joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455810
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x455838
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x45582d
add esp, 0x1c
ret

Function at 0x455900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x455922
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
jne 0x45593c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x45597d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4559bd
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x455972
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x455986
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call sym._push_pthread_mem
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x45597d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4559d1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x45599e

Function at 0x4559e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x476cf0]
test eax, eax
jne 0x4559f0
xor eax, eax
ret
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x455a30
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x455a20
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x455a14
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x455a16
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x455a0d
jmp 0x455a14

Function at 0x455a40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x455a80
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x455a70
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x455a5d
add esp, 0x1c
ret
Function at 0x455b80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x455bf0
test byte [ebx + 0x20], 0xc
jne 0x455bb0
mov eax, dword [0x476cf0]
test eax, eax
jne 0x455bc0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call dbg.pthread_mutex_lock
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x455be2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x455be2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x455c01
mov dword [esp], esi
call dbg.pthread_mutex_unlock
add esp, 0x14
pop ebx
pop esi
ret
call sym.___pthread_self_lite.part.0
mov ebx, eax
test eax, eax
jne 0x455ba1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x455c21
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop
Function at 0x456710
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
test esi, esi
je 0x456840
mov dword [esp], 0x45bd5c
call dbg.pthread_mutex_lock
mov eax, esi
call dbg.__pthread_get_pointer
mov dword [esp], 0x45bd5c
mov ebx, eax
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x456840
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x456840
lea edx, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
sub esp, 8
test eax, eax
je 0x456840
test byte [ebx + 0x24], 4
jne 0x456850
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x45bd64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x456870
cmp esi, dword [eax + 0xb4]
je 0x456898
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x14]
test ecx, ecx
je 0x4567b7
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x4567ce
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x14]
sub esp, 8
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4567eb
mov dword [esp], eax
call esi
sub esp, 4
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
test edx, edx
je 0x456888
mov edx, dword [ebx + 4]
mov ecx, dword [esp + 0x34]
mov dword [ecx], edx
mov dword [esp], eax
call dbg.pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x45689f
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x456860
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
mov eax, 3
add esp, 0x24
pop ebx
pop esi
ret
add esp, 0x24
mov eax, 0x16
pop ebx
pop esi
ret
mov eax, ebx
call sym._push_pthread_mem.part.0
xor eax, eax
jmp 0x456835
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x456799
jmp 0x4567a5
mov dword [esp], eax
call dbg.pthread_mutex_destroy
jmp 0x456812
mov eax, 0x24
jmp 0x456845
call sym._replace_spin_keys.part.0
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x40944e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40945d
pop dword [ebp - 0x30]
mov eax, 0x40945d
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x40286
push 0
mov eax, 0xacba5b8c
add eax, 0x5387f68c
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x512a
xor ebx, ebx
add ebx, eax
mov edx, 0x835bf463
sub edx, 0x8318a063
add edx, dword [ebp - 0x30]
mov edi, 0x9d391d4d
sub edi, 0x3fd2dd7b
xor dword [ebp - 0x1c], eax
mov esi, dword [edx]
add dword [ebp - 0x20], 0xd85803b3
xor esi, edi
sub dword [ebp - 0x24], edx
mov dword [ebx], esi
add dword [ebp - 0x24], ebx
add ebx, 0x72551e3a
add ebx, 0x8daae1ca
add edx, 0xc3598d90
sub edx, 0xc3598d8c
loop 0x4094b3
add eax, 0x1377b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4dc137
Capabilities:
Encode data using xor

Disassembly:
invalid
xor eax, 0xac065a81
loope 0x4dc0e4
xlatb
dec esp
sub al, 0xa3
sub eax, 0xa58d8add
in al, 0xc2
or al, 0xaf
xor dword [ecx + 0x943be12], 0x51ad5636
inc ebx
or dword [esi], esi
push esi
lodsd eax, dword [esi]
push ecx

Function at 0x4dc177
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
add dword [ebp + 0x7991e401], ebp
jbe 0x4dc160
invalid
add byte [ebp + ebx*8 - 0x15], cl

Function at 0x116b6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 1
jne 0x116cf
push dword [ebp + 8]
push 0x1ab80
jmp 0x116dc
cmp edi, 2
jne 0x116e5
push dword [ebp + 8]
push 0x1ab7c
call fcn.000117a6
pop ecx
pop ecx
jmp 0x11724
test edi, edi
je 0x11722
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0xfffffffe
call sub.ntoskrnl.exe_strlen
pop ecx
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [0x1ec60], eax
mov eax, dword [ebp - 0xc]
jmp 0x11724
xor eax, eax
pop edi
leave
ret

Function at 0x11727
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x410]
push dword [ebp + 0xc]
push eax
call sub.ntoskrnl.exe_vsprintf
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp ecx, 1
je 0x11797
cmp ecx, 2
je 0x11797
xor eax, eax
cmp ecx, eax
je 0x117a4
lea edx, [ebp - 0x410]
test edx, edx
je 0x117a4
lea edx, [ebp - 8]
push eax
push edx
lea edx, [ebp - 0x410]
push 0x100000
or dword [ebp - 4], 0xffffffff
push edx
lea edx, [ebp - 0x10]
push edx
push eax
push eax
push eax
push ecx
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [0x1ec60], eax
mov eax, dword [ebp - 0xc]
leave
ret
lea eax, [ebp - 0x410]
push eax
call fcn.000117a6
pop ecx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10011f30
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10011f30
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10011f30
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x100223a0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xa142850]
add eax, 0xa0408102
push eax
sub byte [edx + ecx], dl
add eax, 0xa0408102
push eax
sub byte [ebx + ebp*8], bh
out dx, eax
adc esi, ebp
in eax, dx
invalid
popfd
mov eax, dword [0x295f5cb3]
inc eax
aam 0x9a
and eax, 0x22e4e5eb
jne 0x100223ff
sbb dword [edi + 0x6a], 0x7b
pop edi
push 0x7b
inc ebp
jl 0x100223d8
xlatb
push esp
pop esi
invalid
dec ebp
mov ecx, 0xf1fda9f3
leave
push edi
pop dword [edx - 0xa4f21ab]
jbe 0x1002237e
div dword [ebx + 0x1eb9e884]
insd dword es:[edi], dx
pop edi
mov edx, 0xe1e2b37f
mov gs, edi
loopne 0x1002238f
insd dword es:[edi], dx
test ah, ah
cld
ja 0x1002235a
pop ebp
xor dword [edx + eax*8], ecx
salc
in eax, 0xa2
sti
imul esi, dword [ebx + 0x64], 0x4cd4c798
push edi
test al, 0x3a
shl dword [edi - 0x572c93bd], 1
xchg edx, eax
je 0x10022436
cmp dl, cl
cmpsd dword [esi], dword es:[edi]
inc ebx
insb byte es:[edi], dx
shr dword [eax - 0x50ab8b6e], cl
scasd eax, dword es:[edi]
mov dh, 0xe4
xchg esi, eax
mov bl, 0x96
mov byte [0xa6b1aaed], al
jg 0x10022396
adc ecx, ecx
xor al, bh
jg 0x10022418
jnp 0x1002241e
jp 0x100223a6
aaa
test eax, 0x98fea8c2
invalid
invalid
bound esi, qword [edx - 0x463541bf]
fsub qword [edx + 0x3c8bddda]
fld qword [esi]
lds esi, [edi - 0x670dc3de]
stosd dword es:[edi], eax
dec edx
mov ebp, dword [esi + 0x767f22ad]
mov esi, 0xcdfdd51d
outsd dx, dword [esi]
aad 0xfd
int 0x6f
jp 0x100224a2
stosd dword es:[edi], eax
mov ch, 0x5d
push ebx
dec esp
inc esp
dec esp
call 0x773e937
fbld tbyte [eax + 0x2ebfc73a]
outsb dx, byte [esi]
mov word [ebp + 0x1553b4bb], fs
dec esp
int3
daa
xchg edi, eax
int3
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d6a4
call fcn.00403763
mov dword [eax], esi
call fcn.00403750
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040cb50
add esp, 0x14
push 0x16
pop eax
jmp 0x40d6f9
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d680
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d6d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.0040cb50
pop ecx
call fcn.00403750
mov eax, dword [eax]
jmp 0x40d6f9
test al, 0x10
jne 0x40d6f7
test al, 1
je 0x40d6f7
test byte [ebp + 0xc], 2
je 0x40d6f7
call fcn.00403763
mov dword [eax], 5
call fcn.00403750
mov dword [eax], 0xd
jmp 0x40d6c8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x2d85cf2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2d85cf39
pop dword [ebp - 0x2c]
mov eax, 0x57b20251
sub eax, 0x2a2c3318
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbe7ecfd9
sub dword [ebp - 0x3c], 0x702c8a8e
mov dword [ebp - 0x38], 0x219f2b9c
sub dword [ebp - 0x38], 0xef6bdf57
mov dword [ebp - 0x34], 0x2641feaf
add dword [ebp - 0x34], 0x260a457f
mov dword [ebp - 0x30], 0xeee138a7
add dword [ebp - 0x30], 0x111ec759
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x789e5909
add eax, 0xb4f1577f
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4d7a0153
add dword [ebp - 0x3c], 0x26f86803
mov dword [ebp - 0x38], 0xc61e8c2e
add dword [ebp - 0x38], 0x7b4dd547
mov dword [ebp - 0x34], 0xcedf5f0e
add dword [ebp - 0x34], 0x94900d5e
mov dword [ebp - 0x30], 0x16f6a4d4
add dword [ebp - 0x30], 0xe9095b2c
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xaaca7180
add eax, 0x82c53f10
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x678a3
push 0
call eax
mov ecx, 0x236be6d4
add ecx, 0xdc9452db
mov esi, eax
mov edx, 0xbdfe623b
add edx, 0x6f9c7dc5
add edx, dword [ebp - 0x2c]
mov ebx, 0xf96f3269
sub ebx, 0x1776cc1a
sub dword [ebp - 0x28], esi
mov edi, dword [edx]
xor dword [ebp - 0x1c], esi
xor edi, ebx
xor dword [ebp - 0x10], 0x23da6b7a
mov dword [esi], edi
add dword [ebp - 0x28], ecx
add esi, 0x74dc4ec6
sub esi, 0x74dc4ec2
add edx, 0x48734c3f
sub edx, 0x48734c3b
loop 0x2d85d05b
add eax, 0xadb622b
add eax, 0xf5257764
mov ebx, eax
add eax, 5
mov ecx, 0x9bc528fa
sub ecx, 0x6e4528fa
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x53ac60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ceb7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005c38fa
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x53ace2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005c1849
mov eax, dword [eax]
push 0x993200
push eax
call fcn.005b3894
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005c3b85
test bl, bl
je 0x53ace2
push 0x993200
lea ecx, [esp + 0xc]
call fcn.005c3f15
push 0x996d54
lea ecx, [esp + 0xc]
call fcn.005c3f15
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x53ad1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005c3b85
jmp 0x53ade9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x53ada2
lea edx, [esp + 0x7c]
push 0x996d50
push edx
call fcn.005b3894
add esp, 8
test eax, eax
je 0x53ada2
lea eax, [esp + 0x7c]
push 0x996d4c
push eax
call fcn.005b3894
add esp, 8
test eax, eax
je 0x53ada2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x53ad32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005c3b85
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x53b5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x53b642
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x53b650
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5cebfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x9abf58]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x53b788
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x53b6b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005c3b85
xor eax, eax
jmp 0x53b7ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005c3cc2
push esi
lea ecx, [esp + 0xc]
call fcn.005c3f51
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x53b7dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0053b5e0
test eax, eax
jne 0x53b7dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0053b5e0
test eax, eax
jne 0x53b7dd
lea eax, [esp + 0x14]
push 0x996d68
push eax
call fcn.005b49e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x53b7bc
lea ecx, [esp + 0x14]
push 0x996d64
push ecx
call fcn.005b4960
mov esi, eax
add esp, 8
test esi, esi
jne 0x53b7bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x53b7bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005c3c72
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x53b6ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005c3b85
xor eax, eax
jmp 0x53b7ff
mov byte [esi], 0
push 0x996d60
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005c3b85
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4