joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cff0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43d00b
mov eax, 0xffffffff
jmp 0x43d00e
add eax, 0xa
push eax
call fcn.00408210
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43d061
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43d050
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x504f4e4d
lea esi, [esp + 0x28]
mov edx, 0x9618f2
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi]
mov edi, edx
and edi, 0x8210d7
lea ebx, [edx - 0x5a000000]
and ebx, 0xa6140828
or ebx, edi
mov edi, eax
xor edi, 0xd7
mov ecx, ebx
xor ecx, 0x28
or ecx, edi
xor eax, 8
xor ebx, 0xd7
or ebx, eax
and ebx, ecx
add bl, 0xbf
mov byte [esi], bl
inc esi
dec edx
cmp edx, 0x9618ee
jne 0x43d0e0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d175
xor edx, edx
mov edi, dword [0x44a894]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x43d150
inc edx
cmp ecx, edx
jne 0x43d140
jmp 0x43d175
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d175
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.00408220
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d18e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x504f4e4d
mov eax, esp
mov edx, 0x9618f2
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov esi, edx
and esi, 0x8210d7
lea ebx, [edx - 0x5a000000]
and ebx, 0xa6140828
or ebx, esi
mov esi, ecx
xor esi, 0xd7
mov edi, ebx
xor edi, 0x28
or edi, esi
xor ecx, 8
xor ebx, 0xd7
or ebx, ecx
and ebx, edi
add bl, 0xbf
mov byte [eax], bl
inc eax
dec edx
cmp edx, 0x9618ee
jne 0x43d1c0
mov eax, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d258
xor edx, edx
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7cde1e50
je 0x43d230
inc edx
cmp ecx, edx
jne 0x43d220
jmp 0x43d258
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43d258
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43d265
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43d274
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d280
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp], 0x504f4e4d
mov eax, esp
mov ebx, 0x9618f2
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov esi, ebx
and esi, 0x8210d7
lea ecx, [ebx - 0x5a000000]
and ecx, 0xa6140828
or ecx, esi
mov esi, edi
xor esi, 0xd7
mov ebp, ecx
xor ebp, 0x28
or ebp, esi
xor edi, 8
xor ecx, 0xd7
or ecx, edi
and ecx, ebp
add cl, 0xbf
mov byte [eax], cl
inc eax
dec ebx
cmp ebx, 0x9618ee
jne 0x43d2a0
mov eax, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d33f
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc81e0bf6
je 0x43d310
inc edi
cmp ecx, edi
jne 0x43d300
jmp 0x43d33f
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x43d33f
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a898]
call fcn.00439540
add esp, 0x30
cmp eax, 0x103
jne 0x43d3f8
mov dword [esp + 8], 0x504f4e4d
lea eax, [esp + 8]
mov ecx, 0x9618f2
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov esi, ecx
and esi, 0x8210d7
lea edx, [ecx - 0x5a000000]
and edx, 0xa6140828
or edx, esi
mov esi, edi
xor esi, 0xd7
mov ebx, edx
xor ebx, 0x28
or ebx, esi
xor edi, 8
xor edx, 0xd7
or edx, edi
and edx, ebx
add dl, 0xbf
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x9618ee
jne 0x43d360
mov eax, dword [esp + 8]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d3f1
xor edx, edx
mov edi, dword [0x44a894]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43d3d0
inc edx
cmp ecx, edx
jne 0x43d3c0
jmp 0x43d3f1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d3f1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x18
test eax, eax
js 0x43d3f8
mov eax, dword [esp]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43d40f
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43d40d
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp], 0x504f4e4d
mov eax, esp
mov ebx, 0x9618f2
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov esi, ebx
and esi, 0x8210d7
lea ecx, [ebx - 0x5a000000]
and ecx, 0xa6140828
or ecx, esi
mov esi, edi
xor esi, 0xd7
mov ebp, ecx
xor ebp, 0x28
or ebp, esi
xor edi, 8
xor ecx, 0xd7
or ecx, edi
and ecx, ebp
add cl, 0xbf
mov byte [eax], cl
inc eax
dec ebx
cmp ebx, 0x9618ee
jne 0x43d440
mov eax, dword [esp]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d4df
xor edi, edi
mov ebx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e66a1b5
je 0x43d4b0
inc edi
cmp ecx, edi
jne 0x43d4a0
jmp 0x43d4df
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x43d4df
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a898]
call fcn.00439540
add esp, 0x30
cmp eax, 0x103
jne 0x43d598
mov dword [esp + 8], 0x504f4e4d
lea eax, [esp + 8]
mov ecx, 0x9618f2
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov esi, ecx
and esi, 0x8210d7
lea edx, [ecx - 0x5a000000]
and edx, 0xa6140828
or edx, esi
