joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x422ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x422ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10118b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9de000]
push edi
jmp 0x10118ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10118d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10118c0
mov eax, 1
add ebx, ebx
jne 0x10118e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10118f4
jne 0x1011913
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1011913
dec eax
add ebx, ebx
jne 0x1011900
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10118d8
add ebx, ebx
jne 0x101190f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1011965
xor ecx, ecx
sub eax, 3
jb 0x101192b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101199a
sar eax, 1
mov ebp, eax
jmp 0x1011936
add ebx, ebx
jne 0x1011936
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1011904
inc ecx
add ebx, ebx
jne 0x1011944
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1011904
add ebx, ebx
jne 0x1011951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1011946
jne 0x1011962
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1011946
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1011984
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1011976
jmp 0x10118c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1011984
add edi, ecx
jmp 0x10118c6
pop esi
mov edi, esi
mov ecx, 0x1034e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10119a2
cmp byte [edi], 0x4b
jne 0x10119a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10119a7
lea edi, [esi + 0xc0d000]
mov eax, dword [edi]
or eax, eax
je 0x1011a1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc73918]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc73ad8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10119d4
mov ecx, edi
jns 0x1011a03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc73ae0]
or eax, eax
je 0x1011a19
mov dword [ebx], eax
add ebx, 4
jmp 0x10119f1
call dword [esi + 0xc73adc]
mov ebp, dword [esi + 0xc73ae4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1011a53
sub esp, 0xffffff80
jmp 0x63dbeb
Function at 0x1b2260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1b229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x1b22a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x1b2280
jmp 0x1b22a3
mov eax, 0x1505
jmp 0x1b22a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x1b8cb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x1b8d15
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x1b8cd0
mov eax, 0x270
jmp 0x1b8def
cmp eax, 0x4e0
jb 0x1b8def
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x1b8d30
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x1b8d80
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
mov edx, ecx
xor edx, 0x1039ffff
or ecx, 0xefc60000
and ecx, edx
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x1b9e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
push eax
sub esp, 0x18c
mov esi, esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x18
mov dword [ebp - 0x14], esp
sub esp, 0x80
mov dword [ebp - 0x10], esp
sub esp, 0x100
mov ebx, esp
mov dword [ebp - 0x20], ebx
push eax
mov edi, esp
push eax
mov dword [ebp - 0x38], esp
sub esp, 0x6c
mov dword [ebp - 0x34], esp
sub esp, 0x24
mov dword [ebp - 0x24], esp
sub esp, 8
mov dword [ebp - 0x2c], esp
sub esp, 0x40
mov dword [ebp - 0x28], esp
sub esp, 0x80
mov dword [ebp - 0x30], esp
mov eax, dword [0x1f48b4]
mov dword [ebp - 0x4e], 0x5ba959af
mov dword [ebp - 0x4a], 0x5f815d6e
mov dword [ebp - 0x46], 0x63506153
mov dword [ebp - 0x42], 0x6782654a
mov dword [ebp - 0x3e], 0x6b866984
mov word [ebp - 0x3a], 0x6d6c
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x98
xor dl, byte [ebp + ecx - 0x4e]
add dl, 0x40
mov byte [ebp + ecx - 0x4e], dl
inc ecx
cmp ecx, 0x16
jne 0x1b9f00
lea ecx, [ebp - 0x4e]
push 0x800
push 0
push ecx
call eax
mov ecx, 0x1f48b8
push eax
call 0x1e7500
movzx eax, al
mov eax, dword [eax*4 + 0x1ee6d8]
mov ecx, 0xe39cb76e
xor ecx, dword [0x1ee6e0]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x1c90f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 0x10], 0x157e133d
mov dword [esp + 0x14], 0x19771785
mov dword [esp + 0x18], 0x1d1c1b74
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x10]
mov edi, eax
and edi, 4
mov edx, ecx
xor edx, 0x380dc102
add edx, edi
lea ebx, [esi + esi]
not ebx
add ebx, esi
mov edi, esi
not edi
or edi, ebx
mov ebx, edx
not ebx
or ebx, esi
and edi, edx
sub edx, esi
add edx, ebx
not edx
or edx, edi
add dl, 0xf0
mov byte [esp + ecx + 0x10], dl
inc ecx
add eax, 2
cmp ecx, 0xc
jne 0x1c9120
mov dword [esp + 0x34], 0xb447b249
mov dword [esp + 0x38], 0x4847b641
mov dword [esp + 0x3c], 0x4c744a83
mov dword [esp + 0x40], 0x40b34e72
mov dword [esp + 0x44], 0x44a042be
mov dword [esp + 0x48], 0x58bb46a4
mov dword [esp + 0x4c], 0x5ca45aa1
mov dword [esp + 0x50], 0x50ab5eae
mov dword [esp + 0x54], 0x5453529b
mov eax, 0x79
mov ecx, 0x86
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x45]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x38
mov byte [esp + eax - 0x45], dl
inc eax
dec ecx
cmp eax, 0x9d
jne 0x1c91c0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x1c9213
lea edx, [esp + 0x36]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c9200
jmp 0x1c9216
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
mov edx, esi
mov esi, dword [ebp + 0xc]
je 0x1c9241
add edx, 2
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c9230
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x1c9271
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c9260
mov word [eax], 0
mov edi, dword [esi]
mov dword [esp + 0x34], 0x64696bd7
mov byte [esp + 0x38], 0xc1
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 3
xor edx, 0x1b
mov ecx, eax
and ecx, 4
sub ecx, edx
xor cl, byte [esp + eax + 0x34]
add cl, 0xd8
mov byte [esp + eax + 0x34], cl
mov ecx, eax
xor ecx, 1
and eax, 1
lea eax, [ecx + eax*2]
cmp eax, 5
jb 0x1c9290
movzx eax, byte [esp + 0x34]
test al, al
je 0x1c92db
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x1c92d0
mov esi, edi
mov byte [edi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x20]
lea edi, [esp + 0x14c]
push eax
push ecx
push edx
push edi
call fcn.001bb0b0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x1efbcc]
mov ecx, 0x3073106a
xor ecx, dword [0x1efbd4]
add eax, ecx
inc eax
jmp eax
Function at 0x100258c4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x18]
movzx ecx, word [ecx + 0x14]
lea ecx, [eax + ecx + 0x18]
mov ebx, 0x24932d1a
xor esi, esi
lea edi, [edi + edx - 0x17]
mov dword [ebp - 0x14], edi
jmp 0x10025910
mov ebx, 0xe8dd7833
nop word cs:[eax + eax]
cmp ebx, 0x484b77b5
jg 0x10025950
cmp ebx, 0x327e72b1
jg 0x10025960
cmp ebx, 0x24932d19
jg 0x10025973
cmp ebx, 0x75babbb
jg 0x10025999
cmp ebx, 0x82b10f00
jg 0x100259bf
cmp ebx, 0x80397a8d
jne 0x10025910
jmp 0x10025a63
cmp ebx, 0x484b77b6
jne 0x10025910
jmp 0x10025900
cmp ebx, 0x327e72b2
jne 0x10025910
add ecx, 0x28
inc esi
mov ebx, 0x24932d1a
jmp 0x10025910
cmp ebx, 0x24932d1a
jne 0x10025910
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx + 0x18]
movzx ebx, word [ebx + 6]
cmp esi, ebx
mov ebx, 0xe8dd7833
mov edi, 0xea73ef4c
cmovb ebx, edi
jmp 0x10025910
cmp ebx, 0x75babbc
jne 0x10025910
mov ebx, dword [ecx + 8]
add ebx, dword [ecx + 0xc]
cmp edx, ebx
mov ebx, 0xd69c0f08
mov edi, 0xc0c5841d
cmovb ebx, edi
jmp 0x10025910
cmp ebx, 0xc0c5841c
jg 0x100259ea
cmp ebx, 0x82b10f01
jne 0x10025910
mov ebx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x14]
add eax, edx
add eax, dword [ebx]
sub eax, dword [ecx + 0xc]
mov ebx, 0x80397a8d
jmp 0x10025910
cmp ebx, 0xd69c0f07
jg 0x10025a19
cmp ebx, 0xc0c5841d
jne 0x10025910
mov ebx, dword [ecx + 8]
add ebx, dword [ecx + 0xc]
cmp dword [ebp - 0x14], ebx
mov ebx, 0xd69c0f08
mov edi, 0x82b10f01
cmovbe ebx, edi
jmp 0x10025910
cmp ebx, 0xd69c0f08
je 0x10025a35
cmp ebx, 0xe8dd7833
jne 0x10025a3f
mov ebx, 0x80397a8d
xor eax, eax
jmp 0x10025910
mov ebx, 0x327e72b2
jmp 0x10025910
cmp ebx, 0xea73ef4c
jne 0x10025910
mov ebx, 0x484b77b6
cmp edx, dword [ecx + 0xc]
jb 0x10025910
mov ebx, 0x75babbc
jmp 0x10025910
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10036340
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x31203a0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jmp 0x10036360
dec ecx
nop word cs:[eax + eax]
mov edi, 0xe0d3b82a
test ecx, ecx
mov edx, 0x5b7b136a
cmovne edx, edi
mov edi, 0xc9224a59
jmp 0x10036390
movzx edi, byte [esi]
inc esi
xor edi, eax
imul eax, edi, 0x1000193
mov edi, 0xdfaefd69
nop word [eax + eax]
mov ebx, edi
cmp ebx, 0x5b7b1369
jg 0x100363b6
cmp ebx, 0xc9224a59
mov edi, edx
je 0x10036390
cmp ebx, 0xdfaefd69
je 0x10036353
cmp ebx, 0xe0d3b82a
jne 0x100363d0
jmp 0x10036376
cmp ebx, 0x5b7b136a
jne 0x100363d0
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x100363d0

