joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f8e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x422fc3
cmp edi, dword [esi + 0xc]
jge 0x422fc3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422fc3
cmp edi, dword [eax + 8]
jge 0x422fc3
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x422fc5
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4230c9
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4230fd
jmp fcn.0041840f
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x42316e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x423267
cmp eax, dword [edi + 0xc]
jge 0x423267
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4231bf
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x423250
cmp dword [ebp + 0xc], ebx
je 0x423250
jmp 0x4231e9
push 0x10
call fcn.00422e5a
cmp eax, ebx
je 0x4231d5
mov ecx, eax
call fcn.004230c0
mov esi, eax
jmp 0x4231d7
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x423200
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x423210
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x423222
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041840f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0040d8f0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x423262
cmp ecx, dword [esi + 8]
jge 0x423262
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x423268
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x423326
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423354
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423372
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423290
jmp 0x423372
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423372
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423290
test edi, edi
mov eax, edi
jne 0x42335c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x433cf4]
test ecx, ecx
je 0x423425
jmp 0x423325
ret 8
Function at 0x40f590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f5b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f5b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f5a8
mov eax, 1
add ebx, ebx
jne 0x40f5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f5c0
jne 0x40f5dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f5c0
xor ecx, ecx
sub eax, 3
jb 0x40f5f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f662
mov ebp, eax
add ebx, ebx
jne 0x40f5fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f62c
inc ecx
add ebx, ebx
jne 0x40f618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f60d
jne 0x40f629
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f60d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f64c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f63d
jmp 0x40f5ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f64c
add edi, ecx
jmp 0x40f5ae
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f66a
cmp byte [edi], 5
jne 0x40f66a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40f66f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f6de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10448]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x104fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f69c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10500]
or eax, eax
je 0x40f6d8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f6b9
call dword [esi + 0x10510]
mov ebp, dword [esi + 0x10504]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40f712
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x408ed3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408ee2
pop dword [ebp - 0x14]
mov eax, 0x408ee2
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x37b65
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x453c
mov esi, eax
mov edi, 0x7f6ff135
add edi, 0x80d1b8cb
add edi, dword [ebp - 0x14]
mov ebx, 0xb6edb4d6
add ebx, 0x52e63ff1
add dword [ebp - 4], 0xa0ba6dd2
mov edx, dword [edi]
xor dword [ebp - 0x10], ecx
add edx, ebx
mov dword [ebp - 0xc], 0xdecc7925
mov dword [esi], edx
mov dword [ebp - 4], 0xc43db993
add esi, 0xf13eeea0
add esi, 0xec11164
add edi, 4
loop 0x408f31
add eax, 0x7c9659db
add eax, 0x836aade8
mov ebx, eax
add eax, 0xe7ce19ce
sub eax, 0xe7ce19c9
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4863d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.00485f4a
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 8], cl
mov edx, dword [ebp + 8]
mov al, byte [edx + 1]
mov byte [ebp - 0xc], al
mov ecx, dword [ebp + 8]
add ecx, 2
mov dword [ebp - 4], ecx
mov word [ebp - 0x10], 0
jmp 0x48641a
mov dx, word [ebp - 0x10]
add dx, 1
mov word [ebp - 0x10], dx
movsx eax, word [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x4864f4
mov ecx, dword [ebp - 8]
and ecx, 0xff
add ecx, 1
and ecx, 0x800000ff
jns 0x486443
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 8], cl