mov esi, edi
xor esi, 0xd7
mov ebx, edx
xor ebx, 0x28
or ebx, esi
xor edi, 8
xor edx, 0xd7
or edx, edi
and edx, ebx
add dl, 0xbf
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x9618ee
jne 0x43d500
mov eax, dword [esp + 8]
mov ecx, dword [0x44a890]
test ecx, ecx
je 0x43d591
xor edx, edx
mov edi, dword [0x44a894]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43d570
inc edx
cmp ecx, edx
jne 0x43d560
jmp 0x43d591
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d591
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a898]
call fcn.00439540
add esp, 0x18
test eax, eax
js 0x43d598
mov eax, dword [esp]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43d5a6
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43d5d0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x504f4e4d
mov eax, esp
mov edi, 0x9618f2
nop
nop
movzx ebp, byte [eax]
mov ecx, edi
and ecx, 0x8210d7
lea ebx, [edi - 0x5a000000]
and ebx, 0xa6140828
or ebx, ecx
mov ecx, ebp
xor ecx, 0xd7
mov edx, ebx
xor edx, 0x28
or edx, ecx
xor ebp, 8
xor ebx, 0xd7
or ebx, ebp
and ebx, edx
add bl, 0xbf
mov byte [eax], bl
inc eax
dec edi
cmp edi, 0x9618ee
jne 0x43d630
mov eax, dword [esp]
mov edi, dword [0x44a890]
test edi, edi
je 0x43d6c8
xor ebx, ebx
mov ebp, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43d6a1
inc ebx
cmp edi, ebx
jne 0x43d690
jmp 0x43d6c8
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43d6c8
lea eax, [esp + 0xc]
push esi
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x44a898]
call fcn.00439540
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41c64b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x41c720
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41c720
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x41c720
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x41c6a6
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41c720
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c6eb
test dl, dl
je 0x41c6e7
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c6eb
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c6cb
xor eax, eax
jmp 0x41c6f0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41c702
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x41c70d
inc esi
cmp esi, ebp
jae 0x41c720
mov edx, dword [esp + 0x10]
jmp 0x41c6c1
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x41c984
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x41c98f
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x41c9a3
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x41c9a7
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x41c9e0
cmp dword [edi + ecx], 0x4550
jne 0x41c9e0
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x41c9e0
test byte [edi + ecx + 0x16], 2
je 0x41c9e0
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x41c9e5
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x41ca21
xor eax, eax
jmp 0x41ca04
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x41ca2a
inc edx
movzx eax, dx
cmp eax, edi
jl 0x41ca04
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x41ca30
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x41ca68
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x41ca76
add edx, 0x20
cmp eax, edx
jne 0x41ca87
test bx, bx
je 0x41cabc
add esi, 2
add edi, 2
jmp 0x41ca58
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x41ca95
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x41caa3
add edx, 0x20
sub ecx, edx
je 0x41cabc
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x41ca51
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41cad5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x41cbae
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41cbae
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x41cbae
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x41cb34
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41cbae
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41cb79
test dl, dl
je 0x41cb75
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41cb79
add ecx, 2
add eax, 2
test dl, dl
jne 0x41cb59
xor eax, eax
jmp 0x41cb7e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41cb90
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x41cb9b
inc esi
cmp esi, ebp
jae 0x41cbae
mov edx, dword [esp + 0x10]
jmp 0x41cb4f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x41cbca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
test esi, esi
je 0x41ccf2
xor eax, eax
mov word [esp + 0x54], ax
mov byte [esp + 0x38], al
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
mov dword [esp + 0x48], 0x6c0065
mov dword [esp + 0x4c], 0x320033
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov dword [esp + 0x2c], 0x4d746547
mov dword [esp + 0x30], 0x6c75646f
mov dword [esp + 0x34], 0x6e614865
mov dword [esp + 0x38], 0x41656c64
mov dword [esp + 0x14], 0x65657246
mov dword [esp + 0x18], 0x7262694c
mov dword [esp + 0x1c], 0x797261
mov dword [esp + 0x20], 0x74726956
mov dword [esp + 0x24], 0x466c6175
mov dword [esp + 0x28], 0x656572
call fcn.0041ce2c
add esp, 4
mov ebx, eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.0041ccfe
mov ebp, eax
test ebp, ebp
je 0x41ccf2
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.0041ccfe
mov edi, eax
test edi, edi
je 0x41ccf2
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.0041ccfe
mov ebx, eax
test ebx, ebx
je 0x41ccf2
mov ecx, dword [esi + 0x3c]
mov eax, 0x2000
test word [ecx + esi + 0x16], ax
je 0x41ccce
mov eax, dword [ecx + esi + 0x28]
test eax, eax
je 0x41ccce
push 0
push 0
push esi
add eax, esi
call eax
push edi
push ebp
push esi
call fcn.0041cddf
add esp, 0xc
push 0x8000
push 0
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x48
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 4

Function at 0x41ccfe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x41cdd3
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41cdd3
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x41cdd3
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x41cd59
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41cdd3
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41cd9e
test dl, dl
je 0x41cd9a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41cd9e
add ecx, 2
add eax, 2
test dl, dl
jne 0x41cd7e
xor eax, eax
jmp 0x41cda3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41cdb5
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x41cdc0
inc esi
cmp esi, ebp
jae 0x41cdd3
mov edx, dword [esp + 0x10]
jmp 0x41cd74
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x41ce2c
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x41ce64
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x41ce72
add edx, 0x20
cmp eax, edx
jne 0x41ce83
test bx, bx
je 0x41ceb8
add esi, 2
add edi, 2
jmp 0x41ce54
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x41ce91
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x41ce9f
add edx, 0x20
sub ecx, edx
je 0x41ceb8
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x41ce4d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x428180
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b9b0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004ae3ab
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x428202
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004ac19a
mov eax, dword [eax]
push 0x521e38
push eax
call fcn.0049d844
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004ae636
test bl, bl
je 0x428202
push 0x521e38
lea ecx, [esp + 0xc]
call fcn.004ae9c6
push 0x521e44
lea ecx, [esp + 0xc]
call fcn.004ae9c6
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42823e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004ae636
jmp 0x428309
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4282c2
lea edx, [esp + 0x7c]
push 0x521e40
push edx
call fcn.0049d844
add esp, 8
test eax, eax
je 0x4282c2
lea eax, [esp + 0x7c]
push 0x521e3c
push eax
call fcn.0049d844
add esp, 8
test eax, eax
je 0x4282c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x428252
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004ae636
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x428b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x428b62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x428b70
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b9b8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x533130]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x428ca8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x428bd6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004ae636
xor eax, eax
jmp 0x428d1f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004ae773
push esi
lea ecx, [esp + 0xc]
call fcn.004aea02
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x428cfd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00428b00
test eax, eax
jne 0x428cfd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00428b00
test eax, eax
jne 0x428cfd
lea eax, [esp + 0x14]
push 0x521e54
push eax
call fcn.0049e990
mov esi, eax
add esp, 8
test esi, esi
jne 0x428cdc
lea ecx, [esp + 0x14]
push 0x521e50
push ecx
call fcn.0049e910
mov esi, eax
add esp, 8
test esi, esi
jne 0x428cdc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x428cdf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004ae723
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x428bee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004ae636
xor eax, eax
jmp 0x428d1f
mov byte [esi], 0
push 0x521e4c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004ae636
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4