Function at 0x10036640
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
mov esi, 0x14d09c1f
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edi
jmp 0x10036680
not eax
mov esi, 0xf525e28
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
mov edi, 0x20403ab4
jmp 0x10036690
dec edx
mov esi, 0x427c6bb8
nop dword [eax]
cmp esi, 0xae5cac45
jg 0x100366b0
cmp esi, 0x825b17b8
jne 0x10036690
jmp 0x10036687
cmp esi, 0xbb1ad64e
jg 0x100366d0
cmp esi, 0xae5cac46
jne 0x10036690
shr ecx, 1
mov esi, 0xbd6ec0eb
jmp 0x10036690
cmp esi, 0x62bf1aa3
jg 0x10036743
cmp esi, 0x5ab62e6b
jg 0x1003675e
cmp esi, 0x427c6bb7
jg 0x10036779
cmp esi, 0x3b19a5c7
jg 0x10036794
cmp esi, 0x25103f17
jg 0x100367a5
cmp esi, 0x20403ab3
jg 0x100367b6
cmp esi, 0x14d09c1e
jg 0x100367c7
cmp esi, 0xbd6ec0ea
jg 0x100367ec
cmp esi, 0xbb1ad64f
jne 0x10036690
shr ecx, 1
xor ecx, dword [ebp - 0x14]
mov esi, 0xbd6ec0eb
jmp 0x10036690
cmp esi, 0x62bf1aa4
jne 0x10036690
mov ebx, 0xedb88320
mov esi, 0x25103f18
jmp 0x10036690
cmp esi, 0x5ab62e6c
jne 0x10036690
shr eax, 8
xor eax, ecx
mov esi, 0xf525e28
jmp 0x10036690
cmp esi, 0x427c6bb8
jne 0x10036690
test edx, edx
mov esi, 0x5ab62e6c
cmovg esi, edi
jmp 0x10036690
cmp esi, 0x3b19a5c8
jne 0x10036690
jmp 0x10036892
cmp esi, 0x25103f18
jne 0x10036690
jmp 0x10036670
cmp esi, 0x20403ab4
jne 0x10036690
jmp 0x10036860
cmp esi, 0x14d09c1f
jne 0x10036690
mov esi, 0xeae27106
cmp dword [ebp - 0x10], 0
jne 0x10036690
mov esi, 0x62bf1aa4
jmp 0x10036690
cmp esi, 0xeae27105
jg 0x1003680a
cmp esi, 0xbd6ec0eb
jne 0x10036690
mov esi, 0x825b17b8
jmp 0x10036690
cmp esi, 0xeae27106
je 0x10036844
cmp esi, 0xf525e28
je 0x10036875
cmp esi, 0x103bf691
jne 0x10036690
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
movzx ecx, al
xor ecx, edx
mov esi, 0x427c6bb8
mov edx, 8
jmp 0x10036690
mov esi, 0x25103f18
mov ebx, dword [ebp + 0x14]
jmp 0x10036690
test cl, 1
mov esi, 0xae5cac46
mov edi, 0xbb1ad64f
cmovne esi, edi
jmp 0x10036680
mov esi, dword [ebp - 0x1c]
test esi, esi
lea esi, [esi - 1]
mov dword [ebp - 0x1c], esi
mov esi, 0x3b19a5c8
mov edi, 0x103bf691
cmovne esi, edi
jmp 0x10036680
not eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402643
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x40265c
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40267b
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x402672
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40266a
mov eax, ebx
leave
ret

