joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401939
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43207c]
jne 0x401943
repz ret
jmp fcn.00402491

Function at 0x405601
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43207c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040308d
and dword [ebp - 0x14], 0
cmp dword [0x434b1c], 0
mov dword [ebp - 0x18], eax
jne 0x4056b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40575c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40575c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x434b1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x434b20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x434b24], eax
call edi
push eax
call esi
mov dword [0x434b2c], eax
test eax, eax
je 0x4056b4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x434b28], eax
mov eax, dword [0x434b28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40570d
cmp dword [0x434b2c], ecx
je 0x40570d
push eax
call esi
push dword [0x434b2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40570d
test ebx, ebx
je 0x40570d
call edi
test eax, eax
je 0x405704
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405704
test byte [ebp - 8], 1
jne 0x40570d
or dword [ebp + 0x10], 0x200000
jmp 0x405740
mov eax, dword [0x434b20]
cmp eax, dword [ebp - 0x18]
je 0x405740
push eax
call esi
test eax, eax
je 0x405740
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405740
mov eax, dword [0x434b24]
cmp eax, dword [ebp - 0x18]
je 0x405740
push eax
call esi
test eax, eax
je 0x405740
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x434b1c]
call esi
test eax, eax
je 0x40575c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40575e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401939
leave
ret
Function at 0x10002010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1001bc3c], 0x497
mov dword [0x1001bc44], 0
mov byte [0x1001bc48], 0
mov dword [0x1001bc40], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x10002131
mov dword [0x1001bc4c], 0
mov dword [0x1001bc38], 0x189a
mov eax, dword [0x1001bc44]
mov ecx, dword [0x1001bc40]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov eax, 0x100
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
movzx esi, byte [ecx + edx]
mov edi, dword [ebp - 0x1c]
add esi, edi
mov dword [ebp - 0x24], eax
mov eax, edx
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add esi, edx
mov dword [0x1001bc4c], esi
mov eax, esi
cdq
mov esi, dword [ebp - 0x24]
idiv esi
mov dword [0x1001bc44], edx
mov edx, dword [0x1001bc40]
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov byte [0x1001bc48], cl
mov edx, dword [0x1001bc38]
add edx, 0xfffff5ce
mov dword [0x1001bc38], edx
mov edx, dword [0x1001bc44]
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [0x1001bc40]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov cl, byte [0x1001bc48]
mov edx, dword [0x1001bc44]
mov byte [esi + edx], cl
mov edx, dword [0x1001bc40]
add edx, 1
mov dword [0x1001bc40], edx
cmp edx, 0x100
jl 0x10002055
jmp 0x10002167
mov dword [0x1001bc40], 0
jmp 0x10002055
mov eax, dword [0x1001bc3c]
add eax, 0xffffefaa
mov dword [0x1001bc38], eax
mov eax, dword [0x1001bc40]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1001bc40]
add eax, 1
mov dword [0x1001bc40], eax
cmp eax, 0x100
jl 0x10002131
jmp 0x10002122
mov dword [0x1001bc38], 0x23c0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1001bc38], 0xc03
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
jmp 0x1000222e
lea eax, [0x10004334]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x1001bc3c], 0x5b3
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
call fcn.10002af0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.10001db0
mov ecx, eax
mov dword [0x1001bc54], eax
mov eax, esp
mov edx, dword [ebp - 0x44]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x1001bc38]
add edx, 0x1bdd
mov dword [0x1001bc38], edx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
jmp 0x1000227e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x13c
mov edi, edx
add edi, esi
add edi, 0xdc
mov esi, dword [edi]
imul edi, eax, 0x13c
add edx, edi
add edx, 0x78
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x127
mov ecx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x100021a8
jmp 0x1000222e
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x13c
mov edi, edx
add edi, esi
add edi, 0xdc
mov esi, dword [edi]
imul edi, eax, 0x13c
mov ebx, edx
add ebx, edi
add ebx, 0x40
mov edi, dword [ebx]
imul ebx, eax, 0x13c
add edx, ebx
add edx, 0x78
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.10002f90
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x127
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x1000227e
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x44]
mov dword [esp + 8], ecx
call fcn.10002850
xor eax, eax
mov dword [0x1001bc3c], 0x20ca
mov ecx, dword [ebp - 0x48]
add ecx, 0x4e76a
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x159200
mov ecx, dword [ebp - 0x48]
add ecx, 0x10b43
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2000
mov ecx, dword [0x1001bc38]
add ecx, 0x12f
mov dword [0x1001bc38], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100024d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1001bc40], 0
mov dword [0x1001bc44], 0
mov dword [0x1001bc50], 0
mov dword [0x1001bc38], 0xf20
mov dword [0x1001bc3c], 0xd96
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x10002638
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1001bc38], 0xad8
mov edx, dword [0x1001bc40]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x1001bc40], edx
mov dword [0x1001bc3c], 0x462
mov esi, dword [0x1001bc44]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x1001bc44], edx
mov ecx, dword [0x1001bc40]
mov bl, byte [edi + ecx]
mov byte [0x1001bc48], bl
mov dword [0x1001bc38], 0x4f5
mov bl, byte [edi + edx]
mov ecx, dword [0x1001bc40]
mov byte [edi + ecx], bl
mov dword [0x1001bc38], 0x2323
mov bl, byte [0x1001bc48]
mov ecx, dword [0x1001bc44]
mov byte [edi + ecx], bl
mov ecx, dword [0x1001bc40]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x1001bc44]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x1001bc38], 0x1e35
and edx, 0xff
mov dword [0x1001bc50], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov esi, dword [0x1001bc38]
add esi, 0xfffffd2a
mov dword [0x1001bc38], esi
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x10002533
mov eax, dword [0x1001bc38]
add eax, 0xfffffc64
mov dword [0x1001bc38], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10002eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10002eb0]
mov ecx, dword [0x1001bc3c]
add ecx, 0xfffff271
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x10002ee1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x10002ef0
jmp 0x10002ef8
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
je 0x10002ed0
jmp 0x10002ef8
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x1001bc38], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
jmp 0x10002ee1
Function at 0x10003010
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov dword [0x1001bc38], 0x138b
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x1001bc3c]
add esi, 0xffffd959
mov dword [0x1001bc38], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10003096
mov eax, 1
mov ecx, dword [0x1001bc38]
add ecx, 0x221d
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10003164
mov eax, 0x717
mov ecx, dword [ebp - 0x20]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jge 0x100030b4
mov eax, dword [ebp - 0x14]
mov ecx, 0xb82
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
jne 0x10003075
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x1001bc38], ecx
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x1000314b
mov dword [0x1001bc38], 0xe65
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x2e], dx
mov ax, word [ebp - 0x2e]
cmp ax, 0x6f
jne 0x1000314b
mov dword [0x1001bc3c], 0xee
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000314b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1000314b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000314b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000314b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x10003059
mov eax, dword [0x1001bc3c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffee9c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [0x1001bc38], ecx
add esp, 0x30
pop esi
pop ebp
ret
Function at 0x4014d1
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x401541
cmp ebx, 0x20
je 0x401541
cmp ebx, 0xffffffe0
je 0x401541
jne 0x40154a
add eax, 1
cmp esi, eax
je 0x401557
jne 0x401526
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x40155b
jne 0x401522
pop edx
mov eax, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
cmp ebx, 0
je 0x4015a0
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x4015a6
add eax, 4
pop esi
dec esi
push esi
jne 0x401588
xor eax, eax
mov dword [ebp - 8], eax
nop
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
mov dword [ebp - 8], eax
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
mov esi, dword [esi + 4]
lea ecx, [esi - 1]
test ecx, ecx
jl 0x4015e7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea eax, [eax + ecx*4 + 8]
inc ecx
push dword [eax]
sub eax, 4
dec ecx
jne 0x4015df
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4015fd
lea eax, [esi*4]
add esp, eax
mov eax, dword [ebp - 0xc]
jmp 0x401605
mov esp, ebp
pop ebp
ret 0x18

Function at 0x40207e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4020c5
cmp ebx, 0x20
je 0x4020c5
cmp ebx, 0xffffffe0
je 0x4020c5
jne 0x4020ce
add eax, 1
cmp esi, eax
je 0x4020db
jne 0x4020aa
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4020df
jne 0x4020a6
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4
Function at 0x4020f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x402138
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x40213e
add eax, 4
pop esi
dec esi
push esi
jne 0x402120
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x411afa
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x411b28
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x411b1f
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x411b17
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x411b49
mov esp, ebp
pop ebp
ret

Function at 0x411b4d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x411bb9
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x411be6
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x411bd5
xor ecx, eax
xor edx, ebx
dec edi
jne 0x411bc6
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x411c0c
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x411bad
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x411c38
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41222e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x41223e
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x41234c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.0041235c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x41234c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.0041235c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x41234c
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.0041235c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41234c
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x412349
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0041236f
test eax, eax
je 0x412338
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.004123a3
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x4122f3
add esp, 0xc
mov eax, 0
jmp 0x412356
mov esp, ebp
pop ebp
ret 8
Function at 0x418970
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4abfbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a105f
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4189f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049ef71
mov eax, dword [eax]
push 0x60dc98
push eax
call fcn.00490fa4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a12ea
test bl, bl
je 0x4189f2
push 0x60dc98
lea ecx, [esp + 0xc]
call fcn.004a167a
push 0x60dca4
lea ecx, [esp + 0xc]
call fcn.004a167a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x418a2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a12ea
jmp 0x418af9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x418ab2
lea edx, [esp + 0x7c]
push 0x60dca0
push edx
call fcn.00490fa4
add esp, 8
test eax, eax
je 0x418ab2
lea eax, [esp + 0x7c]
push 0x60dc9c
push eax
call fcn.00490fa4
add esp, 8
test eax, eax
je 0x418ab2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418a42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a12ea
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4192f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x419352
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc