joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444140
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4743f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046784a
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046cee0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0046e3fc
test eax, eax
je 0x44425c
mov ecx, dword [esp + 0x3c]
call fcn.0046cf0d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x444220
push edi
mov ecx, esi
call fcn.0046a575
mov ecx, esi
call fcn.004443c0
cmp dword [esp + 0x38], 1
jne 0x444255
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046a6b0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x446c80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x446cb3
push esi
call fcn.00449d90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x446cac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x446d39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x446d22
mov eax, dword [esi + 8]
test eax, eax
je 0x446cd7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x446d1e
cmp eax, 2
je 0x446d22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x446cca
cmp eax, 3
je 0x446cfd
cmp eax, 1
jne 0x446cca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x446cca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x446cca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00446d60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x446d48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00446d60
add esp, 4
pop esi
ret

Function at 0x4528c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x452963
test eax, eax
jbe 0x452963
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x452963
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45290e
xor esi, esi
jmp 0x452914
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45293f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00407cc0
add esi, eax
push esi
mov ebx, esi
call fcn.00407cc0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x452920
pop ebp
test edi, edi
pop edi
jne 0x452963
test ebx, ebx
je 0x452963
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00457150
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x452aa5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x452bbd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x452bbd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00467c9c
mov esi, eax
test esi, esi
je 0x452bbd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x452bbd
mov ecx, esi
call fcn.00452a10
cmp edi, eax
jge 0x452bbd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x452b43
mov dword [esp + 0x34], 1
jmp 0x452b9e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x452bbd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00451fd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x468640
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x468678
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004666f4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004666cc
jmp 0x468684
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x469d32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x469d74
call fcn.0046f7e2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x469d74
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x469d6b
xor eax, eax
jmp 0x469d7c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00469d82
pop edi
pop esi
pop ebx
ret 4
Function at 0x46fd12
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46fd40
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46fd5e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046fc78
jmp 0x46fd5e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46fd5e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046fc78
test edi, edi
mov eax, edi
jne 0x46fd48
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6a2433
Capabilities:
Encrypt data using aes

Disassembly:
mov di, word [esp]
neg edi
jmp 0x6a1b23
xor eax, edi
mov di, word [esp]
mov edi, 0x4b5b508c
lea esp, [esp + 0x24]
xor eax, dword [ecx]
jmp 0x6a1ae2
xor ebx, eax
call fcn.006a1d13
sub esi, dword [ebx + reloc.WINMM.dll_midiStreamOut]
xor esi, dword [edx + ebp + reloc.WINMM.dll_midiStreamOut]
pushal
mov dword [reloc.WINMM.dll_midiStreamOut], eax
adc byte [ebx - 0x3b7ce314], al
pop es
lea edi, [ecx + 0x10]
sub esp, 0x1c
add esp, 7
mov byte [esp + 0xd], bh
lea esp, [esp + 1]
jmp 0x6a1b0b
clc
push edx
and edi, ebp
pushal
jmp 0x6a1af8
mov bp, 0xa7dd
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 4]
mov ebp, 0xff00
jmp 0x6a1b47
push edx
bsr bp, bp
xchg word [esp], bp
lea ebp, [ebp - 0xef]
and edi, esi
jmp 0x6a1d36
xor eax, edi
bswap edi
xchg edi, ebp
mov edi, edx
jmp 0x6a1ea6
mov eax, dword [ebp - 8]
pushal
lea esp, [esp + 0x13]
mov al, 0x72
lea eax, [edi + edi]
lea esp, [esp + 1]
jmp 0x6a2296
lea esp, [esp + 4]
jl 0x674a4e
jge 0x6a22b3
and eax, 0xbd4e2bbb
add eax, 0x2b88691e
inc edx
xchg word [esp + 1], bp
sub ebp, eax
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x67ed1c]
jmp 0x6a2152

Function at 0x6a9d3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1c]
push ebx
sub esp, 0xa
jmp 0x6aa089
lea esp, [esp + 2]
jmp 0x6aa073

Function at 0x6aa06b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
call fcn.006aa04a
lea esp, [esp + 8]
mov dword [esp + 0x18], 0
sub esp, 6
jmp 0x6aa12d
sub esp, 0
call 0x6aa0cb
lea esp, [esp + 4]
add edi, 8
nop
jmp 0x6a9f74
mov dword [esp], ebp
lea esp, [esp + 2]
lea esp, [esp + 4]
mov dword [esp + 0x20], eax
cmc
jmp 0x6aa0ec

Function at 0x6aa285
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x6aa32f
pop ds
mov word [edx], es
xchg esp, eax
push eax
mov ebx, dword [ecx]
mov eax, ebp
sbb esp, dword [edi + 0x2d32dbf8]
cmp al, 0xf
call 0x6aa4a3
mov eax, dword [esp + 0x20]
jmp 0x6a9dd3
pop word [esp]
jmp 0x6aa2d2
div ebp
cmc
mov dword [esp + 0x10], edx
clc
jmp 0x6aa3cb
lea esp, [esp + 1]
lea esp, [esp + 1]
popal
stc
jmp 0x6aa2b0
test edx, edx
jne 0x6a9d68
call 0x6aa36b
cmp ebp, edx
jb 0x6a9db6
cmc
sub esp, 0x1c
jmp 0x6aa5dc
push edx
push edx
add esp, 1
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x6aa39e
lea esp, [esp + 0x20]
jae 0x6a9db6
mov eax, ebx
cmc
call 0x6aa3f1
lea esp, [esp + 0x24]
sub ecx, dword [esp + 0x10]
add ecx, ebx
stc
jmp 0x6aa474
cmc
call fcn.006aa55f
cmp eax, ecx
call fcn.006aa4e8
ficom word [edi - 0x39]
mov byte [0xc844e851], al
pop esi
cmp eax, ecx
or eax, 0x2e8714e5
cmp dword [ebx], edi
out dx, al
cmp ebp, esi
push edx
lea esp, [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x6aa43c
mov byte [esp + 2], dh
push word [esp + 1]
lea esp, [esp + 2]
add esi, edx
push edx
jmp 0x6aa492

Function at 0x6aa387
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x6aa3ab
Function at 0x6aa425
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 8]
jb 0x6a9db6
call fcn.006aa46d
cmp edi, dword [esi + reloc.WINMM.dll_midiStreamOut]
setbe byte [ebx]
ret
cmp eax, ebx
push esp
pop word [esp]
mov word [esp], sp
mov byte [esp], ch
jmp 0x6aa3f3
add eax, ebp
clc
jmp 0x6aa40e

Function at 0x6aa4e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x6a9d95
jae 0x6a9db6
push dword [esp]
pop word [esp + 1]
pop word [esp + 1]
lea esp, [esp + 4]
jmp 0x6aa4ba

Function at 0x6aa53a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006aa544
xor eax, eax
jmp 0x6aa587
sub ebp, eax
jmp 0x6aa211
pop ebx
bswap ebp
mov edi, dword [esp]
jmp 0x6aa56f
pop edi
mov bp, sp
jmp 0x6aa590
mov ecx, dword [esp + 0x18]
pushal
jmp 0x6aa4c6
xchg ch, bl
jmp 0x6aa182
pop edx
mov ch, 0x8c
sub esp, 0x1c
pop word [esp + 9]
mov ch, bh
lea esp, [esp + 2]
jmp 0x6aa197
bswap esi
push edx
mov edx, edi
mov esi, dword [edx]
jmp 0x6aa13f
lea esi, [esi*4]
mov ebx, dword [edi + 0xc]
mov ecx, dword [esp]
not cx
mov si, sp
jmp 0x6aa165
mov ecx, dword [edi + 8]
jmp 0x6aa201
mov eax, esi
div ebp
mov al, 0xd6
jmp 0x6aa228
bswap eax
bswap eax
mov eax, ebp
jmp 0x6a9d7f
cmp eax, ebp
mov dx, word [esp]
xor edx, edx
mov al, byte [esp]
mov eax, dword [esp]
jmp 0x6aa1b4
lea esp, [esp + 0x18]
test ebx, ebx
je 0x6a9dd3
mov dh, bh
jmp 0x6aa1dc
rdtsc
mov eax, 0x3ce0e794
mov dx, ax
jmp 0x6aa29f
mov eax, edx
test edx, edx
jne 0x6a9d7f
lea eax, [esp + eax]
jmp 0x6aa1bc
xor edx, edx
not eax
mov eax, dword [esp]
bt eax, edx
lea eax, [ebx + esi]
jmp 0x6aa25a
pushal
bswap ebx
shr bx, cl
mov dword [esp + 0x1c], ecx
call fcn.006aa285
fst qword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
in eax, dx
push esi
lea esp, [esp + 0xc]
mov ebp, dword [esp + 0x14]
setae ah
xchg dx, ax
cmp dx, 0x502
jmp 0x6aa247
add esi, ebp
mov ax, word [esp]
sub esp, 0xc
rdtsc
mov eax, dword [esp + 9]
jmp 0x6aa270
lea esp, [esp + 0x20]
inc ecx
cmc
clc
sub esp, 0x1c
lea esp, [esp + 1]
jmp 0x6aa529
lea esp, [esp + 3]
lea esp, [esp + 0x18]
add edi, 0x28
stc
call fcn.006aa512
lea esp, [esp + 8]
mov dword [esp + 0x18], ecx
jmp 0x6aa5ae
lea edi, [ebx*4]
jmp 0x6a9da0
lea esp, [esp + 4]
jmp 0x6a9d95
mov esi, dword [esp]
lea esp, [esp + 4]
pop ebp
sub esp, 0xa
jmp 0x6aa5ba
jl 0x6a9f74
jge 0x6a9d04
push esp
lea esp, [esp + 2]
lea esp, [esp + 0xc]
add esp, 0x14
jmp 0x6aa63f
ret

Function at 0x6aa55f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
lea esp, [esp + 8]
add ecx, dword [esp + 0x14]
jmp 0x6aa47a

Function at 0x785042
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
lea ebx, [ebp - 0xd7]
add esp, 0x16
xchg dword [esp + 0xb], esi
lea eax, [eax + ebx]
jmp 0x785065

Function at 0x785329
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe bh
xchg word [esp + 0x10], cx
xor dl, ch
xchg word [esp + 0xa], cx
xor edi, esi
jmp 0x785288

Function at 0x785448
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax*4]
mov byte [esp + 5], bh
xchg dword [esp], ecx
mov dword [esp + 0xc], eax
btr edx, esp
jmp 0x78546c
Function at 0x785bfa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebx*4]
clc
lea ebp, [edx*4]
mov al, ah
clc
mov dl, 0x24
add esp, 0
jmp 0x785a81
mov edx, 0xfe0f7e8e
mov edi, 0x30f416
lea esp, [esp]
lea esp, [esp]
setp ch
mov al, ah
jmp 0x785a9a
pop word [esp + 1]
mov dh, byte [esp + 3]
mov byte [esp + 1], bh
add esp, 3
setge ah
mov ax, word [esp]
jmp 0x785ae1
rdtsc
jmp 0x785b6d
Function at 0x785fd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ch, 5
mov esi, dword [esp + 0x12]
mov byte [esp + 3], bh
mov dh, byte [esp + 0xc]
rdtsc
push word [esp + 0xb]
jmp 0x785fd8
rdtsc
btr edx, edx
xor ax, 0xb2fc
btr ebp, edx
push word [esp + 0x10]
lea ebp, [ecx*4]
jmp 0x785f92
xchg esi, ecx
neg si
jmp 0x785fae
mov ch, byte [esp + 0x13]
mov bx, di
push word [esp + 0xb]
pop word [esp]
lea edi, [ecx + 0xdb]
lea ebp, [ecx*4]
jmp 0x78603a
mov dword [esp + 2], eax
xchg ebp, ecx
sub esp, 0x10
lea ecx, reloc.WINMM.dll_midiStreamOut
mov al, ah
pushal
jmp 0x786017

Function at 0x78a3fb
Capabilities:
Parse pe header

Disassembly:
call 0x78a3ab
fcom qword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
cli
dec esi
invalid
Function at 0xfbb909
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1098e9b
mov byte [esp + 4], 0xc
lea esp, [esp + 0x5c]
ja 0x1c62f66
call fcn.01be0a4e

Function at 0xfbc08b
Capabilities:
Encode data using xor

Disassembly:
repne scasb al, byte es:[edi]
call fcn.01c59a8e
in al, 0xc
xor byte [esi + 0x794edc11], 0x44
pop es
shl dword [edi - 0x13d5b398], cl
sahf
invalid
Function at 0x11737c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0xa
xor eax, 0x82fd5aaf
btr ax, 0xd
push ebp
jmp 0x1173868
mov ebp, esp
aam 0xc1
sub al, bl
daa
btr ax, 8
sub esp, 0x10
clc
shl ax, 9
sar al, 3
not ax
push esi
bt sp, 0xb
push edi
bt ebp, edi
or ax, bx
movsx eax, dl
rol eax, cl
push ebx
stc
stc
xor ah, 0x24
push edx
rcr ax, cl
rcr ax, 1
mov eax, dword [ebp + 8]
bt sp, 5
test eax, eax
jge 0x1c5a15f
je 0x1c563d2
shl si, 0xe
jmp 0x1c60f86
mov byte [esp + 4], ch
jmp 0x1c5e199
lea esp, [esp + 8]
je 0x1c563d2
dec ch
neg cl
not ch
not cx
add edx, eax
stc
sar ch, 1
adc cl, 0xca
mov ecx, dword [esi + 0x7c]
cmp esp, 0xd95637f5
test dl, 0x14
add ecx, edx
pushfd
push 0x9186ce2a
bt ax, 9
pushfd
mov dword [ebp - 0x10], ecx
neg cl
adc ch, 0x98
mov ecx, dword [ebp + 0xc]
bt bp, 8
cmp ecx, 0xffff
call fcn.01be5d43
cmc
push esi
int3
jmp 0x1be5338
bsr edx, esi
mov esi, dword [eax + 0x3c]
stc
bts dx, 6
add esi, eax
btr edx, esi
mov edx, dword [esi + 0x78]
push ebx
push 0x5aab25cf
test ebx, 0x60f9be68
test edx, edx
jmp 0x1178ca9

