joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ffd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1000fffa
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1000fffa
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10010004
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010046
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100100a8
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100100a3
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1001008e
test dl, dl
je 0x1001008a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1001008e
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001006e
xor eax, eax
jmp 0x10010093
sbb eax, eax
or eax, 1
test eax, eax
je 0x100100b4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x1001005b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10010148
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1001016b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1001016b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10010175
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100101b7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10010219
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10010214
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100101ff
test dl, dl
je 0x100101fb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100101ff
add ecx, 2
add eax, 2
test dl, dl
jne 0x100101df
xor eax, eax
jmp 0x10010204
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010225
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100101cc
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100102b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100102da
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100102da
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100102e4
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010326
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10010388
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10010383
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1001036e
test dl, dl
je 0x1001036a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1001036e
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001034e
xor eax, eax
jmp 0x10010373
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010394
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x1001033b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10010426
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10010449
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10010449
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10010453
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010495
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100104f7
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100104f2
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100104dd
test dl, dl
je 0x100104d9
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100104dd
add ecx, 2
add eax, 2
test dl, dl
jne 0x100104bd
xor eax, eax
jmp 0x100104e2
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010503
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100104aa
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x10015698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x100156bb
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10015793
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x100157b6
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1001596f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10015992
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1001c9a0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x10038ba4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1001c9b3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x1001c9f4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10038c4c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1001ca26
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001ca2a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1001ca1b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1001ca48
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001ca4c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1001ca3d
xor ecx, ecx
mov eax, 0x10038bb4
xor ebx, ebx
mov bl, byte [ecx + 0x10038c5c]
cmp byte [esp + ebx + 0x14], 0
je 0x1001ca77
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10038c74]
cmp byte [esp + ebx + 0x14], 0
je 0x1001ca8e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1001ca5e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1001c9e7
lea edx, [esp + 0x84]
push edx
call fcn.1001cad0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x10170c35
Capabilities:
Encode data using xor

Disassembly:
push 0x4c6fbac3
call fcn.10240354
push 0x8097c15e
call fcn.1038723c
push 0x634fe2c3
call fcn.10240354
sal edi, 0xdc
stc
xlatb
push ds
out dx, eax
xor dword [ebx + 5], 0xa
std
jle 0x10170c72
fldenv [esi + eax*2 - 0x68eb3311]
int 0x3e
add dl, byte [esi - 0x7c88a9d3]
stc
inc eax
jle 0x10170cf4
out dx, eax
pop es
cmp ebp, dword [eax - 0x30]
adc dl, byte [ebx - 0x7948d12d]
xchg edx, eax
mov al, 0xa1
inc byte [esp + esi*8 - 0x1e549dd0]
xchg ecx, eax
xor eax, 0xd5875d06
add al, 0x3f
pop esi
sar byte [esi + edx*2 - 0x74555142], 0x6d
out 0x1e, eax
inc edi
adc eax, 0x27513844
jmp dword [ebx]
jnp 0x10170c9e
mov dh, 0x11
out dx, al
sub ah, byte [edi - 0x65]
pop edx
and esi, dword [edx + 0x37]
aas
inc esi
and edi, edi
dec esp
pop ss
adc byte [0x813e748], bl
lodsd eax, dword [esi]
inc edi
adc byte [edx - 0x6cbcc9f2], ah
invalid