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + edx]
mov edx, dword [ebp - 0xc]
and edx, 0xff
add ecx, edx
and ecx, 0x800000ff
jns 0x486472
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp - 4]
add ecx, eax
push ecx
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 4]
add eax, edx
push eax
call fcn.004862da
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
mov edx, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [edx + ecx]
add eax, ebx
and eax, 0x800000ff
jns 0x4864c9
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x14], al
movsx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp - 4]
mov al, byte [edx + eax]
xor al, byte [esi + ecx]
movsx ecx, word [ebp - 0x10]
mov edx, dword [ebp + 0x14]
mov byte [edx + ecx], al
jmp 0x48640e
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 8]
mov byte [eax], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0xc]
mov byte [edx + 1], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4406d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x44071b
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.00440340
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x447b08]
xor ebx, edx
dec edi
jne 0x4406f6
pop edi
test ebp, ebp
jle 0x440747
push 1
mov ecx, esi
call fcn.00440340
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x440744
xor ebx, 0x8005
dec ebp
jne 0x44071f
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x4018e8
Capabilities:
Encode data using xor

Disassembly:
push 0x401b70
call sub.MSVBVM50.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], bl
pop ebp
or byte [ecx + 0x50], bh
xor byte [ebx + ecx*2 - 0x5c], dl
jb 0x401901
lds ebp, [edi + esi*8 + 0x9d2e]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x6563694e
push ebx
insb byte es:[edi], dx
arpl word gs:[edi + ebp*2 + 0x72], si
add byte [ebx], ah
xor ch, byte [esi]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
nop
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
Function at 0xebb2a4
Capabilities:
Encode data using xor

Disassembly:
push 0x844
mov eax, 0xedfb30
call fcn.00ec156f
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x840], eax
mov edi, 0xff
mov ecx, esi
mov dword [ebp - 0x850], esi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x84c], ecx
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x844], 0x4fd7e7d
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x830], eax
push 0x20
pop ebx
or eax, 0xffffffff
shr eax, 1
dec ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x828], eax
cmp eax, 0x7ffffffd
ja 0xebb2f9
mov dword [ebp - 0x834], eax
add edi, 0x80000000
lea eax, [ecx - 0x80000000]
mov dword [ebp - 0x838], ebx
sub edi, eax
mov dword [ebp - 0x83c], eax
cmp edi, 0xffffffff
jne 0xebb35e
mov edi, esi
mov dword [ebp - 0x818], esi
lea ecx, [ebp - 0x830]
call fcn.00ebb669
lea ecx, [ebx - 1]
add esi, ebx
shl edi, cl
add edi, edi
or edi, eax
cmp esi, 0x20
jb 0xebb33c
xor esi, esi
jmp 0xebb406
lea eax, [edi + 1]
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], esi
mov eax, esi
mov dword [ebp - 0x820], eax
test edi, edi
je 0xebb3c9
mov esi, dword [ebp - 0x834]
lea eax, [ebx - 1]
mov ebx, dword [ebp - 0x814]
mov dword [ebp - 0x81c], eax
lea ecx, [ebp - 0x830]
call fcn.00ebb669
mov ecx, dword [ebp - 0x81c]
shl ebx, cl
add ebx, ebx
or ebx, eax
mov eax, dword [ebp - 0x820]
shl eax, cl
add eax, eax
or eax, esi
mov dword [ebp - 0x820], eax
cmp eax, edi
jb 0xebb38e
mov dword [ebp - 0x814], ebx
xor esi, esi
mov ebx, dword [ebp - 0x838]
xor edx, edx
lea ecx, [edi + 1]
div ecx
mov ecx, eax
mov dword [ebp - 0x81c], edx
mov eax, dword [ebp - 0x814]
xor edx, edx
div dword [ebp - 0x818]
cmp eax, ecx
jb 0xebb3f6
cmp dword [ebp - 0x81c], edi
jne 0xebb367
mov eax, dword [ebp - 0x814]
xor edx, edx
div dword [ebp - 0x818]
mov edi, edx
mov ecx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x83c]
add eax, edi
add eax, 0x80000000
mov byte [ebp + ecx - 0x810], al
inc ecx
mov dword [ebp - 0x824], ecx
cmp ecx, 0x800
jge 0xebb440
mov edi, dword [ebp - 0x848]
mov ecx, dword [ebp - 0x84c]
jmp 0xebb2f3
push 0x800
lea ecx, [ebp - 0x830]
call fcn.00ebb4f9
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x830]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cmp eax, 0x800
jne 0xebb489
lea ebx, [ebp - 0x810]
sub ebx, edi
mov eax, dword [ecx]
lea edx, [edi + esi]
mov cl, byte [ebx + edx]
xor cl, byte [eax + esi]
inc esi
mov byte [edx], cl
mov ecx, dword [ebp + 0xc]
cmp esi, 0x800
jl 0xebb470
mov ecx, dword [ebp - 0x840]
push edi
call fcn.00eb9191
lea ecx, [ebp - 0x830]
call fcn.00ebb591
mov eax, dword [ebp - 0x840]
call fcn.00ec1519
ret 8

Function at 0xebbc16
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0xebbc1e
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0xebbc31
shr eax, 4
and eax, 1
ret
xor al, al
ret
Function at 0xebd290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xedfeca
mov eax, dword fs:[0]
push eax
mov eax, 0x13a4
call fcn.00ec1cf0
mov eax, dword [0xef3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0xeedb34
lea ecx, [ebp - 0x28]
call fcn.00eb9191
and dword [ebp - 4], 0
call fcn.00ec00fa
xor esi, esi
lea ecx, [ebp - 0x28]
push 0
inc esi
or ebx, 0xffffffff
push esi
mov dword [ebp - 4], ebx
call fcn.00eb9ee8
call fcn.00ec00fa
mov dword [ebp - 0x2c], ebx
mov edx, 0x270
mov dword [ebp - 0x13ac], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [ebp + esi*4 - 0x13ac], eax
inc esi
cmp esi, edx
jl 0xebd301
mov dword [ebp - 0x13b0], edx
lea eax, [ebp - 0x13b0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], ebx
cmp edi, ebx
jne 0xebd34a
lea ecx, [ebp - 0x13b0]
call fcn.00ebd4be
cmp eax, ebx
ja 0xebd339
jmp 0xebd356
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00ebd44e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ec0b8d
mov esp, ebp
pop ebp
ret

Function at 0xebd4be
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0xebd506
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0xebd4ce
jmp 0xebd513
cmp dword [esi], 0x4e0
jb 0xebd513
call fcn.00ebd54d
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0xebd54d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0xebd55d
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0xebd59d
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0xebd6a9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xedecb3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0xef3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x2c]
mov dword [edi], 0xeedf1c
cmp dword [esi + 0x14], 8
jb 0xebd6e9
mov eax, dword [esi]
jmp 0xebd6eb
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
push ecx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00ebc6bc
pop ecx
cmp dword [eax + 0x14], 8
jb 0xebd708
mov eax, dword [eax]
push eax
call ebx
xor ebx, ebx
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00eb195d
push ebx
push 1
mov ecx, esi
call fcn.00eb195d
push ebx
push 1
lea ecx, [edi + 0x14]
call fcn.00eb195d
lea ecx, [edi + 4]
call fcn.00ebe6c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ec0b8d
mov esp, ebp
pop ebp
ret
Function at 0x414d50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4816fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004745b1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414dd2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00472067
mov eax, dword [eax]
push 0x49d214
push eax
call fcn.00464544
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047483c
test bl, bl
je 0x414dd2
push 0x49d214
lea ecx, [esp + 0xc]
call fcn.00474c18
push 0x4a0d60
lea ecx, [esp + 0xc]
call fcn.00474c18
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x414e0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047483c
jmp 0x414ed9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414e92
lea edx, [esp + 0x7c]
push 0x4a0d5c
push edx
call fcn.00464544
add esp, 8
test eax, eax
je 0x414e92
lea eax, [esp + 0x7c]
push 0x4a0d58
push eax
call fcn.00464544
add esp, 8
test eax, eax
je 0x414e92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414e22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047483c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4156d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x415732
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x415740
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48177b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4abf18]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x415878
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4157a6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047483c
xor eax, eax
jmp 0x4158ef
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004749c5
push esi
lea ecx, [esp + 0xc]
call fcn.00474c54
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4158cd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.004156d0
test eax, eax
jne 0x4158cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.004156d0
test eax, eax
jne 0x4158cd
lea eax, [esp + 0x14]
push 0x4a0d74
push eax
call fcn.004656f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4158ac
lea ecx, [esp + 0x14]
push 0x4a0d70
push ecx
call fcn.00465670
mov esi, eax
add esp, 8
test esi, esi
jne 0x4158ac
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4158af
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00474975
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4157be
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047483c
xor eax, eax
jmp 0x4158ef
mov byte [esi], 0
push 0x4a0d6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047483c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4