Function at 0x1be391c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
call fcn.01c599cf
pop edx
sub edx, dword [edi + 0x39dcd42f]
popal
and eax, 0x4664a1ea
sub bh, al
fldenv [edi - 0x42f1d098]
in eax, 0xc0
pop es
push ecx
jle 0x1be3997
pop ebp
fbstp tbyte [ebp + 0x726bcb02]
cdq
test dword [ebp - 0x3f], ebx
xor byte [ecx], dh
cmp eax, 0x56551d3e
jb 0x1be3904
idiv byte [eax - 0x68d3fe1c]
mov ecx, 0xea1f6146
test eax, 0x320f3bde
mov dword [edx + eax*2], edx
femms
xor byte [ecx], bh
test eax, 0x6fcc710e
sub eax, 0x58df6416
cmp al, 7
cmpsd dword [esi], dword es:[edi]
fcmovne st(0), st(3)
pushfd
push eax
xchg edi, eax
hlt
mov eax, 0x4f4c4ed2
les ebx, [eax + 0x78]
adc esi, dword [edx + esi*4 - 0x3d]
adc byte [ecx + 0x5c834c97], dh
and byte [esi + 0x2434ffac], al
push dword [esp]

Function at 0x1c56c1b
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xe73a0767
mov dh, 0xd1
call 0x2725d6f6
sbb ah, byte [eax + 8]
xor eax, edi
daa
adc eax, 0x56cb219
inc edx
invalid
sbb dword [edx - 0x72bdfa94], esi
invalid
push dword [esp]
repne scasb al, byte es:[edi]
call int.0109884b
dec ebx
mov bl, 0xe8
popal
fcmovnu st(0), st(4)
call 0xb79c5c45
wait
outsd dx, dword [esi]
push eax
or al, 0x73
push 0xffffffffffffffae
cmc
pop ds
call 0x1d09d8ea
enter 0xffffffffffffb4c6, 0xffffffffffffffe8
or ebx, ecx
mov esi, 0x74a7dd17
mov bh, 0x29
fnstsw word [esi + 0x7d]
sqrtps xmm6, xmmword [esi - 0x175d791d]
nop
jae 0x1c56bef
jmp 0x1c56c02

Function at 0x1c64591
Capabilities:
Encode data using xor

Disassembly:
pushal
adc ecx, ecx
push dword [esp]
mov word [esp + 4], 0x7ba8
lea esp, [esp + 0x48]
jmp 0x1c576a0
dec al
cmp ah, 0xc4
clc
pushfd
shr eax, 1
mov word [esp], si
lea esp, [esp + 0x2c]
je 0x1179aea
pushal
push 0xa5ebbfc3
jmp 0x1c562da
Function at 0x406e40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47980b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046e56e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406ec2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046c480
mov eax, dword [eax]
push 0x4d6c44
push eax
call fcn.0045f194
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046e7f9
test bl, bl
je 0x406ec2
push 0x4d6c44
lea ecx, [esp + 0xc]
call fcn.0046eb89
push 0x4d6c50
lea ecx, [esp + 0xc]
call fcn.0046eb89
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x406efe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046e7f9
jmp 0x406fc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406f82
lea edx, [esp + 0x7c]
push 0x4d6c4c
push edx
call fcn.0045f194
add esp, 8
test eax, eax
je 0x406f82
lea eax, [esp + 0x7c]
push 0x4d6c48
push eax
call fcn.0045f194
add esp, 8
test eax, eax
je 0x406f82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406f12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046e7f9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4077d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407832
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x407840
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47988b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4e057c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x407978
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4078a6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e7f9
xor eax, eax
jmp 0x4079ef
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046e936
push esi
lea ecx, [esp + 0xc]
call fcn.0046ebc5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4079cd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004077d0
test eax, eax
jne 0x4079cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004077d0
test eax, eax
jne 0x4079cd
lea eax, [esp + 0x14]
push 0x4d6c60
push eax
call fcn.00460210
mov esi, eax
add esp, 8
test esi, esi
jne 0x4079ac
lea ecx, [esp + 0x14]
push 0x4d6c5c
push ecx
call fcn.00460190
mov esi, eax
add esp, 8
test esi, esi
jne 0x4079ac
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4079af
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046e8e6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4078be
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e7f9
xor eax, eax
jmp 0x4079ef
mov byte [esi], 0
push 0x4d6c58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046e7f9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4