joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c920
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x120
mov eax, dword [0x4320d0]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x128]
mov eax, ebx
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0x10
jb 0x41c949
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ca9f
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x41caf3
xor ebp, ebp
mov esi, 0x42ac90
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x41c970
sub esi, ecx
mov dword [esp + 0x10], ebx
cmp dword [ebx + 0x14], 0x10
jb 0x41c989
mov eax, dword [ebx]
mov dword [esp + 0x10], eax
test esi, esi
je 0x41c9e3
cmp ebp, edi
jae 0x41c9e3
push pe_nt_image_headers32
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x42ac90
lea edx, [esi + 0x42ac90]
add esp, 0xc
cmp edx, ecx
je 0x41c9c1
movzx eax, byte [ecx]
inc ecx
mov byte [esp + eax + 0x2c], 1
cmp ecx, edx
jne 0x41c9b4
mov esi, dword [esp + 0x10]
lea edx, [edi + esi]
lea eax, [esi + ebp]
cmp eax, edx
jae 0x41c9e3
nop
movzx ecx, byte [eax]
cmp byte [esp + ecx + 0x2c], 0
jne 0x41caba
inc eax
cmp eax, edx
jb 0x41c9d0
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 0x14], 0
mov esi, edi
mov dword [esp + 0x24], 0
cmovne esi, eax
mov dword [esp + 0x28], 0xf
cmp edi, esi
mov ecx, esi
mov eax, ebx
cmovb ecx, edi
cmp dword [ebx + 0x14], 0x10
jb 0x41ca17
mov eax, dword [ebx]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401f20
cmp dword [esp + 0x24], 0
je 0x41ca5f
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ca5f
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 4
test eax, eax
jne 0x41cac1
mov ecx, dword [esp + 0x28]
lea ebp, [esi + 1]
cmp ecx, 0x10
jb 0x41ca94
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ca8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41caf7
push ecx
push edx
call fcn.0042441b
add esp, 8
mov edi, dword [ebx + 0x10]
cmp ebp, edi
jb 0x41c966
mov al, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424429
add esp, 0x120
ret
sub eax, esi
jmp 0x41c9e6
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x41caf3
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41cae9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41caf7
push ecx
push edx
call fcn.0042441b
add esp, 8
xor al, al
jmp 0x41caa1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x41d310
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427475
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4320d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
call fcn.00421230
mov edi, eax
mov dword [ebp - 0x48], edi
lea esi, [edi + 0x30]
push esi
mov dword [ebp - 0x50], esi
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x41d433
push 0x64
mov dword [ebp - 4], eax
call fcn.004243eb
add esp, 4
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x41d3b3
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_3e97ee1a117ac990b5f02fd2a9af9208___void___.0
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], ecx
push dword [ebp - 0x40]
mov ebx, 1
mov byte [ebp - 4], 2
push dword [ebp - 0x44]
mov dword [ebp - 0x3c], ebx
push ecx
mov ecx, eax
call fcn.00423df0
mov edi, eax
jmp 0x41d3b5
xor edi, edi
or ebx, 2
test bl, 1
je 0x41d3d5
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41d3d5
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x4c]
add eax, 0x110
cmp eax, ecx
je 0x41d3f8
mov ebx, dword [eax]
mov dword [eax], edi
test ebx, ebx
je 0x41d40e
mov ecx, ebx
call fcn.00424010
push 0x64
push ebx
jmp 0x41d406
test edi, edi
je 0x41d40e
mov ecx, edi
call fcn.00424010
push 0x64
push edi
call fcn.0042441b
add esp, 8
push esi
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424429
mov esp, ebp
pop ebp
ret
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3

Function at 0x421510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x42151c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x4217b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42783d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4320d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
add eax, 8
mov dword [ebp - 4], 0
push eax
call fcn.00402150
cmp dword [ebp - 0x14], 0x10
lea edi, [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmovae edi, dword [ebp - 0x28]
xor ecx, ecx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x421821
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x421810
push edx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [esi + 0x90]
call fcn.00416e50
mov eax, dword [eax + 4]
test eax, eax
jne 0x421842
mov eax, dword [esi + 0x94]
cmp eax, dword [esi + 0x94]
lea eax, [ebp - 0x28]
push eax
jne 0x42192a
lea ecx, [esi + 0x90]
call fcn.0041b750
mov ecx, dword [ebp + 8]
or edi, 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov esi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0x42189f
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x42189f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x42189f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4218d5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4218cb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4218cb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042441b
add esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
je 0x42190c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x42190c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x42190c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424429
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x40]
push str.logger_with_name_
push eax
call fcn.004033a0
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
push str._already_exists
push eax
push ecx
call fcn.00402020
add esp, 0xc
call fcn.00421f70
int3
Function at 0x423480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427d55
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4320d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push dword [edi + 8]
mov esi, dword [eax + 8]
push esi
push 1
push dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, esi
jne 0x4234e5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424429
mov esp, ebp
pop ebp
ret 4
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041d0f0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.Failed_writing_to_file
push eax
call fcn.00403330
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push esi
call fcn.00421f40
int3
Function at 0x423df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427f45
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4320d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], edi
movq qword [edi + 4], xmm0
lea eax, [edi + 0xc]
mov dword [ebp - 4], 0
push 2
push eax
call sub.MSVCP140.dll__Mtx_init_in_situ
lea eax, [edi + 0x3c]
push eax
call sub.MSVCP140.dll__Cnd_init_in_situ
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 2
test edx, edx
jl 0x423f49
mov eax, dword [ebp + 0xc]
jg 0x423e68
test eax, eax
je 0x423f49
lea ecx, [ebp - 0x40]
mov byte [edi], 1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x1c], 0
mov ecx, dword [esi + 0x24]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x423e97
mov eax, dword [ecx]
lea edx, [ebp - 0x40]
push edx
call dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0x38
mov byte [ebp - 4], 4
call fcn.004243eb
mov esi, eax
add esp, 4
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x423ee7
mov eax, dword [ebp - 0x48]
lea ebx, [esi + 8]
mov dword [esi], eax
mov dword [ebp - 0x50], ebx
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x423ed9
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
jmp 0x423ee9
xor esi, esi
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 7
push eax
push 0
push esi
push 0x423ce0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x58], ecx
test ecx, ecx
je 0x423f6c
cmp dword [edi + 8], 0
je 0x423f1e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x54]
xorps xmm0, xmm0
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x1c]
movlpd qword [ebp - 0x58], xmm0
mov dword [edi + 8], eax
test ecx, ecx
je 0x423f4c
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x423f4c
mov byte [edi], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424429
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [ebp - 0x54], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x4253b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x4253f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4253f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4253f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4253f7
cmp dword [ecx + 0x74], 0xe
jbe 0x4253f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10007fbe
pop dword [ebp - 0x1c]
mov eax, 0x10007fbe
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xeae2cd16
add dword [ebp - 0x2c], 0x636f7835
mov dword [ebp - 0x28], 0x7089a608
sub dword [ebp - 0x28], 0x3e5659c3
mov dword [ebp - 0x24], 0x389081bc
sub dword [ebp - 0x24], 0xec443d8e
mov dword [ebp - 0x20], 0xc8b186e2
add dword [ebp - 0x20], 0x374e791e
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x4c4b164f
sub eax, 0x3c4955cf
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x132a5752
add dword [ebp - 0x2c], 0x61481204
mov dword [ebp - 0x28], 0x46ba6b68
add dword [ebp - 0x28], 0xfab1f60d
mov dword [ebp - 0x24], 0x221e28c3
add dword [ebp - 0x24], 0x415143a9
mov dword [ebp - 0x20], 0x5e3ed886
sub dword [ebp - 0x20], 0x5e3ed886
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xab51857b
add eax, 0x64b03a85
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37903
push 0
call eax
mov ecx, 0x52c53b24
sub ecx, 0x52c4f2e0
xor edx, edx
add edx, eax
mov esi, 0x63c1db45
sub esi, 0x53bf7345
add esi, dword [ebp - 0x1c]
mov ebx, 0x2000b04e
sub ebx, 0x77f07fa3
xor dword [ebp - 8], 0x2e0015f8
mov edi, dword [esi]
sub dword [ebp - 0x18], esi
sub edi, ebx
xor dword [ebp - 4], 0xb45b6bc9
mov dword [edx], edi
xor dword [ebp - 4], 0x101c945
add edx, 0x73fba672
add edx, 0x8c045992
add esi, 4
loop 0x100080dd
add eax, 0x113e3
mov ebx, eax
add eax, 5
mov ecx, 0xf9d33a97
sub ecx, 0xe9d33a97
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4011b5
pop dword [ebp - 8]
mov eax, 0x4011b5
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb63c779e
sub dword [ebp - 0x18], 0x67ea3253
mov dword [ebp - 0x14], 0xdc27f236
add dword [ebp - 0x14], 0x560b5a0f
mov dword [ebp - 0x10], 0x86be85db
add dword [ebp - 0x10], 0xc58dbe53
mov dword [ebp - 0xc], 0x1f899519
sub dword [ebp - 0xc], 0x1f899519
lea eax, [ebp - 0x18]
push eax
mov eax, 0x7d98a1b8
add eax, 0x82a82e9c
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb15b6b42
sub dword [ebp - 0x18], 0x3ce901ec
mov dword [ebp - 0x14], 0xf153f6d0
add dword [ebp - 0x14], 0x50186aa5
mov dword [ebp - 0x10], 0x6c054dfd
sub dword [ebp - 0x10], 0x895e191
mov dword [ebp - 0xc], 0xfea64f7e
sub dword [ebp - 0xc], 0xfea64f7e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x23503fd7
sub eax, 0x230f6f8b
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39ba7
push 0
call eax
mov ecx, 0xa9863bbc
add ecx, 0x567a0d03
mov ebx, eax
mov esi, 0xeda1fcfa
add esi, 0x129fb306
add esi, dword [ebp - 8]
mov edx, 0x5362b7a1
sub edx, 0x33120683
sub dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 4], 0x9c0a0013
xor edi, edx
add dword [ebp - 4], 0x35134292
mov dword [ebx], edi
mov dword [ebp - 4], 0xe49877fb
add ebx, 0x8f3b5026
add ebx, 0x70c4afde
add esi, 0x64fd735c
add esi, 0x9b028ca8
loop 0x4012d2
add eax, 0x74568810
sub eax, 0x74557241
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd7b03dbe
sub ecx, 0xd7703dbe
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x100250d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100250e3
pop dword [ebp - 0x10]
mov eax, 0x342dc121
sub eax, 0x242b703e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xaf54b6e5
sub dword [ebp - 0x20], 0x6102719a
mov dword [ebp - 0x1c], 0xaec8a65c
add dword [ebp - 0x1c], 0x836aa5e9
mov dword [ebp - 0x18], 0x7e119b81
sub dword [ebp - 0x18], 0x31c55753
mov dword [ebp - 0x14], 0xd3764104
sub dword [ebp - 0x14], 0xd3764104
lea eax, [ebp - 0x20]
push eax
mov eax, 0x5bd312ea
sub eax, 0x4bcfc1d2
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xfb0ad785
add dword [ebp - 0x20], 0x796791d1
mov dword [ebp - 0x1c], 0xcc895ab1
sub dword [ebp - 0x1c], 0x8b1cf93c
mov dword [ebp - 0x18], 0x76be1180
sub dword [ebp - 0x18], 0x134ea514
mov dword [ebp - 0x14], 0x3e59caf8
sub dword [ebp - 0x14], 0x3e59caf8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c96e
push 0
call eax
mov ecx, 0x3f47d58c
add ecx, 0xc0b8787c
mov edi, eax
mov esi, 0xb0a4d91c
sub esi, 0xa09c551c
add esi, dword [ebp - 0x10]
mov ebx, 0xb722e57e
sub dword [ebp - 8], ebx
mov edx, dword [esi]
xor dword [ebp - 8], 0x346bdfab
sub edx, ebx
add dword [ebp - 4], 0x69f323f7
mov dword [edi], edx
mov dword [ebp - 4], 0x5d7fd492
add edi, 4
add esi, 4
loop 0x100251fa
add eax, 0x12af3
xor ebx, ebx
add ebx, eax
add eax, 0x27cc4a61
sub eax, 0x27cc4a5c
mov ecx, 0x5bb83baf
sub ecx, 0x4bb83baf
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40aa91
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040ac41
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40ab8f
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40ab32
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40ab75
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40ab49
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40ab64
test al, 0x40
je 0x40ab5b
mov ecx, dword [edi + 0x20]
jmp 0x40ab62
test al, 0x80
je 0x40ab75
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40ab75
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40ab01
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x42c3e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x71358b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00707e9a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42c462
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00705c89
mov eax, dword [eax]
push 0xdcfcb8
push eax
call fcn.006f7394
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00708125
test bl, bl
je 0x42c462
push 0xdcfcb8
lea ecx, [esp + 0xc]
call fcn.007084b5
push 0xdcfcc4
lea ecx, [esp + 0xc]
call fcn.007084b5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42c49e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00708125
jmp 0x42c569
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA_1]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42c522
lea edx, [esp + 0x7c]
push 0xdcfcc0
push edx
call fcn.006f7394
add esp, 8
test eax, eax
je 0x42c522
lea eax, [esp + 0x7c]
push 0xdcfcbc
push eax
call fcn.006f7394
add esp, 8
test eax, eax
je 0x42c522
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42c4b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00708125
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42cdc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc