joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460af4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x460cad
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x460c26
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x460c26
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x460c0d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x460c0d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.00461d60
mov ebp, eax
test ebp, ebp
je 0x460c05
push ebp
mov ecx, esi
call fcn.004632b0
test eax, eax
je 0x460c05
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x460c05
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x460bc6
xor eax, eax
jmp 0x460bce
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00463c50
inc ebx
xor ebp, ebp
jmp 0x460b57
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x460b30
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.00462070
test eax, eax
pop ebx
je 0x460cad
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.00461d60
mov edi, eax
cmp edi, ebp
je 0x460cad
push edi
mov ecx, esi
call fcn.004632b0
test eax, eax
je 0x460cad
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.004622b0
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00462320
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.00463c50
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x46b2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49c067
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x63706c
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.00486386
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.00486386
call fcn.007a442a
salc
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x637058
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call fcn.0079aa20
ja 0x46b36d
mov word [eax + esi*4], fs
add byte [eax], al
add byte [ecx - 0x18], dl
sbb eax, 0x3d0030d6
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0046be10
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x6ab14c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, dh
xchg dword [esp], edi
not dh
rdtsc
not dx
mov eax, 0x3ed48054
jmp 0x6ab157
mov edx, ebx
mov eax, ebx
mov dh, 0x5a
mov edx, dword [esp]
jmp 0x6ab130
sub esp, 0x18
lea edi, [edi + 0x72]
rdtsc
mov ax, 0x317
xchg edx, eax
mov dx, sp
jmp 0x6ab1f6
mov ax, 0x581
xchg dword [esp + 0x18], edi
mov dh, 0xc2
add al, dh
lea eax, [esi + 0x65]
not eax
jmp fcn.006ab19c

Function at 0x6ac927
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
add cl, 0xf5
rdtsc
jmp 0x6ac8fd

Function at 0x6acba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
add cl, 0x63
clc
jmp 0x6ac999
stc
mov eax, 0x4567ec0e
mov dh, byte [esp]
not edx
mov dx, di
mov eax, 0xe0be702e
jmp 0x6aca65
mov word [esp], dx
mov dword [esp], ecx
mov dh, 0x10
jmp 0x6ac94b
mov dh, byte [esp]
not edx
mov dx, di
jmp 0x6ac967
jle 0x6ac959
stc
mov eax, 0x4567ec0e
jmp 0x6ac981
mov dword [esp], esi
jmp 0x6ac976
jp 0x6ac9e7
jnp 0x6ac9e7
lea eax, [eax - 0x294462b7]
btr edx, edx
jmp 0x6ac9ec
sub esp, 0x1c
rdtsc
add esp, 0x1b
sub esp, 0x10
mov edx, dword [esp + 0x10]
clc
jmp 0x6aca3b
call 0x6aca14
jp 0x6ac9cf
sub esp, 0x1c
rdtsc
jmp 0x6ac9f9
add esp, 0x1b
sub esp, 0x10
mov edx, dword [esp + 0x10]
jmp 0x6ac9de
xchg dx, ax
mov edx, eax
jmp 0x6aca4a
or eax, esi
jo 0x6aca21
xchg dx, ax
mov edx, eax
jmp 0x6acb6a
lea esp, [esp + 1]
lea esp, [esp + 0x10]
sub cl, 0xd
lea edx, [ebx + ebx]
xchg dh, dl
jmp 0x6acac8
sub cl, 0xe1
setge dh
mov dh, byte [esp]
xchg dh, dl
neg eax
jmp 0x6ac9bc
inc edx
mov eax, 0xa04a207c
jmp 0x6acb3e
adc ax, 0x115c
jp 0x6aca77
inc edx
mov eax, 0xa04a207c
rcr ax, cl
call fcn.006acafd
popal
loope 0x6acb16
adc bl, ah
pop esi
mov eax, dword [0x22d7b022]
loopne 0x6aca92
sbb dl, byte [edx - 0x7d]
loope 0x6acaf0
push edx
and ecx, 0x3c
jmp 0x6aca8e
sub esp, 0x1c
je 0x6acab0
push edx
jmp 0x6acab1
mov cl, 0xa
das
test al, 0x3e
pop ecx
test al, 0x69
inc ebp
hlt
and al, 7
lea esp, [esp + 3]
xchg dword [esp + 0xc], ebx
jmp 0x6acb8b
rcr ax, cl
mov eax, dword [edi]
xchg dh, dl
mov dh, byte [esp]
call 0x6acb4e
xor esi, 0xffffffde
jne 0x6acdd1
je 0x6acd71
adc dl, byte [ebp + 0x2d9f6c05]
mov word [esi], es
xchg esp, eax
push cs
iretd
lea esp, [esp + 1]
jmp 0x6aca4e
push dword [esp + 0xc]
ret 0x10
lea edx, [ebx*4]
mov dh, 0xfe
setbe dh
bswap edx
lea edx, [ecx + edx]
jmp 0x6acb73
neg dh
jbe 0x6ac9b7
mov dword [esp], esi
mov word [esp], dx
mov dword [esp], ecx
mov dh, 0x10
jmp 0x6ac94b
inc cx
jge 0x6acbf1
jl fcn.006ab0e4
jne 0x6acc09
je 0x6acc09
jmp fcn.006ab0e4
add edi, 4
mov cl, 0x9a
mov dl, byte [esp]
xchg ah, ch
jmp 0x6acbbb
mov dword [ebp], eax
pop ebp
xchg edx, eax
mov ch, byte [esp]
not ecx
bsf ax, ax
jmp 0x6acbd5
push ebp
mov ebp, esi
lea ebp, [ecx + ebp]
jmp 0x6acd35
jmp 0x6acd71

Function at 0x6cb6ef
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [edx], ecx
pop edx
mov edi, dword [esp]
jmp 0x6cb6af
push edx
mov edx, ebp
lea edx, [edx - 4]
jmp 0x6cb66e
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x69db0a
cmc
bswap ebx
jmp 0x6cb689
Function at 0x6cb701
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0069d491
mov dl, byte [esp]
mov di, si
jmp 0x6cb691
lea esp, [esp + 4]
jmp 0x69db05
movzx ebx, byte [esi + 0x11]
mov di, bx
mov dx, 0xf65f
jmp 0x6cb6d4
add esi, 0x10
mov dx, ax
mov dh, ch
jmp 0x6cb6f4
mov ebx, dword [ebx*4 + 0x6a7df8]
bswap edx
mov dx, 0x9cd7
jmp 0x6cb6bd
mov edx, dword [esi]
bswap edi
mov edi, edx
cmc
call 0x6cb701
scasd eax, dword es:[edi]
jmp 0x6cb72e

Function at 0x6cb77b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push eax
mov eax, edi
lea eax, [eax*4]
lea eax, [eax + 0x6a81f8]
jmp 0x6cb780
mov dword [esp], esi
jmp 0x6cb75d
mov edi, dword [eax]
pop eax
sub esp, 0xa
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x6cb7c1
and ebx, ecx
sub esp, 0x1e
mov byte [esp + 8], ah
stc
pushal
jmp 0x6cb7a6

Function at 0x6cb819
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
stc
cmc
jmp 0x6cba36
sub esp, 2
lea esp, [esp + 2]
shr edi, 0x18
sub esp, 2
lea esp, [esp + 2]
lea edi, [edx + ebp]
mov edi, 0xafa96e7e
mov ebx, dword [ebx*4 + 0x6a7df8]
mov edi, edx
jmp 0x6cb88b
mov edx, dword [esi + 4]
sub esp, 0x1e
pop word [esp + 0xd]
mov dword [esi], edi
bswap edi
jmp 0x6cb989
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x6a8df8]
mov dl, byte [esp]
mov dh, 0x70
jmp 0x6cba0e

Function at 0x6cb952
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x6cb907

Function at 0x6cb99f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x38]
jmp 0x6cb9a9
xor edi, dword [edx*4 + 0x6a8df8]
bsf dx, si
mov dx, 0x8777
jmp 0x6cb9f0
mov edx, dword [esi + 8]
cmc
clc
mov dword [esi + 4], edi
jmp 0x6cb9d7
Function at 0x6cbbcf
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x6cbbe6
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x6a85f8]
mov ebx, 0x8d4a69c4
jmp 0x6cbbc2
and ebx, ecx
sub esp, 0xa
push dword [esp + 8]
lea esp, [esp + 2]
jmp 0x6cbb93
movzx ebx, byte [esi + 0xd]
pushal
and edx, ecx
call 0x6cbbcf
pop ecx
pushal
jmp 0x6cc403
mov ebx, dword [ebx*4 + 0x6a7df8]
jmp 0x6cbbb3
mov dword [esp + 4], edi
sub esp, 4
pop word [esp]
lea esp, [esp + 2]
popal
jmp 0x6cbc44
mov edi, edx
stc
call fcn.006cbc11
lea esi, [esi*4]
lea esi, [esi + 0x6a7df8]
mov edi, dword [esi]
pop esi
clc
jmp 0x6cbc68
jmp 0x6cbc1b
sub esp, 4
and edi, ecx
stc
push esp
call 0x6cbc75
mov ecx, gs
add byte [ecx], 0
add byte [esi], cl
mov dword [0x11a55633], eax
je 0x6cbc66
jp 0x6cbca1
in al, dx
pop edi
adc byte [ecx], 0x81
loopne 0x6cbc9e
aad 0x10
inc edi
mov ebx, dword [ebx*4 + 0x6a7df8]
not di
mov di, word [esp]
mov di, word [esp]
cmp al, 0x24
jmp 0x6cbc3c
lcall 0x3c33, 0x3024648d
popfd
clc
mov dword [edx], ebp
mov bx, word [esp]
xchg bl, bh
movzx ebx, byte [esi + 0xe]
jmp 0x6cbcf6
and edx, ecx
sub esp, 6
cmc
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x6cbddd
mov ebx, dword [ebx*4 + 0x6a7df8]
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x6cbcdb
lea eax, [eax + 0x6a7df8]
mov edx, dword [eax]
pop eax
call fcn.006cbd17
mov dword [esp], ecx
lea esp, [esp + 2]
jmp 0x6cbd77
lea esp, [esp + 4]
dec dword [ebp - 4]
jmp 0x6cbda5
mov dword [esi + 0xc], edi
push esp
call fcn.006cbf37
xor al, 0xa8
pop ecx
test al, 0x6d
pop edx
lds edx, [ebp + 0x3c]
iretd
push eax
mov eax, edx
lea eax, [eax*4]
jmp 0x6cbd2f
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
neg di
lea edi, [ebp - 0x6f]
jmp 0x6cbc8d
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + 0x6a8df8]
clc
lea edx, [ebx + edi]
mov dx, 0xd1f3
lea edx, [ebx*4]
jmp 0x6cc1d8
mov dword [esp + 1], ebp
mov edx, dword [edx*4 + 0x6a7df8]
and edx, ecx
jmp 0x6cc2c6
Function at 0x6cbc75
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 2]
jmp 0x6cbbe6
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x6a85f8]
mov ebx, 0x8d4a69c4
jmp 0x6cbbc2
and ebx, ecx
sub esp, 0xa
push dword [esp + 8]
lea esp, [esp + 2]
jmp 0x6cbb93
movzx ebx, byte [esi + 0xd]
pushal
and edx, ecx
call 0x6cbbcf
pop ecx
pushal
jmp 0x6cc403
mov ebx, dword [ebx*4 + 0x6a7df8]
jmp 0x6cbbb3
mov dword [esp + 4], edi
sub esp, 4
pop word [esp]
lea esp, [esp + 2]
popal
jmp 0x6cbc44
mov edi, edx
stc
call fcn.006cbc11
lea esi, [esi*4]
lea esi, [esi + 0x6a7df8]
mov edi, dword [esi]
pop esi
clc
jmp 0x6cbc68
jmp 0x6cbc1b
sub esp, 4
and edi, ecx
stc
push esp
call 0x6cbc75
mov ecx, gs
add byte [ecx], 0
add byte [esi], cl
mov dword [0x11a55633], eax
je 0x6cbc66
jp 0x6cbca1
in al, dx
pop edi
adc byte [ecx], 0x81
loopne 0x6cbc9e
aad 0x10
inc edi
mov ebx, dword [ebx*4 + 0x6a7df8]
not di
mov di, word [esp]
mov di, word [esp]
cmp al, 0x24
jmp 0x6cbc3c
lcall 0x3c33, 0x3024648d
popfd
clc
mov dword [edx], ebp
mov bx, word [esp]
xchg bl, bh
movzx ebx, byte [esi + 0xe]
jmp 0x6cbcf6
and edx, ecx
sub esp, 6
cmc
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x6cbddd
mov ebx, dword [ebx*4 + 0x6a7df8]
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x6cbcdb
lea eax, [eax + 0x6a7df8]
mov edx, dword [eax]
pop eax
call fcn.006cbd17
mov dword [esp], ecx
lea esp, [esp + 2]
jmp 0x6cbd77
lea esp, [esp + 4]
dec dword [ebp - 4]
jmp 0x6cbda5
mov dword [esi + 0xc], edi
push esp
call fcn.006cbf37
xor al, 0xa8
pop ecx
test al, 0x6d
pop edx
lds edx, [ebp + 0x3c]
iretd
push eax
mov eax, edx
lea eax, [eax*4]
jmp 0x6cbd2f
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
neg di
lea edi, [ebp - 0x6f]
jmp 0x6cbc8d
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + 0x6a8df8]
clc
lea edx, [ebx + edi]
mov dx, 0xd1f3
lea edx, [ebx*4]
jmp 0x6cc1d8
mov dword [esp + 1], ebp
mov edx, dword [edx*4 + 0x6a7df8]
and edx, ecx
jmp 0x6cc2c6

Function at 0x6cbd0f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + 0x6a89f8]
pushal
mov word [esp + 4], dx
pushal
add esp, 0x1f
lea esp, [esp + 1]
jmp 0x6cbca2
lea esp, [esp + 2]
and ebx, ecx
jmp 0x6cbccb

Function at 0x6cbd17
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
pushal
jmp 0x6cbdbb
xor edi, dword [edx*4 + 0x6a8df8]
push esp
push word [esp + 1]
mov word [esp], di
jmp 0x6cbd3d
lea esp, [esp + 2]
and edx, ecx
pushal
lea esp, [esp + 0x2c]
jmp 0x6cbd53
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + 0x6a85f8]
push edx
push word [esp + 1]
sub esp, 8
jmp 0x6cbd6a
add esp, 0x15
push word [esp + 6]
mov byte [esp + 7], ch
lea esp, [esp + 1]
jmp 0x6cbd8f

Function at 0x6cbf37
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jne 0x69db0a
je 0x69db29
call fcn.006ccdc9
lds ecx, [edx + eax*8 - 0x5b]
push esp
xchg esi, eax
push ebp
invalid

Function at 0x7ba5a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 5], dx
pop dword [esp + 0x13]
jmp 0x7ba5b5
pop dword [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 2], eax
mov al, 0xfa
jmp 0x7ba5ea
mov ax, word [esp]
lea eax, [ebx*4]
lea eax, [eax - 0x99]
jmp 0x7ba5d4
Function at 0x7ba5cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x11]
call fcn.007ba5a6
lea eax, [ebp + 0x635bde0f]
lea eax, [esi*4]
setb al
jmp 0x7ba6a0
bswap eax
rdtsc
mov al, ah
mov dh, 0xc2
mov eax, ebp
lea eax, [edx + edx]
jmp 0x7ba677
not esi
lea esi, [ecx + edi]
push edx
xchg dh, dl
mov dx, word [esp]
rdtsc
jmp 0x7ba645
xchg esi, eax
xchg dx, ax
mov si, word [esp]
mov eax, ebp
lea esi, [esp + ebp]
pop edx
jmp 0x7ba6d4
bswap esi
mov esi, edi
pop esi
mov al, ah
mov eax, 0x2eac6e42
lea eax, [ecx - 0xd3]
jmp 0x7ba6bb
push esi
lea esi, [eax - 0x71]
lea eax, [ebp + 0x4f]
lea esi, [edx*4]
mov si, word [esp]
lea esi, [esi*4]
jmp 0x7ba667
mov ax, 0x5e7b
lea eax, [ebx*4]
mov eax, dword [esp]
mov eax, dword [esp + 2]
jmp 0x7ba78f
mov al, ah
mov al, byte [esp]
xchg si, ax
lea esi, [esp + ebp]
bswap esi
mov esi, dword [esp]
jmp 0x7ba687
call 0x7ba70c
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add al, ch
push es
push ecx
out dx, al
invalid
pushal
jmp 0x7ba6fc
lea esp, [esp + 0x18]
cmp dword [esp + 4], 0
jne 0x7ba601
jmp 0x7ba726

