joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92bb9
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x339f8]
push 0x3d984947
mov byte [esp], dl
xor ecx, edi
mov word [esp + 0xc], 0x243a
pushfd
pushfd
pushfd
and edx, 0xff00
clc
mov word [esp + 4], dx
jmp 0x7bd5b
xor ecx, edx
not dl
stc
not edx
rcl dh, cl
xor ecx, dword [eax - 4]
shl dh, 7
sar dx, 3
rol dh, 6
or dh, al
xor ecx, dword [esi]
bsr dx, bp
movzx dx, al
bt bx, 8
and dx, 0x5df0
add esi, 4
movsx dx, dl
sar dl, 4
mov dword [eax + 0xc], ecx
bt bx, 8
stc
xor dx, sp
shl dl, 7
mov edx, dword [eax]
cmc
xor edx, ecx
rcr ch, cl
clc
mov dword [eax + 0x10], edx
bts cx, si
not cx
sar ch, 7
mov ecx, dword [eax + 4]
mov word [esp], di
call fcn.000688d9
jp 0x7bdbc
mov bl, 0xa1
push dword [esp + 4]
mov edx, dword [edx*4 + 0x335f8]
test dh, 0x67
pushfd
push dword [esp + 4]
shr edi, 0x18
jmp 0x61da6

Function at 0x92de2
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x79c08
xor ecx, esi
inc si
shl ecx, 8
xor esi, esi
ror si, cl
xor ecx, eax
aas
inc ah
mov eax, ecx
ror si, 0xd
shr eax, 0x10
push dword [esp + 4]
sbb si, 0x55c9
cmp bp, 0x6601
rcl si, cl
and eax, ebx
pop esi
mov eax, dword [eax*4 + 0x33df8]
shrd si, ax, 1
pushfd
adc esi, ecx
xor eax, 0x1000000
sbb si, cx
sar esi, 3
and si, 0xae80
mov esi, ecx
stc
shr esi, 8
jmp 0xb16d7
pushfd
movzx eax, byte [eax + 0xf]
bt esp, 0x1f
shl ecx, 8
stc
cmp esp, ebp
jmp 0x5404a
push 0x9d90a2ab
cmp ebx, 0xec7e1705
cmc
xor ecx, esi
movsx si, bl
add esi, esp
pushal
movzx esi, byte [eax + 0xd]
call fcn.000ab84d
jmp 0x4c95f
clc
add esp, 0x48
jae 0x8cd79
xor ecx, esi
btr si, dx
movzx esi, byte [eax + 0xd]
bt sp, di
mov dword [ebp - 0xfc], ecx
bsf ecx, ecx
and cl, 0x31
pushal
movzx ecx, byte [eax + 0xc]
pushal
bt eax, 0x16
shl ecx, 8
cmp cl, 0x9c
xor ecx, esi
btc si, cx
movzx esi, byte [eax + 0xe]
test bl, 0x8a
pushfd
jmp 0x785ba
bt sp, di
test dh, 0x5e
mov esi, dword [esi*4 + 0x341f8]
call fcn.0008ef36
out dx, al
invalid
pushfd
cmp ah, 0x65
stc
and esi, ebx
jmp 0xaf19f

Function at 0x92e29
Capabilities:
Encrypt data using aes

Disassembly:
cmp si, di
test di, 0xd439
push edx
shl ecx, 8
cmp sp, 0x5d9f
xor ecx, edi
sub di, 0x9378
movzx edi, byte [eax + 0xe]
push esi
mov byte [esp], 0xcd
cmc
movzx eax, byte [eax + 0xf]
cmc
shl ecx, 8
mov byte [esp], 0x88
bt edi, 0xe
cmp ch, dl
xor ecx, edi
sbb di, di
movsx di, cl
shl ecx, 8
cmc
bsr edi, esi
xor ecx, eax
bsr di, cx
mov eax, ecx
shrd di, dx, cl
shr eax, 0x10
rcr di, 1
test al, 0xd1
and eax, ebx
movzx di, bl
pop edi
mov eax, dword [eax*4 + 0x33df8]
lea edi, [esi*8 - 0x416a4287]
adc di, bp
xor eax, 0x1000000
inc edi
dec di
mov edi, ecx
cmp ch, ah
jmp 0x9ab9b

Function at 0x951d9
Capabilities:
Encrypt data using aes

Disassembly:
push edx
xchg dword [esp + 0x30], esi
mov word [esp + 0xc], 0x4c45
push esp
mov dword [esp + 0x10], 0xee9ac5a7
mov word [esp + 0x10], 0x77ac
push dword [esp + 0x34]
ret 0x38
mov esi, 0x1868c
push dword [esp]
mov esi, dword [esi + 0x6814e]
lea esp, [esp + 0x2c]
jg 0xa2817
push 0xad37a7f7
push edx
mov byte [esp + 4], ch
lea esi, [esi - 0x1f0255ea]
push 0xcae9b212
pushal
jmp 0x90308
Function at 0x99dc3
Capabilities:
Encrypt data using aes

Disassembly:
test ah, cl
push 0x4a3bf009
cmc
test ecx, ecx
pushfd
lea esp, [esp + 8]
jne 0x84222
clc
cmp dx, 8
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x84222
pushfd
push 0xc62668da
call fcn.0009ad0a
inc ecx
cmp byte [eax + 0x38], ah
mov esp, 0x7642b29a
push ds
mov edx, 0xeeb21c88
invalid
sbb al, al
cmc
jmp 0xd2979
bt di, si
cmp esi, eax
push dword [esp]
lea esp, [esp + 0xc]
jbe 0x4da7b
stc
bt di, sp
cmp cx, 0x2b0b
cmp ecx, eax
jmp 0x7cae1
test eax, 0x72a578e3
push 0x5d12145e
and al, 0x7d
stc
stc
bt di, bx
add al, 3
push dword [esp]
mov byte [ebp - 1], al
push eax
lea esp, [esp + 0xc]
jmp fcn.0007f58f

Function at 0x9b0a8
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x339f8]
jmp 0x5a9fe
xor eax, edi
add di, 0x84e
dec di
and di, bp
mov edi, ecx
lea esp, [esp + 0x60]
jo 0xb5671
pushfd
cmp cl, 0xf4
and edi, ebx
pushal
bt di, 2
mov edi, dword [edi*4 + 0x335f8]
jmp 0xb6cb3
jmp 0x4ca75
call fcn.000a1dbb
cmc
pushfd
mov dword [esp], ecx
bt ax, ax
and edi, ebx
bt edx, edi
test al, ah
mov word [esp], 0x7045
pushfd
mov edi, dword [edi*4 + 0x335f8]
cmp al, al
pushfd
clc
and edi, 0xff00
cmc
pushfd
xor eax, edi
jmp 0xa0e98
and edi, 0xff00
pushfd
test bl, bh
bt cx, di
xor eax, edi
clc
mov byte [esp + 4], cl
cmc
xor eax, edx
test ax, sp
cmc
mov dword [esp], ecx
test dx, 0xd3db
mov dword [ebp - 0xf4], eax
push edi
test bl, 0xbe
cmp al, 0x84
xor eax, esi
cmc
push 0xaf639934
push dword [esp + 4]
mov dword [ebp - 0xf0], eax
bt ebx, 0xe
pushfd
xor eax, dword [ebp - 0xfc]
call fcn.0008ddb7

Function at 0x9b628
Capabilities:
Encrypt data using aes

Disassembly:
sub esi, 0xf3dc4022
cmp bl, dl
xor eax, 0x1000000
bts si, 4
pop esi
shr si, 0xa
mov esi, edx
cmc
shr esi, 8
test ch, 0x85
lea esp, [esp + 8]
jae 0x7fa82
and esi, ecx
cmc
bt si, cx
bt cx, di
push 0xb8d65f42
mov esi, dword [esi*4 + 0x341f8]
cmp ah, 0x40
and esi, 0xff0000
call fcn.000b2a95
clc
mov ecx, 0xff
shld si, bp, 0xe
and eax, ecx
shl esi, 4
movzx si, cl
mov eax, dword [eax*4 + 0x33df8]
jmp 0x565dd
Function at 0x9ccd1
Capabilities:
Encrypt data using aes

Disassembly:
bt ecx, ecx
cmc
stc
and edi, 0xff0000
cmp si, 0x42d
bt bx, 8
stc
and eax, 0xff000000
jmp 0xb1eec
cmp al, 0xee
cmp ah, ch
push 0x4f9f891e
clc
shl eax, 4
pushfd
bt dx, 8
push 0x9e1d3d73
cmp bp, 0x761c
add eax, dword [edi + 0x56]
push 0xe6c71c63
pushal
push 0x756e3f53
lea esp, [esp + 0x34]
jmp 0xa9d33
jne 0x6fedf
clc
shl eax, 4
cmc
add eax, dword [edi + 0x56]
pushfd
mov byte [esp], 0xff
pushal
lea esp, [esp + 0x24]
jmp 0xa9d33
lea esp, [esp + 0x4c]
jne 0x760fe
push ecx
pushal
mov byte [ebp - 1], 2
pushal
push dword [esp]
mov byte [esp + 0xc], dh
pushfd
lea esp, [esp + 0x4c]
jmp fcn.0007f58f
pushal
mov edi, dword [ebp - 0xc]
movzx si, cl
pop esi
mov dword [ebp - 0x10], edx
not si
jmp 0xa52a0
mov esi, eax
lea esp, [esp + 0x1c]
push esi
pushfd
mov byte [esp], 0x64
mov byte [esp], 0x3c
movsd dword es:[edi], dword [esi]
pushal
mov byte [esp], dh
call fcn.000a1a92
bt sp, di
and edi, ebx
stc
mov edi, dword [edi*4 + 0x341f8]
jmp 0x6caf6
movsx di, al
jmp 0xa4ded
cmp ebp, eax
xor eax, edi
sbb edi, ebx
cmc
adc di, 0xff71
mov edi, ecx
cmc
cmp cl, al
mov word [esp + 4], 0x8628
cmp ah, 0x80
shr edi, 0x18
cmp cx, 0x2b3d
stc
cmc
movzx edi, byte [edi*4 + 0x339f8]
call fcn.0007be40

Function at 0x9ce59
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], edx
call fcn.00076121
adc al, 0xf3
push 0x14
aas
setns ah
pop eax
jmp 0x98d9a
pushal
bt sp, 5
cmp si, ax
pushfd
push 0x9a4f4d29
lea esp, [esp + 0x28]
jb 0xcd777
xchg si, cx
setle ch
movzx si, al
push 5
call fcn.0005dd79
call fcn.0006ab74
push esp
mov word [ebx + 0xc], ax
pushfd
call fcn.000b135e
pop edi
in eax, 0xfe
sbb byte [ebp + 0x283b6673], dl
cli
dec dword [edi - 0x20]
test dword [ecx], eax
add byte [edi - 0x1b], bl
invalid
jo 0x98db6
mov byte [0xeb1324d8], al
sbb esp, dword [edi + 0x37d0ff09]
in al, dx
mov edx, 0x336a69b2
rol byte [eax + esi*2 + 0x17], 1
xor byte [esi + esi], 0xe1
popfd
cmp ebp, dword [bx + si]
jge 0x98dd1
dec esi
aam 0x2c
int1
xchg esi, eax
inc ebp
cmp dword [esi + 7], eax
pop ss
clc
inc esi
sbb dword [eax - 0x13], esi
mov cl, 0xc7
cdq
cdq
or al, 0x70
mov bl, 0x32
int 0x5a
and al, 0x72
sbb dword [ebx - 0x5b049138], ebx
sahf
ja 0x98de1
jne 0x98e6e
pop ebp
sub eax, 0x45e11141
stc
nop
push ebx
invalid
add dl, byte [edx]
mov dword [0xf30db27f], edx
or eax, 0x45113867
dec ebx
inc ebx
lodsd eax, dword [esi]
pop es
fdivr qword [eax + esi*2]
mov ebx, 0x9d3769b2
invalid
mov word [esp + 4], 0xc0a0
sub eax, 0
mov byte [esp + 4], dh
pushfd
jmp 0xb6a89
mov byte [esp], 9
lea esp, [esp + 0x28]
je 0x57871
pushfd
jmp 0x4ca6d

Function at 0x9f8d1
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, eax
shrd ax, bx, 3
push 0xdc2d6367
stc
sar al, cl
mov eax, edx
and si, dx
bsr cx, di
shr eax, 0x10
jmp 0x6ff48
Function at 0xa00a1
Capabilities:
Encrypt data using aes

Disassembly:
push 0x35049988
pushal
mov byte [ebp - 1], 0x80
pushfd
mov byte [esp], al
pushfd
push 0x99d5699c
lea esp, [esp + 0x30]
jmp fcn.0007f58f
pushal
lea esp, [esp + 0x44]
je 0xcd74f
push 0x59b06756
mov word [esp], ax
stc
cmp eax, 0x1c
mov byte [esp], 0
push ebx
pushal
pushfd
lea esp, [esp + 0x2c]
je 0x92455
pushal
pushfd
bt ax, di
cmp dl, dl
cmp eax, 0x1e
call fcn.000ab8b4
cmp al, 0x72
mov eax, edx
add dh, 0xb7
mov dx, ax
movzx edx, word [eax + 0xc]
pushal
cmp ecx, 0x5fede397
cmc
cmp si, dx
push 0x8850e386
lea esp, [esp + 0x24]
jge 0xa0f77

Function at 0xa17c9
Capabilities:
Encrypt data using aes

Disassembly:
push 0x6cf87382
mov cl, byte [ecx + esi + 8]
mov byte [esp], ch
clc
bt dx, cx
pushfd
and cl, 0x50
jmp 0x8c9fc
shl ecx, 4
clc
jmp 0x656d1
lea esp, [esp + 0x28]
jne 0x7048f
stc
cmc
stc
cmp eax, 2
push 0x3dfcea1e
push 0xf60cdabd
push esi
lea esp, [esp + 0xc]
jbe 0x760fe
shr cx, cl
mov esi, dword [edi + 0x56]
bsf ecx, eax
shrd ecx, esp, 0x19
mov ecx, eax
test bx, 0x3446
test ch, 0xa
bt cx, 0xa
jmp 0x7267a

Function at 0xa3bc4
Capabilities:
Encrypt data using aes

Disassembly:
xor eax, esi
rol esi, cl
bt bx, 1
bsf si, bp
mov esi, edx
pushal
stc
cmc
bt cx, 1
shr esi, 0x18
push dword [esp]
clc
test sp, si
movzx esi, byte [esi*4 + 0x339f8]
pushfd
pushfd
xor eax, esi
btc si, si
bsf si, dx
jmp 0xa7b2b

Function at 0xa3c3f
Capabilities:
Encrypt data using aes

Disassembly:
btr si, 4
xor ecx, edx
rcl si, 7
movzx edx, byte [eax + 3]
and si, sp
bsr esi, ebp
btc esi, eax
movsx esi, cl
shl ecx, 8
cmc
cmc
test esi, 0x2a4e3914
movsx si, bl
xor ecx, edx
shrd edx, ecx, cl
sar si, 3
movzx edx, byte [eax + 9]
bsf si, di
bt dx, bp
shr si, cl
mov dword [ebp - 0x130], ecx
setbe ch
rol si, 2
and ch, 0x97
rcl cx, cl
movzx ecx, byte [eax + 5]
bswap si
pop esi
shl edi, 8
jmp 0x75873

Function at 0xa3f07
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [0x8729baf6]
mov eax, dword [esi + 0x13]
sete cl
neg cl
not cl
mov cl, byte [edx + 4]
bt cx, ax
jmp 0xad028
cmp byte [esi + 5], 0x16
push esi
pushal
push dword [esp + 4]
lea esp, [esp + 0x2c]
jne fcn.0007f58f
setge dh
mov byte [esi + 0x64], 1
bswap si
mov si, cx
daa
mov esi, dword [ebp + 0xc]
movzx ax, al
aad 0x32
and dx, bx
mov edx, dword [ebp + 8]
jmp 0x4f78e

Function at 0xa4c6b
Capabilities:
Encrypt data using aes

Disassembly:
movzx eax, word [eax + 3]
mov word [esp], 0x3853
mov dword [esp + 0x4c], eax
jmp 0x5673c

Function at 0xa79c9
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, 0x1c206
pushfd
lea esp, [esp + 0x28]
jl 0x9afff
mov eax, dword [eax + 0x61a44]
jmp 0x973d8
pushfd
mov word [esp], 0x3dfa
push ecx
pushfd
mov eax, dword [eax + 0x61a44]
pushfd
mov byte [esp], ah
push dword [esp]
lea eax, [eax - 0x5d8e9291]
jmp 0x7e278
pushal
xchg dword [esp + 0x24], eax
jmp 0x8c951
xchg dword [esp + 8], eax
jmp 0xa03e0

Function at 0xa9d21
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
xchg dword [esp + 0x38], edi
call fcn.00055989

Function at 0xab6f6
Capabilities:
Encrypt data using aes

Disassembly:
push 0xce91fddb
lea esp, [esp + 0x38]
jne 0x760fe
pushfd
jmp 0x7582d
Function at 0xab8b4
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xab5a4
pushal
sub eax, 0xfffc
call fcn.000a0e17
aas
pop ss
push 0xffffffffffffffb0
mov word [esp + 8], 0x8dcc
push dword [esp]
lea esp, [esp + 0x2c]
jne fcn.0007f58f
sbb cx, 0x1471
sbb cl, dl
push 0x30
btr ecx, ebp
stc
ror cl, cl
pop ecx
jns 0xad37b
stc
cmp si, cx
call fcn.000561e4
test eax, 0x812e47f8
jae 0x9799b
push ebp
fidiv word [eax]
pop ebx
out 0x4d, al
sahf
sbb byte cs:[esi - 0x334f111a], ah
bound eax, qword [ecx + 0x5e]
hlt
cwde
inc eax
mov dword [ebp + ebx - 0x56], ecx
cmp dh, al
leave
js 0x979a7
or byte [edx - 0x1a], al
push ebx
cmp dh, byte [ebp + 0x4a]
ret
jb 0xcd777
not al
test dl, al
mov eax, edx
push 0xc07d3b4c
movzx eax, word [eax + 0xc]
cmc
jmp 0x954ed
jmp 0x978fb
cmc
cmp si, cx
jmp 0x80312

Function at 0xad056
Capabilities:
Encrypt data using aes

Disassembly:
cmp dl, ah
call fcn.00056672
lea esp, [esp + 0x48]
jne fcn.0007f58f
bt sp, bp
btr dx, 7
or cl, al
clc
mov byte [esi + 0x64], 1
das
dec esi
mov esi, dword [ebp + 0xc]
and dh, 0x11
ror al, 7
mov edx, dword [ebp + 8]
and cl, ch
adc ax, 0x7ff0
cmp ax, ax
mov eax, dword [esi + 0x13]
neg cl
mov cl, byte [edx + 4]
clc
bt di, dx
mov byte [eax], cl
sar al, 6
mov al, byte [ebp - 1]
bt bx, di
jmp 0xa3928

Function at 0xae077
Capabilities:
Encrypt data using aes

Disassembly:
and eax, ebx
bts di, 0xf
mov eax, dword [eax*4 + 0x33df8]
and di, dx
xor eax, 0x1000000
add di, ax
cmp ch, ah
adc di, di
movzx edi, cl
mov edi, ecx
test ax, 0xda74
cmp ecx, 0xafd3b98
stc
cmp sp, bp
shr edi, 8
call fcn.00099e00

Function at 0xb0b0d
Capabilities:
Encrypt data using aes

Disassembly:
xchg dword [esp + 0x2c], edi
push dword [esp]
movzx edi, cl
mov di, word [esp]
lea esp, [esp + 0x30]
jns 0xb1eb3
mov edi, 0x1ba2b
push esp
push 0x9f706b23
pushfd
mov byte [esp + 4], 0x13
mov edi, dword [edi + 0x41808]
pushal
lea edi, [edi + 0x74ed9fe2]
push dword [esp]
push esi
xchg dword [esp + 0x34], edi
mov byte [esp], 0xfb
push 0x1232c38
mov byte [esp + 8], bh
push dword [esp + 0x38]
ret 0x3c
jmp 0x5f180
not edi
mov di, 0x7f4
movsx edi, bl
mov edi, 0x1ba2b
pushal
pushal
call fcn.0006d21e
invalid
invalid
sub dl, byte [esi]

Function at 0xb0c4c
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.000afef8
jmp 0x65e6b
push dword [esp]
lea esp, [esp + 0x1c]
jo 0x6d211
lea ecx, [ecx - 0x5ab575d7]
jmp 0x66ae1

Function at 0xb0fa5
Capabilities:
Encrypt data using aes

Disassembly:
pushal
mov esi, dword [esi + 0x2a2dd]
mov byte [esp], bh
pushfd
lea esi, [esi - 0x31cfaa1b]
call fcn.00066ac7

Function at 0xb56f3
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x9e8a2
push 0xd0b50b72
mov word [esp], bx
mov byte [ecx - 2], al
call fcn.00052371
mov edx, 0x1fef7
call fcn.00059c50
mov byte [esp], cl
lea esp, [esp + 0x54]
je 0x85319
dec cl
mov ecx, dword [ebp - 0xc]
cmc
or al, 0x80
jmp 0x56aa9
Function at 0xb6bd8
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00056949
lea esp, [esp + 0x48]
jp 0x5c03e
call fcn.00012f4e
neg di
or ah, 0x9a
push esp
aaa
mov eax, dword [esi + 0x13]
neg edi
pushal
stc
mov byte [eax + 1], bl
shl ax, cl
bsf ax, di
adc di, 0x47a1
pop eax
mov eax, dword [esi + 0x13]
movzx bx, al
sar bl, cl
clc
movsx di, dl
mov byte [eax + 2], 2
xor bx, ax
mov eax, dword [ebp - 0x10]
sub esp, 0xffffffe0

Function at 0xcea25
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
push 0x4d6660d8
movsw word es:[edi], word [esi]
mov word [esp], di
lea esp, [esp + 0x50]
jmp fcn.0007f58f

Function at 0xcf5a5
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
invalid
mov word [esp + 8], di
pushfd
push dword [esp]
mov dword [esp + 0x34], eax
push esp
setnp ah
mov eax, 0x1ddaf
call fcn.00097c88
test al, 0x29
cmp ax, sp
xor edx, ecx
cmc
call fcn.000ac512
or eax, 0xdd84553f
sbb esp, dword [edx + 0x336a99d6]
loope 0xcf56d
cmp eax, 0x8058b1aa
imul esi, dword [ecx + 0xd60904], 0xffffffe5
add ch, ah
cmp eax, eax
loop 0xcf63e
ljmp 0xba7e:0xb13e6853
loopne 0xcf620
dec ebp
inc edi
test dword [eax], ecx
or eax, ebx
insd dword es:[edi], dx
adc byte [edx - 0xa], al
add byte [ecx + 0x30ee611], ah
mov al, 0x55
add al, 6
cmp ecx, ecx
push ss
sal byte [edi + edx - 0x3f2d45c6], 0x37
stosd dword es:[edi], eax
mov ah, 0x17
cmp bh, byte [edx - 0x54c83f2e]
jmp 0xcf5e4
mov esp, 0x10af1956
push ss
mov bh, 0xdc
jnp 0xcf606
cmpsb byte [esi], byte es:[edi]
loope 0xcf64f
clc
mov ebp, dword [esi + 0x54]
push es
test al, 0x1e
or dword [esi + 0x30f0469c], 0x7e40a4a5
aas
dec eax
and ebp, dword [ecx + 0x75]
out 0x91, al
adc dh, dh
xchg ecx, eax
invalid

Function at 0xcffd3
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 4], 0x1a
pushal
xchg dword [esp + 0x24], edi
call fcn.00075845
Function at 0x38c10e49
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x38c2834c]
sub esp, 0x10
cmp eax, 0xaaaaaaaa
jne 0x38c10ec6
push edi
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x38c10ee8
push 0x80000002
mov edi, 0x6400000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x38c10ebe
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x38c10ec8
push dword [ebp - 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x38c10eb5
cmp dword [ebp - 4], 4
jne 0x38c10eb5
cmp dword [ebp - 0xc], 4
jne 0x38c10eb5
mov edi, dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov dword [0x38c2834c], eax
pop edi
leave
ret

Function at 0x38c11422
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x25c]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x270], ecx
mov ebx, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x38c11511
cmp eax, esi
ja 0x38c11511
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, eax
test ebx, ebx
jl 0x38c11511
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [fcn.38c05984]
test eax, eax
je 0x38c1150c
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x25c]
push ecx
push 0x38c11524
add eax, 0x238
push esi
push eax
call fcn.38c06580
mov ebx, eax
add esp, 0x14
test ebx, ebx
jl 0x38c11511
mov esi, dword [ebp - 0x270]
mov eax, dword [edi]
push 0
push 0
add esi, 0x238
push esi
push 5
push edi
call dword [eax + 0x18]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x38c11511
push eax
push 0x80
push 3
push eax
push eax
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x270]
mov dword [ecx + 0x440], eax
cmp eax, 0xffffffff
jne 0x38c11511
mov ebx, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 4
Function at 0x38c123de
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x4d0]
push ecx
push eax
call fcn.38c16cff
mov esi, eax
test esi, esi
je 0x38c124cf
push 0
push esi
call fcn.38c16ee3
mov dword [ebp - 0x4c4], eax
test eax, eax
je 0x38c124c2
and dword [ebp - 0x4c0], 0
push 0x2b0
lea eax, [ebp - 0x4bc]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push 0x2b4
lea eax, [ebp - 0x4c0]
push eax
push 0
push dword [ebp - 0x4c4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x38c124b6
cmp dword [esi], 1
jbe 0x38c124a6
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x14b
push dword [0x38c270d0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.38c06580
add esp, 0x10
jmp 0x38c124b6
lea eax, [ebp - 0x4b4]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.38c074ef
push dword [ebp - 0x4c4]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x4d0]
push eax
push esi
call fcn.38c16d61
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 0xc

Function at 0x38c12b99
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
call 0x38c44c12
xor edi, edi
cmp eax, edi
je 0x38c12bea
push 1
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
xor eax, eax
jmp 0x38c12c45
push edi
push dword [ebp - 0x2bc]
call fcn.38c12917
mov dword [esi], eax
cmp eax, edi
je 0x38c12c42
cmp ebx, edi
je 0x38c12c42
push dword [ebp + 0xc]
push ebx
push eax
call fcn.38c12b0a
push 0x108
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp - 0x2b8]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x38c12c42
mov eax, dword [ebp - 0x2b8]
push edi
push eax
push 0x402
push dword [esi]
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 0x10
Function at 0x38c1a9f4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push dword [ebp + 0x10]
push 0x50
call fcn.38c1a2cc
test eax, eax
mov dword [ebp - 4], eax
jne 0x38c1aa0f
leave
ret
push ebx
push esi
push edi
cld
mov edi, dword [ebp - 4]
mov eax, 0
mov ecx, 0x50
or ecx, ecx
je 0x38c1aa26
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0x38c1aa2e
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x38c274bc
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0x38c1aaa1
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0x38c1aaa3
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0x38c1aada
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x38c27f4c
push dword [0x38c274d0]
push eax
push ebx
push dword [ebp - 4]
call 0x38c44c12
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0x38c1aafd
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x38c1ab0d
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.38c1a2ec
xor eax, eax
inc eax
leave
ret