x64ce13
add dword [esp], 0xffffe488
call fcn.005c7790
jmp 0x64ce51
call 0x64ce28
jmp 0x64cf36
call fcn.005c8dab
popal
jmp 0x64a3a0
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x64d009
call 0x64cecf
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x64cf2e
jb 0x64cee1
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
jmp 0x64ce5c
popal
je 0x64cf4a
inc ecx
arpl word [ebx + 0x65], sp
insb byte es:[edi], dx
jb 0x64cf4e
je 0x64cf5e
jb 0x64cf45
popal
bound ebp, qword [ebp + 0x41]
add byte [esi - 3], dh
insd dword es:[edi], dx
hlt
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x64a864
jmp 0x64cf41
inc edi
push esp
lds edx, [ebp + 0x3c]
iretd
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x64cf0a
sub eax, 0x10000
add dword [eax], eax
add bl, ch
int1
rol byte [eax - 0x2a], 1
jmp 0x64cf3a
inc eax
salc
mov cl, 0x40
out 0x98, eax
setg dl
or esp, edx
push edi
invalid
lodsd eax, dword [esi]
pop esp
mov dh, 0xf
cdq
or dword [eax - 0x65], ebp
jno 0x64cf46
dec ecx
fnstcw word [eax - 0x7fe511b5]
push ss
jno 0x64cef2
jno 0x64cfe8
in eax, dx
jge 0x64cf7b
test dword [ebx + 0xc], 0x9c6d0a94
or ch, byte [ebp - 0x64]
xor eax, 0xa4dd4dd6
push edi
ljmp 0x69c0
fisubr dword [ecx]
cld
popal
call 0x74ce96f
jbe 0x64cfeb
outsb dx, byte [esi]
or eax, edi
sbb al, 0xdc
push ecx
shl dword [eax + 0x6ae6b353], 0xf8
lahf
push 0xffffffffffffff83
cmp eax, 0x303bbfa0
inc esp
mov eax, dword [eax + 8]
push eax
jmp 0x64ce23
Function at 0x4b7a02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
call fcn.004b7881
and dword [ebx + reloc.WINMM.dll_midiStreamOut], ecx
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
js 0x4b7a72
add ch, al
pop esp
xchg esp, eax
add byte [eax], al
test edx, edi
adc dword [ebx], 0x76
test dword [edx], esi
invalid
mov dword [esp + 0x13], eax
lea esp, [esp + 0x1d]
lea esp, [esp + 2]
push edx
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x4b7b21
add byte [eax], al
add byte [ebp - 0x3b4d9fb3], dl
popal
pushal
jmp 0x4b7a5b
lea esp, [esp + 4]
jmp 0x5063cc
push 0x2527632
call fcn.004c0e82
Function at 0x4e15e6
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4e1614
xor edx, esi
bsf si, si
mov si, dx
lea esp, [esp + 4]
jmp 0x4e1661
xchg word [esp + 1], di
jmp 0x4e15e8
mov di, bx
not edi
xor edx, esi
lea edi, reloc.WINMM.dll_midiStreamOut
btc esi, ebx
jmp 0x4e183c
movzx esi, byte [eax + 3]
bswap edi
shl edx, 8
mov edi, 0xffc62946
mov edi, dword [esp]
jmp 0x4e163a
mov edi, ecx
jmp 0x4e17cd
xor edx, esi
movzx esi, byte [eax + 6]
neg di
mov di, bx
jmp 0x4e168d
movzx edx, byte [eax + 4]
neg bl
lea ebp, [ebp + 0x5f]
shl edx, 8
jmp 0x4e16a3
mov bx, word [esp]
mov bl, 0xae
xor edx, esi
mov bl, 0xbe
jmp 0x4e171a
mov dword [ecx + 4], edx
xchg ebx, edi
mov bx, 0xc01f
mov edx, dword [esp]
jmp 0x4e16fe
rcl ebp, 0x1d
and di, 0x1fb2
shl edx, 8
clc
lea edi, [eax + edx]
jmp 0x4e16ca
movzx edx, byte [eax + 8]
bswap edi
xchg di, bp
mov di, 0xce8b
jmp 0x4e17a4
movzx esi, byte [eax + 9]
neg bl
jmp 0x4e16d6
mov di, dx
bsr di, bp
movzx esi, byte [eax + 7]
lea edi, [eax*4]
mov di, word [esp]
jmp 0x4e16ed
movzx esi, byte [eax + 0xb]
bswap edi
jmp 0x4e176c
shl edx, 8
xor edx, esi
lea edi, [ebp - 0x27]
jmp 0x4e174b
shl edx, 8
xchg bh, bl
mov ebp, esi
setle bl
clc
jmp 0x4e17b0
mov edi, eax
dec ebp
movzx esi, byte [eax + 0xa]
sub esp, 0
cmc
jmp 0x4e1762
shl edx, 8
xor edx, esi
inc di
lea ebx, [eax + 1]
jmp 0x4e1785
xor edx, esi
movzx esi, byte [eax + 0xd]
btr ebp, edx
jmp 0x4e17fe
shl edx, 8
xor edx, esi
lea ebx, [edi + ebp]
clc
jmp 0x4e1733
movzx edx, byte [eax + 0xc]
bswap ebp
lea edi, [edx + ebx]
sub esp, 0xc
setle bl
jmp 0x4e1823
mov dword [ecx + 8], edx
setno bh
xchg bp, di
clc
inc bx
jmp 0x4e17db
mov bp, 0xa491
mov bl, bh
jmp 0x4e1882
shl edx, 8
xor edx, esi
setp bl
mov bx, word [esp]
jmp 0x4e180c
movzx esi, byte [eax + 5]
mov bx, 0x2cc9
mov bl, 0x22
mov dword [ecx], edx
jmp 0x4e16bc
xor edx, esi
not ebp
sub esp, 2
lea esp, [esp + 2]
jmp 0x4e1893
mov bl, byte [esp]
bswap edi
shl edx, 8
neg edi
jmp 0x4e184d
lea esp, [esp + 0xc]
movzx esi, byte [eax + 0xe]
setbe bl
movzx eax, byte [eax + 0xf]
jmp 0x4e1863
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x4e18a1
mov eax, edx
shr eax, 0x10
mov ebx, dword [esp]
setnp bl
jmp 0x4e18cd
rol bl, 7
sets bl
mov esi, 0xff
and eax, esi
jmp 0x4e18e0
mov bl, byte [esp]
inc bl
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0x4e193d
mov edi, edx
mov bl, 0xa
inc bx
mov ebp, 0xe41934a0
push esp
jmp 0x4e1e1e
xor eax, 0x1000000
xchg bl, bh
jmp 0x4e190a
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamOut]
clc
mov ebx, 0x24a64cf0
bswap edi
jmp 0x4e1926
shr edi, 8
setl bl
inc ebp
btr ebp, edx
call fcn.004e1b31
lea esi, [esi + 0x18]
mov dword [esi], ecx
pop esi
neg dh
mov dx, word [esp]
jmp 0x4e1ec0
mov word [esp + 0xa], dx
lea esp, [esp + 2]
lea esp, [esp + 0x30]
cmp ebx, 0x4bf400
call fcn.004e1ecc
test byte [edx], bl
mov bh, ch
sbb ch, byte [ecx - 0x23b22d05]
das
xor edx, ecx
mov dword [eax + 0x1c], edx
sub esp, 0x1e
cmc
mov dword [esp + 0x17], ebp
jmp 0x4e1e7f
inc edx
mov edx, 0xa16d678
mov edx, dword [eax + 0xc]
push esp
jmp 0x4e1ea2
Function at 0x4e1a58
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, 0xec67229c
lea edx, [ebp - 0x17]
mov eax, edi
lea edi, [ebx*4]
jmp 0x4e1c9c
and eax, 0xff000000
stc
lea ebp, [edx + ebx]
mov ebp, 0xc2b0cdce
jmp 0x4e1983
xor eax, edi
lea edi, [esi*4]
jmp 0x4e19bd
mov bp, 0x23ab
xchg word [esp + 1], bp
add esp, 1
lea esp, [esp + 3]
jmp 0x4e1956
mov edi, edx
lea ebp, [edx*4]
push esp
lea ebp, [edx + edx]
xchg word [esp + 1], bp
jmp 0x4e1a0c
xor eax, edi
stc
rcl edi, 0x1d
bswap ebp
jmp 0x4e1a4d
shr edi, 0x18
rcr ebp, 5
mov ebp, dword [esp]
call fcn.004e19ec
lea esp, [esp + 8]
movzx edi, byte [edi*4 + 0x4bdbd8]
btr ebp, edx
jmp 0x4e19f2
mov edi, edx
lea ebp, [esp + ebp]
call 0x4e1a58
xchg byte [esi - 0x71], ah
add al, 0x24
lea ebp, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 2]
jmp 0x4e1ae5
and edi, ebp
sub esp, 0x1c
jmp 0x4e1b14
sub esp, 0x1e
jmp 0x4e1a7e
lea esp, [esp + 4]
mov ebp, 0xff00
sub esp, 0x18
sub esp, 0
pop word [esp + 0x11]
jmp 0x4e1a94
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
bswap ebp
mov ebp, 0x352993ba
jmp 0x4e1aab
and edi, esi
lea ebp, reloc.WINMM.dll_midiStreamOut
push edx
mov byte [esp + 1], ch
jmp 0x4e1acb
lea edi, [ecx + 0x10]
cmc
pushal
push dword [esp + 0xc]
push word [esp + 5]
jmp 0x4e1da0
xor eax, edi
lea esp, [esp + 0x50]
xor eax, dword [ecx]
mov di, word [esp]
jmp 0x4e1af4
pop edx
call fcn.004e1b51
lea esi, [esi + 0x14]
mov dword [esi], ebx
pop esi
stc
sub esp, 0x10
jmp 0x4e1bdf
lea edx, [edx + 0x18]
mov dword [edx], eax
pop edx
jmp 0x4e1bec
sub esp, 0x1a
pushal
lea esp, [esp + 2]
lea esp, [esp + 0x38]
popal
jmp 0x4e1ba8
mov word [esp + 0xc], di
push edx
pushal
mov dword [esp + 0x14], ecx
jmp 0x4e1bc0
xor edx, eax
mov dword [ecx + 0x1c], edx
lea esp, [esp + 0x4c]
jmp 0x4e1bfb
call fcn.004ca900
jmp 0x4b3273
push edx
mov edx, ecx
lea edx, [edx + 8]
mov eax, dword [edx]
jmp 0x4e1b68
shr ecx, 8
jmp 0x4e1c81
mov ecx, edx
btr edi, esp
and di, 0x68e2
pushal
pop dword [esp]
jmp 0x4e1c1f
mov ebp, eax
lea ebp, [ebp + 0xc]
mov edx, dword [ebp]
pop ebp
jmp 0x4e1c35
shr edi, 0x10
and edi, esi
push ebp
jmp 0x4e1c68
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ebp]
jmp 0x4e1cd2
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x4e1c5c
sub esp, 0xa
rcr edi, 0x19
pushal
lea esp, [esp + 2]
push ebp
jmp 0x4e1c51
clc
xor ecx, edi
mov edi, edx
jmp 0x4e1ce5
pop ebp
lea esp, [esp + 0x44]
and ecx, 0xff0000
and edi, 0xff000000
jmp 0x4e1caa
and edx, esi
call fcn.004e1cb1
cwde
adc byte [esi + 0x6d310e1], al
lea ebx, reloc.WINMM.dll_midiStreamOut
out dx, eax
mul cl
and byte [ecx + 0x48b6607], cl
and al, 0x8a
add al, 0x24
mov dword [edi], eax
mov ax, word [esp]
mov al, byte [esp]
clc
shr ah, 1
jmp 0x4e1c12
lea esp, [esp + 2]
xor ebx, eax
cmc
sub esp, 0x14
jmp 0x4e1cfd

Function at 0x4e1b31
Capabilities:
Encrypt data using aes

Disassembly:
pop ebp
mov ebp, edx
bswap ebp
mov bp, 0xc011
call 0x4e19b7
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ebp]
jmp 0x4e19de
and edi, esi
add bp, 0xeca6
btc ebp, ebx
sub bl, dh
push ebp
jmp 0x4e1a39
jmp 0x4e1a6f
Function at 0x58eccd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov edx, 0x3ba51924
xchg dword [esp], esi
jmp 0x58ecf9

Function at 0x58f052
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x2a
setns ah
btc eax, esp
jmp 0x58f079

Function at 0x58f197
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pop esi
jmp 0x58f1a0
rdtsc
btc edx, esp
mov word [esp + 1], dx
xchg word [esp], dx
pop edx
lea eax, [eax + edi]
jmp 0x58f221
clc
mov ah, byte [esp]
lea esp, [esp]
call fcn.0058f1cd
xchg dword [esp], esi
mov dword [esp], ecx
cld
push dword [esp]
inc si
bswap eax
jmp 0x58f267
lea eax, [edx + edi]
mov esi, dword [esp + 0x19]
pop si
mov dword [esp + 0xb], esi
push word [esp + 7]
jmp 0x58f24c
lea edx, [esi + 0x25]
push esp
shr eax, 9
pop si
mov ax, word [esp + 1]
add esp, 2
jmp 0x58f1ec
mov esi, 0xd503804a
bswap edx
call fcn.0058f27a
push edi
push ebx
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x21], ah
retf 0xc68b
and edx, ecx
mov eax, esi
lea esp, [esp + 0x13]
sub esp, 8
ror dh, 5
neg edx
jmp 0x58f234
xchg byte [esp], dh
pop word [esp + 3]
sete dh
pushal
mov dx, sp
pop ax
jmp 0x58f208

Function at 0x58f5e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
not edx
push dword [esp + 2]
mov byte [esp + 6], ch
jmp 0x58f60e
push edx
xchg word [esp + 1], dx
mov ax, sp
pop eax
pop esi
not dh
jmp 0x58f5b7
mov dword [esp + 3], eax
rdtsc
mov edx, ecx
inc dl
jmp 0x58f5cd
mov eax, ebx
mov dl, dh
clc
lea edx, [eax + edi]
pushal
clc
jmp 0x58f6a5
add esp, 1
mov dx, bx
rdtsc
pop word [esp]
mov dh, bh
rdtsc
jmp 0x58f5f0
push dword [esp + 8]
mov dx, 0x73a5
cmc
xchg word [esp + 0x22], si
pop dword [esp + 0x21]
jmp 0x58f640
pop ax
rdtsc
mov edx, 0x9f143e56
mov dx, di
mov word [esp + 0x17], sp
mov si, cx
jmp 0x58f65b
mov ax, word [esp + 0x1e]
bswap esi
push dword [esp + 0x20]
lea edx, [ecx + edi]
btc edx, ebx
pop edx
jmp 0x58f673

Function at 0x58f79c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xd827
lea esp, [esp + 3]
pop word [esp]
sub esp, 4
xchg dh, al
sbb si, 0x882
jmp 0x58f7cc
pop si
xchg word [esp + 3], dx
mov dh, ch
cmc
mov dx, word [esp + 4]
jmp 0x58f779
bswap esi
mov esi, 0xc87f1d78
inc dh
xchg dh, dl
mov al, ah
sub esp, 2
jmp 0x58f807
bsf dx, si
pop edx
mov eax, ebx
lea eax, [eax*4]
mov word [esp], bx
jmp 0x58f7ad
not ax
mov word [esp], di
mov byte [esp + 2], bh
lea esp, [esp + 3]
shl dh, 3
bswap eax
jmp 0x58f7ec

Function at 0x59460e
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header

Disassembly:
call int.00593015
push eax
jmp 0x593010
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x59446a
lea esp, [esp + 0xd4]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x59448f
lea esp, [esp + 2]
mov dword [esp + 0xd4], edi
jmp 0x5945a8
Function at 0x549920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf3000]
push edi
jmp 0x54993a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x549941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x549930
mov eax, 1
add ebx, ebx
jne 0x549953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x549964
jne 0x549983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x549983
dec eax
add ebx, ebx
jne 0x549970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x549948
add ebx, ebx
jne 0x54997f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5499d5
xor ecx, ecx
sub eax, 3
jb 0x54999b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x549a0a
sar eax, 1
mov ebp, eax
jmp 0x5499a6
add ebx, ebx
jne 0x5499a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x549974
inc ecx
add ebx, ebx
jne 0x5499b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x549974
add ebx, ebx
jne 0x5499c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5499b6
jne 0x5499d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5499b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5499f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5499e6
jmp 0x549936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5499f4
add edi, ecx
jmp 0x549936
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x549a12
cmp byte [edi], 0x11
jne 0x549a12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x549a17
lea edi, [esi + 0x142000]
mov eax, dword [edi]
or eax, eax
je 0x549a8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bb5cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bb748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x549a44
mov ecx, edi
jns 0x549a73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bb74c]
or eax, eax
je 0x549a89
mov dword [ebx], eax
add ebx, 4
jmp 0x549a61
call dword [esi + 0x1bb75c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x549ac0
cmp al, 0xef
ja 0x549ab3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x549a95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x549aa2
mov ebp, dword [esi + 0x1bb750]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x549af4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x47daa0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x536edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00528e00
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x47db22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00525f3f
mov eax, dword [eax]
push 0x58d284
push eax
call fcn.005065c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0052908b
test bl, bl
je 0x47db22
push 0x58d284
lea ecx, [esp + 0xc]
call fcn.00529467
push 0x590e98
lea ecx, [esp + 0xc]
call fcn.00529467
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x47db5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0052908b
jmp 0x47dc29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x47dbe2
lea edx, [esp + 0x7c]
push 0x590e94
push edx
call fcn.005065c4
add esp, 8
test eax, eax
je 0x47dbe2
lea eax, [esp + 0x7c]
push 0x590e90
push eax
call fcn.005065c4
add esp, 8
test eax, eax
je 0x47dbe2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47db72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0052908b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x47eea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x47ef02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x47ef10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x53703b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5a6374]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x47f048
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x47ef76
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0052908b
xor eax, eax
jmp 0x47f0bf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00529214
push esi
lea ecx, [esp + 0xc]
call fcn.005294a3
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x590ed0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x47f09d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0047eea0
test eax, eax
jne 0x47f09d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0047eea0
test eax, eax
jne 0x47f09d
lea eax, [esp + 0x14]
push 0x590eac
push eax
call fcn.005077b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x47f07c
lea ecx, [esp + 0x14]
push 0x590ea8
push ecx
call fcn.00507730
mov esi, eax
add esp, 8
test esi, esi
jne 0x47f07c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x47f07f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005291c4
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x47ef8e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0052908b
xor eax, eax
jmp 0x47f0bf
mov byte [esi], 0
push 0x590ea4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0052908b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4