Function at 0x7fad35
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x7fad7c
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
jmp 0x7facfe
mov byte [esp + 1], ah
mov dword [esp], eax
jmp 0x7fad1b
mov eax, dword [eax + 0x1c]
Function at 0x7ace48
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ace52
pushal
call 0x7ace58
pop ebp
sub ebp, 0x10
sub ebp, 0x3ace48
jmp 0x7ace6e
mov eax, 0x3ace48
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ff
mov edx, 0xf7acae1b
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ace85
jmp 0x7ace98
nop
salc
nop
xchg edx, eax
daa
sbb ebx, dword [ebx]
sbb ebx, dword [edx + 0x1b1be3da]
sbb ebx, dword [eax]
salc
mov dword [0x1b1b1b1f], eax
mov eax, dword [0x1b1b1b33]
in al, dx
stc
sbb bl, dl
nop
lcall 0xde18, 0x1b1b1b17
dec ebx
dec ebx
fimul word [ebx + 0x4b]
jae 0x7acebd
pushal
adc eax, 0x497d731b
aaa
sbb ebx, dword [edx]
aaa
aas
jae 0x7acee4
xor al, 0x52
popal
push ds
sbb ebx, dword [ebx]
sbb esi, edx
xor eax, 0x4e1b1b1b
nop
not dword [eax + 0x1b1b139e]
sbb edx, dword [eax + 0x1b1b178e]
sbb edx, dword [eax + 0x1b1b0b96]
sbb ebx, edx
sbb dword [edx], ebp
sbb dword [eax + 0x14521fd9], ebx
sahf
out dx, eax
in al, 0xe4
in al, 0x90
aaa
aas
xchg esi, eax
jg 0x7acf45
pop ds
fst dword [edi]
sbb edx, dword [eax + 0x1b1f3f97]
sbb ebx, dword [ebx]
jae 0x7acf0e
sbb ebx, dword [ebx]
sbb esi, dword [ebx - 5]
pushal
adc eax, 0x497d731b
aaa
sbb ebx, dword [edx]
aaa
aas
xchg esi, eax
jg 0x7acf60
out 0x92, eax
pop ss
aas
push ds
sbb ebx, dword [ebx]
sbb esi, edx
push eax
sbb dword [ebx], ebx
sbb ecx, dword [esi + 0x4f]
inc esi
in al, 0x6e
pop ss
in al, 0x6e
adc esi, ebx
sbb ebx, dword gs:[ebx]
sbb edx, dword [eax + 0x1b1b13a6]
sbb ebx, dword [edx - 0x7074b016]
sti
lcall 0x28fb, 0x8f8b4fea
rcr byte [edx - 0x4400b617], cl
cdq
lcall 0x2899, 0xbbff49e9
leave
cwde
dec edi
mov ecx, dword [edi + 0x4fea9afb]
mov ecx, dword [edi - 0x652dd705]
jmp 0x9a36cea0
push ds
push ebx
adc al, 0x9f
push ebp
sbb ebx, dword [ebx]
sbb edx, dword [ebx + edx*4]
push ebx
sbb ebx, dword [ebx]
sbb edi, dword [ebp - 0x70]
sbb ebx, dword [ebx]
jge 0x7acf01
pop es
and bl, byte [ebx - 0x60eb0c20]
add dword [ebx], ebx
sbb ebx, dword [ebx]
wait
loopne 0x7acf71
adc al, 0x9f
or bl, byte [ebx]
sbb ebx, dword [ebx]
jge 0x7acf21
loopne 0x7acf6d
adc al, 0x9f
push cs
sbb ebx, dword [ebx]
sbb ebx, dword [edx - 0xe]
xlatb
in al, 0xe4
in al, 0x32
push edi
and bl, byte [edx]
cwde
ficomp dword [esi]
cwde
pop ds
repne cmpsb byte [esi], byte es:[edi]
in al, 0xe4
in al, 0x32
dec edi
and bl, byte [ecx]
cwde
ficomp dword [0x981ff198]
push ds
mov al, 0xe4
in al, 0xe4
inc esi
fst dword [edi]
sbb ecx, dword [esi - 0x70]
test dword [ebp + 0x4c], 0x176e904e
nop
adc sp, di
test eax, 0x9a1d919b
fstp qword [edx]
sbb ebx, dword [ebx]
sbb edx, dword [ebx + 0x1adc9a1c]
sbb ebx, dword [ebx]
sbb esp, dword [eax + 0x1b1b1b19]
sbb ecx, ecx
adc al, 0x9e
push ds
sbb ebx, dword [ebx]
sbb edx, dword [ecx - 0x36f6a2f3]
adc al, 0x98
ret
Function at 0x10015bfd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [0x1002588c], edi
je 0x10015c7f
push edi
push edi
push dword [ebp + 8]
call fcn.100144bf
mov esi, eax
add esp, 0xc
cmp esi, edi
jl 0x10015c7f
lea eax, [ebp + 0xa]
push 2
push eax
push esi
call fcn.1001453a
add esp, 0xc
cmp word [ebp + 0xa], 0x5a4d
jne 0x10015c78
push edi
push 0x3c
push esi
call fcn.10014584
lea eax, [ebp - 4]
push 4
push eax
push esi
call fcn.1001453a
push edi
push dword [ebp - 4]
push esi
call fcn.10014584
lea eax, [ebp + 0xa]
push 2
push eax
push esi
call fcn.1001453a
add esp, 0x30
cmp word [ebp + 0xa], 0x4550
je 0x10015c75
cmp word [ebp + 0xa], 0x454c
jne 0x10015c78
push 1
pop edi
push esi
call dword [0x1001e2b4]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x47da30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ec1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004e026e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x47dab2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004dd95a
mov eax, dword [eax]
push 0x514214
push eax
call fcn.004cfd14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004e04f9
test bl, bl
je 0x47dab2
push 0x514214
lea ecx, [esp + 0xc]
call fcn.004e0889
push 0x517d8c
lea ecx, [esp + 0xc]
call fcn.004e0889
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x47daee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004e04f9
jmp 0x47dbb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x47db72
lea edx, [esp + 0x7c]
push 0x517d88
push edx
call fcn.004cfd14
add esp, 8
test eax, eax
je 0x47db72
lea eax, [esp + 0x7c]
push 0x517d84
push eax
call fcn.004cfd14
add esp, 8
test eax, eax
je 0x47db72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47db02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004e04f9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x47e840
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x47e8a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x47e8b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ec2ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5201cc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x47e9e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x47e916
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e04f9
xor eax, eax
jmp 0x47ea5f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004e0636
push esi
lea ecx, [esp + 0xc]
call fcn.004e08c5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x47ea3d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0047e840
test eax, eax
jne 0x47ea3d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0047e840
test eax, eax
jne 0x47ea3d
lea eax, [esp + 0x14]
push 0x517da0
push eax
call fcn.004d0e20
mov esi, eax
add esp, 8
test esi, esi
jne 0x47ea1c
lea ecx, [esp + 0x14]
push 0x517d9c
push ecx
call fcn.004d0da0
mov esi, eax
add esp, 8
test esi, esi
jne 0x47ea1c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x47ea1f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004e05e6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x47e92e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e04f9
xor eax, eax
jmp 0x47ea5f
mov byte [esi], 0
push 0x517d98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004e04f9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4