Function at 0x4026bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x4026df
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x4026eb
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x40273a
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x402726
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x402710
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40c8f1
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040caa1
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40c9ef
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40c992
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40c9d5
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40c9a9
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40c9c4
test al, 0x40
je 0x40c9bb
mov ecx, dword [edi + 0x20]
jmp 0x40c9c2
test al, 0x80
je 0x40c9d5
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40c9d5
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40c961
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x417c6f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret

Function at 0x417d1a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
leave
ret

Function at 0x41ef71
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x41ef8a
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x41efa9
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x41efa0
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x41ef98
mov eax, ebx
leave
ret

Function at 0x41efeb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x41f00d
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x41f019
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x41f068
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x41f054
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x41f03e
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x429bff
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x429c36
mov esp, ebp
pop ebp
ret
Function at 0x438570
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e69ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004d9199
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4385f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004d6a42
mov eax, dword [eax]
push 0x56cd30
push eax
call fcn.004c8344
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004d9424
test bl, bl
je 0x4385f2
push 0x56cd30
lea ecx, [esp + 0xc]
call fcn.004d9800
push 0x56cd3c
lea ecx, [esp + 0xc]
call fcn.004d9800
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43862e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004d9424
jmp 0x4386f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4386b2
lea edx, [esp + 0x7c]
push 0x56cd38
push edx
call fcn.004c8344
add esp, 8
test eax, eax
je 0x4386b2
lea eax, [esp + 0x7c]
push 0x56cd34
push eax
call fcn.004c8344
add esp, 8
test eax, eax
je 0x4386b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x438642
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004d9424
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x438f00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x438f62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc