joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fb30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
push edi
mov edi, dword [esp + 0x78]
push edi
call dword [0x483394]
cmp eax, 1
je 0x46fb4e
mov eax, 0x1000000
pop edi
add esp, 0x70
ret
lea eax, [esp + 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Ordinal_43589]
test eax, eax
jne 0x46fb68
mov eax, 0x200
pop edi
add esp, 0x70
ret
push ebp
push esi
lea ecx, [esp + 0x28]
push ecx
call dword [0x483198]
lea edx, [esp + 0x38]
push edx
call dword [0x483318]
mov esi, dword [0x48319c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
call esi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
call esi
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
sbb ecx, dword [esp + 0x1c]
sub dword [esp + 0x5c], eax
sbb dword [esp + 0x60], ecx
sub dword [esp + 0x54], eax
sbb dword [esp + 0x58], ecx
sub dword [esp + 0x4c], eax
sbb dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x48]
mov eax, ecx
xor ebp, ebp
and eax, 1
je 0x46fbd8
mov ebp, 1
test cl, 2
je 0x46fbe0
or ebp, 2
test cl, 4
je 0x46fbe8
or ebp, 4
mov edx, ecx
and edx, 0x10
je 0x46fbf2
or ebp, 0x10
test cl, 0x20
je 0x46fbfa
or ebp, 0x20
test edx, edx
je 0x46fc06
or ebp, 0x40000000
jmp 0x46fc0c
or ebp, 0x80000000
or ebp, 0x1000000
test eax, eax
jne 0x46fc1c
or ebp, 0x800000
push 0
push edi
call dword [0x4831d8]
mov dword [esp + 0x10], eax
cmp eax, 0x28
jbe 0x46fccc
mov esi, dword [0x483220]
push ebx
push 0
push 0
push 0
push edi
call esi
mov ebx, dword [0x4831e8]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push edi
call ebx
push 0
push 0
push 0x24
push edi
call esi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push edi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x46fccb
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x14], ecx
jbe 0x46fccb
push 0
push 0
push eax
push edi
call esi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push edi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x46fcc5
cmp eax, 0x454e
je 0x46fcc5
cmp eax, 0x454c
je 0x46fcc5
cmp eax, 0x4550
jne 0x46fccb
or ebp, 0x400000
pop ebx
mov eax, dword [esp + 0x84]
test eax, eax
je 0x46fcd9
mov dword [eax], ebp
mov eax, dword [esp + 0x88]
test eax, eax
je 0x46fcea
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov esi, dword [esp + 0x8c]
test esi, esi
je 0x46fd2d
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
push eax
call fcn.0046fa80
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x64]
push ecx
push edx
mov dword [esi], eax
call fcn.0046fa80
mov ecx, dword [esp + 0x5c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x60]
push eax
push ecx
call fcn.0046fa80
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x90]
test esi, esi
je 0x46fd5e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_Ordinal_10089]
movzx edx, word [esp + 0xc]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x70
ret
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401039
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401070
invalid
wait
add byte [eax], al
invalid

Function at 0x43d433
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add al, byte [ecx]
pop ds
push esi
push eax
adc bh, ah
add al, ch
or al, 0xe8
xor eax, 0x52d20001
dec esp
add byte [ebx], cl
jbe 0x43d3b2
and dword [ecx - 0x74c3fda0], esi
cmp al, 0x8b
cmp eax, 0x32033131
push ebx
mov cl, 0x53
and byte [ebp + 0x29], dh
push dword [ebp - 0x14]
rcr byte [edx], 0x15
mov al, 3
add byte [eax + esi*2], 0
xlatb
cmp eax, dword [ebp - 0x14]
jne 0x43d46a
in eax, 0xb0
sub ch, al
adc byte [eax + ebp*2], 0x1f
add byte [ecx], ah
and al, byte [ecx + edx]
adc byte [edx], dl
call dword [edx - 0x2e4274e1]
push ds
push ebx
push 3
and al, 0xff
ja 0x43d436
sbb eax, 0x1c91bd83
add byte [ebx + 0xd74f028], cl
xor al, byte [ecx]
sub al, 0
pop ds
and dword [edi], 0x28
add byte [ebx + 0x50ebe8c6], cl
add dword [edx + 0x56417500], edx
push edi
inc edi
and al, 0xe8
and dh, byte [ecx + 0x70]
or dword [ebx - 0x1fb22866], eax
pop ss
jge 0x43d4aa
cmp dword [esi], edi
adc al, 0x74
sub eax, dword [ebx + 0x7500287e]
adc byte [edx], ah
call dword [0x5007c0f4]
sub byte [eax], al
jne 0x43d4be
and bh, bh
adc eax, 0x5007c0f4
push 0
add byte [eax + 0x6c], ch
adc al, 0x44
add byte [edx + 5], ch
inc dword [ebp + edx + 0x6c]
add eax, 0x6c1544ff
and byte [0xa0284689], al
add byte [0xf06fe8c4], 2
mov dword [esi + 0x14], edi
xchg ecx, eax
movsd dword es:[edi], dword [esi]
push esp
scasb al, byte es:[edi]
adc byte [ebx - 0x4fa9cf14], al
dec esi
adc byte [ebx - 0x7aef0f], cl
je 0x43d4f7
inc eax
xchg esi, eax
call 0x94691417
lea edi, [edx - 0x3f]
add eax, 0x8fd10845
inc ebp
or al, 0x43
inc ebx
ror byte [edx + edx*2 + 0x30], 0xf0
mov eax, dword [ebp + 0x18]
lock adc byte [ebx + 0x421c450c], cl
inc ecx
push eax
dec ebp
in al, 0x8b
inc ebp
and al, 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp], eax
fmul qword [ebx + 0x7d892c45]
hlt
Function at 0x408150
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40819d
mov esi, dword [esp + 0xc]
push 8
push esi
call fcn.00408220
add esp, 8
cmp edi, 8
jle 0x40819d
add edi, 0xfffffff7
add esi, 8
shr edi, 3
inc edi
xor eax, eax
mov cl, byte [esi + eax - 8]
mov dl, byte [esi + eax]
xor dl, cl
mov byte [esi + eax], dl
inc eax
cmp eax, 8
jl 0x40817a
push 8
push esi
call fcn.00408220
add esp, 8
add esi, 8
dec edi
jne 0x408178
pop edi
pop esi
ret

Function at 0x4081a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 4], bl
mov byte [esp + 5], bl
mov byte [esp + 6], bl
mov byte [esp + 7], bl
mov byte [esp + 8], bl
mov byte [esp + 9], bl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], bl
jle 0x408219
push esi
mov esi, dword [esp + 0x1c]
push edi
lea edi, [eax - 1]
shr edi, 3
inc edi
mov eax, esi
push 8
push esi
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
call fcn.00408250
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov dl, byte [esi + eax]
xor dl, cl
mov byte [esi + eax], dl
mov dl, byte [esp + eax + 0x14]
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jl 0x4081f7
add esi, 8
dec edi
jne 0x4081db
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x408be0
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ecx
push ebx
push ebp
movsx ebp, word [esp + 0x14]
push esi
mov ebx, dword [esp + 0x14]
push edi
mov ecx, 0x12
mov esi, 0x55d370
mov edi, 0x56f288
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x400
mov esi, 0x55d3b8
mov edi, 0x56e288
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], 0x56f288
mov dword [esp + 0x10], 0x12
movsx esi, dx
xor eax, eax
xor ecx, ecx
mov al, byte [esi + ebx]
mov edi, eax
lea eax, [esi + 1]
cdq
idiv ebp
lea eax, [esi + 2]
shl edi, 0x18
and edi, 0xff00ffff
mov cl, byte [edx + ebx]
cdq
idiv ebp
shl ecx, 0x10
xor ecx, edi
xor eax, eax
and ecx, 0xffff0000
mov ah, byte [edx + ebx]
xor eax, ecx
xor ecx, ecx
mov dword [esp + 0x18], eax
lea eax, [esi + 3]
cdq
idiv ebp
mov eax, dword [esp + 0x18]
mov cl, byte [edx + ebx]
or eax, ecx
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx]
add ecx, 4
xor edi, eax
lea eax, [esi + 4]
cdq
idiv ebp
mov eax, dword [esp + 0x10]
mov dword [ecx - 4], edi
dec eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jne 0x408c22
xor eax, eax
mov esi, 0x56f28c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov edi, 9
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00408280
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esi - 4], ecx
mov dword [esi], edx
add esp, 8
add esi, 8
dec edi
jne 0x408ca4
mov esi, 0x56e28c
mov ebx, 4
mov edi, 0x80
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00408280
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 8
add esi, 8
dec edi
jne 0x408cd8
dec ebx
jne 0x408cd3
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
pop ecx
ret
Function at 0x409330
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call fcn.0048d700
mov ebx, eax
add ebx, 0xa
push ebx
call fcn.0050c4a3
mov ecx, ebx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test edx, edx
je 0x409385
mov cl, byte [edx]
test cl, cl
je 0x409385
xor byte [eax + esi], cl
inc eax
cmp eax, 0xa
jl 0x40937d
xor eax, eax
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x409372
test ebp, ebp
je 0x4093a2
mov al, byte [ebp]
test al, al
je 0x4093a2
lea ecx, [esi + 0xa]
mov dl, byte [ecx]
xor dl, al
mov byte [ecx], dl
mov al, byte [ebp + 1]
inc ecx
inc ebp
test al, al
jne 0x409393
mov eax, dword [esp + 0x1c]
push eax
push ebx
push esi
call fcn.0048ded0
push esi
call fcn.0050c4cc
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40a6d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c006
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp + 8]
push str..dat
lea ecx, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00507fcf
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x244]
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x20], esi
je 0x40a8c0
mov ebx, 5
lea ecx, [ebp - 0x218]
push 0x55e51c
push ecx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40a8a3
lea edx, [ebp - 0x218]
push 0x55e518
push edx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40a8a3
mov eax, dword [ebp - 0x244]
and eax, 0x10
cmp al, 0x10
je 0x40a8a3
lea ecx, [ebp - 0xc0]
call fcn.0040c600
lea ecx, [ebp + 8]
push 0x55cfa4
lea edx, [ebp - 0x1c]
push ecx
push edx
mov byte [ebp - 4], 2
call fcn.00507fcf
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x14]
push ecx
push eax
push edx
mov byte [ebp - 4], 3
call fcn.00507fcf
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00507d3a
lea ecx, [ebp - 0x30]
call fcn.0050c575
mov eax, dword [ebp - 0x14]
push 0x8040
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.0050c6e3
push 0
push 0x1000
push 1
push eax
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 8
call fcn.0050ed7b
push eax
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 9
call fcn.0040cda0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 8
call fcn.0050ee57
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.0050c783
lea ecx, [ebp - 0xc0]
call fcn.0040d060
lea ecx, [ebp - 0x28]
mov edi, eax
push ecx
call fcn.005057fa
mov esi, dword [eax]
lea ecx, [ebp - 0xc0]
sub esi, edi
call fcn.0040d040
test eax, eax
je 0x40a852
call fcn.0040a2c0
cmp esi, eax
jl 0x40a87d
mov edx, dword [ebp - 0x14]
push edx
call fcn.00422fd0
add esp, 4
jmp 0x40a87d
mov dword [ebp - 4], ebx
call fcn.0050c5b3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00507d3a
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 1
call fcn.0040c6a0
mov esi, dword [ebp - 0x20]
lea edx, [ebp - 0x244]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a735
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00507d3a
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00507d3a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40abd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x51c0c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push esi
lea eax, [esp + 0x164]
push 0x55e520
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x168], 0
call fcn.00507fcf
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x164], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ad22
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
xor edi, edi
lea ecx, [esp + 0x48]
push 0x55e51c
push ecx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40ac68
lea edx, [esp + 0x48]
push 0x55e518
push edx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40ac68
inc edi
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
test eax, eax
jne 0x40ac3b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 1
jne 0x40ad0c
lea ecx, [esp + 0x18]
push ecx
call fcn.004092b0
add esp, 4
mov esi, eax
lea edx, [esp + 0x16c]
push 0x55cfa4
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x170], 2
call fcn.00507fcf
push esi
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x170], 3
call fcn.00507f69
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 6
call fcn.00507d3a
lea ecx, [esp + 0x18]
mov byte [esp + 0x164], 5
call fcn.00507d3a
mov edx, dword [esp + 0x10]
push edx
call fcn.00422fd0
add esp, 4
test eax, eax
je 0x40acfb
xor edi, edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x164], 1
call fcn.00507d3a
test edi, edi
pop edi
pop ebp
jne 0x40ad22
mov eax, dword [esp + 0x164]
push eax
call fcn.00422c50
add esp, 4
lea ecx, [esp + 4]
mov byte [esp + 0x15c], 0
call fcn.00507d3a
lea ecx, [esp + 0x164]
mov dword [esp + 0x15c], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x154]
pop esi
mov dword fs:[0], ecx
add esp, 0x15c
ret
Function at 0x40ada0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51c0f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea eax, [esp + 8]
push edi
push eax
call fcn.00409230
mov ecx, dword [str._cindex.dat]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x10]
push eax
push edx
mov dword [esp + 0x3c], 0
call fcn.00424830
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call fcn.00507d3a
lea eax, [esp + 0x10]
push eax
call fcn.00409230
add esp, 4
mov eax, dword [eax]
mov ecx, 0x56f2d0
push eax
mov byte [esp + 0x30], 3
call fcn.00450b60
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00507d3a
mov ecx, dword [esp + 8]
push ecx
mov ecx, 0x56f2d0
call fcn.00451370
push 0x56f31c
mov dword [esp + 0x20], 0x56f314
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
mov byte [esp + 0x2c], 4
test eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0xbff00000
je 0x40aec5
mov ecx, 0x571fb8
call fcn.00480ea0
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fst qword [esp + 0x10]
fcomp qword [0x533a28]
fnstsw ax
test ah, 5
jp 0x40ae95
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, 0x571fb8
call fcn.00480eb0
fld qword [esp + 0x10]
sub eax, 0
je 0x40aebb
dec eax
je 0x40aeb3
fmul qword [0x533a20]
jmp 0x40aec1
fmul qword [0x533a18]
jmp 0x40aec1
fmul qword [0x533a10]
fstp qword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov edx, dword [0x56f334]
push 0x56f2d0
push 1
push esi
push edi
push 0
push edx
call fcn.0040af60
lea eax, [esp + 0x28]
push eax
call fcn.00423c80
mov eax, dword [eax]
push 0x56f2d0
push 1
push esi
push edi
push str.pdc
push eax
mov byte [esp + 0x60], 5
call fcn.0040af60
add esp, 0x34
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.00507d3a
mov ecx, dword [esp + 8]
push ecx
mov ecx, 0x56f2d0
call fcn.004514c0
mov edx, dword [0x56f314]
mov ecx, 0x56f314
mov byte [esp + 0x2c], 2
call dword [edx + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x24]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51c168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
lea eax, [esp + 4]
push eax
call fcn.00409230
mov ecx, dword [str._cindex.dat]
mov eax, dword [eax]
push ecx
lea edx, [esp + 8]
push eax
push edx
mov dword [esp + 0x3c], 0
call fcn.00424830
add esp, 0x10
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.00507d3a
lea eax, [esp + 8]
push eax
call fcn.00409230
add esp, 4
mov eax, dword [eax]
mov ecx, 0x56f2d0
push eax
mov byte [esp + 0x30], 3
call fcn.00450b60
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.00507d3a
mov ecx, dword [esp]
push ecx
mov ecx, 0x56f2d0
call fcn.00451370
lea edx, [esp + 0x18]
push edx
call fcn.004e9b59
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x34]
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
mov ecx, 0x56f2d0
mov dword [esp + 0x1c], eax
call fcn.00450c30
lea ecx, [esp]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x40cb70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x51c460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
xor ebx, ebx
push 0x55e7ac
lea ecx, [esp + 0x170]
mov dword [esp + 0x168], ebx
call fcn.00505538
mov eax, dword [esp + 0x16c]
cmp dword [eax - 8], ebx
je 0x40cbc8
push eax
call fcn.00422860
add esp, 4
test eax, eax
jne 0x40cbe6
lea ecx, [esp + 0x16c]
mov dword [esp + 0x164], 0xffffffff
call fcn.00507d3a
xor eax, eax
jmp 0x40cd78
mov ecx, esi
call fcn.0040c780
lea eax, [esp + 0x16c]
push 0x55e520
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00507fcf
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x16c], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov eax, 1
cmp edi, 0xffffffff
je 0x40cd4c
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, ebx
je 0x40cd45
lea ecx, [esp + 0x48]
push 0x55e51c
push ecx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40cd38
lea edx, [esp + 0x48]
push 0x55e518
push edx
call fcn.0048d6a0
add esp, 8
test eax, eax
je 0x40cd38
push 0x30
call fcn.0050c4a3
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x164], 2
je 0x40cc93
mov ecx, eax
call fcn.0040d100
mov esi, eax
jmp 0x40cc95
xor esi, esi
lea eax, [esp + 0x48]
lea ecx, [esi + 4]
push eax
push 0x55e7a8
push ecx
mov byte [esp + 0x170], 1
call fcn.005054dc
mov eax, dword [esp + 0x178]
lea edx, [esp + 0x54]
push edx
push eax
lea ecx, [esi + 8]
push 0x55e7a0
push ecx
call fcn.005054dc
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
xor ebx, ebx
xor edx, edx
or eax, ebx
or edx, ecx
push eax
push edx
lea edx, [esi + 0xc]
push str._I64u
push edx
call fcn.005054dc
add esp, 0x2c
lea eax, [esp + 0x30]
push ebx
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040ef20
mov ecx, esi
call fcn.0040d770
mov ecx, dword [esp + 0x1c]
and ecx, 0x10
cmp cl, 0x10
jne 0x40cd1a
mov dword [esi + 0x18], ebx
jmp 0x40cd21
mov dword [esi + 0x18], 3
mov ecx, dword [esp + 0x14]
push esi
call fcn.0040c710
lea edx, [esp + 0x1c]
push edx
push edi
call ebp
jmp 0x40cc32
lea eax, [esp + 0x1c]
push eax
push edi
call ebp
jmp 0x40cc32
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov byte [esp + 0x164], bl
call fcn.00507d3a
lea ecx, [esp + 0x16c]
mov dword [esp + 0x164], 0xffffffff
call fcn.00507d3a
mov eax, 1
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x158
ret 4
Function at 0x412c80
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe8]
test eax, eax
jne 0x412cdb
lea eax, [esp + 8]
mov dword [esi + 0xe0], 0
push eax
push 4
push esi
push 0x412c50
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x412cdb
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x412cd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0xe8], edi
pop edi
pop esi
pop ecx
ret

Function at 0x4216a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42171a
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42171a
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42171a
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x42171a
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x421708
mov edx, esi
cmp edi, ebx
jb 0x421712
add edx, ebx
cmp edi, edx
jbe 0x421724
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x4216fa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x421740
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str._nESP_dump:_n
call fcn.00421940
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 4
xor edi, edi
mov esi, dword [ebp + 0xc4]
push 4
push esi
call ebx
test eax, eax
jne 0x421785
mov eax, dword [esi]
push eax
push str._0x_04x
call fcn.00421940
add esp, 8
add esi, 4
inc edi
cmp edi, 0x32
jl 0x421763
push str._n_nEBP_dump:_n
call fcn.00421940
mov esi, dword [ebp + 0xb4]
add esp, 4
xor edi, edi
push 4
push esi
call ebx
test eax, eax
jne 0x4217bc
mov ecx, dword [esi]
push ecx
push str._0x_04x
call fcn.00421940
add esp, 8
add esi, 4
inc edi
cmp edi, 0x32
jl 0x42179a
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 0x55f080
jmp fcn.00421940