Function at 0x1018894f
Capabilities:
Encode data using xor

Disassembly:
push ebp
test edi, ebx
mov ebp, esp
bt cx, 0xd
btr ecx, ebx
lea esp, [esp - 8]
rcr cx, 0x34
push ebx
push esi
push edi
cmc
and edi, edi
mov edi, eax
mov ebx, dword [edi + 8]
sbb cx, 0x31d1
btr cx, si
sub eax, eax
mov ecx, edx
add ecx, dword [ebp + 0xc]
adc eax, dword [ebp + 0x10]
sub esi, esi
cmc
cmp esi, eax
ja 0x1024e4dc
jb 0x1018899b
cmp ebx, ecx
jae 0x1024e4dc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
movzx ebp, si
xchg ebp, ebp
pop ebp
ret 0x10
mov edi, dword [edi + 4]
bsf ax, cx
bt ax, 0x72
mov eax, dword [ebp + 8]
test ebp, 0x1f981d1a
cmp bp, cx
add edi, dword [eax]
stc
test si, bp
cmp eax, 0x1fde2a21
sub esi, esi
test dx, dx
test edx, edx
jbe 0x1024e56a
sub ecx, ecx
inc bx
adc bx, cx
mov eax, esi
btc ebx, edx
add ebx, esp
add eax, dword [ebp + 0xc]
movsx ebx, sp
inc bh
mov bl, cl
adc ecx, dword [ebp + 0x10]
bswap ebx
inc esi
rol ebx, cl
btc bx, 0xd0
rcr bh, cl
mov dword [ebp - 4], ecx
stc
cmovne bx, bp
mov ecx, dword [ebp + 8]
rcr bl, cl
stc
mov ebx, dword [ecx + 4]
rol cl, cl
mov cl, al
rol ebx, cl
cmp sp, bp
add bl, al
cmc
test eax, esp
xor bl, byte [eax + edi]
sar al, 0x46
mov eax, dword [ebp + 0x14]
mov byte [esi + eax - 1], bl
test ebx, esi
cmp esi, edx
jb 0x1024e50c
pop edi
setne al
xchg si, si
pop esi
xchg bl, al
mov al, 1
pop ebx
mov esp, ebp
movzx ebp, bp
pop ebp
ret 0x10
Function at 0x5366a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
push edi
jmp 0x5366ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5366c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5366b0
mov eax, 1
add ebx, ebx
jne 0x5366d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5366e4
jne 0x536703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536703
dec eax
add ebx, ebx
jne 0x5366f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5366c8
add ebx, ebx
jne 0x5366ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x536755
xor ecx, ecx
sub eax, 3
jb 0x53671b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53678a
sar eax, 1
mov ebp, eax
jmp 0x536726
add ebx, ebx
jne 0x536726
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5366f4
inc ecx
add ebx, ebx
jne 0x536734
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5366f4
add ebx, ebx
jne 0x536741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x536736
jne 0x536752
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x536736
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x536774
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x536766
jmp 0x5366b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x536774
add edi, ecx
jmp 0x5366b6
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x536792
cmp byte [edi], 0x11
jne 0x536792
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x536797
lea edi, [esi + 0x12f000]
mov eax, dword [edi]
or eax, eax
je 0x53680f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x186e70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x186fec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5367c4
mov ecx, edi
jns 0x5367f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x186ff0]
or eax, eax
je 0x536809
mov dword [ebx], eax
add ebx, 4
jmp 0x5367e1
call dword [esi + 0x187000]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x536840
cmp al, 0xef
ja 0x536833
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x536815
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x536822
mov ebp, dword [esi + 0x186ff4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x536874
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x1000a560
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1008808b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1007cc33
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1000a5e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.1007ab0d
mov eax, dword [eax]
push 0x1016bc5c
push eax
call fcn.1006d7c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1007cebe
test bl, bl
je 0x1000a5e2
push 0x1016bc5c
lea ecx, [esp + 0xc]
call fcn.1007d24e
push 0x1016bc68
lea ecx, [esp + 0xc]
call fcn.1007d24e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1000a61e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1007cebe
jmp 0x1000a6e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1000a6a2
lea edx, [esp + 0x7c]
push 0x1016bc64
push edx
call fcn.1006d7c4
add esp, 8
test eax, eax
je 0x1000a6a2
lea eax, [esp + 0x7c]
push 0x1016bc60
push eax
call fcn.1006d7c4
add esp, 8
test eax, eax
je 0x1000a6a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000a632
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1007cebe
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1000aee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1000af42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1000af50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1008810b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x10175528]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1000b088
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000afb6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1007cebe
xor eax, eax
jmp 0x1000b0ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.1007cffb
push esi
lea ecx, [esp + 0xc]
call fcn.1007d28a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1000b0dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.1000aee0
test eax, eax
jne 0x1000b0dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.1000aee0
test eax, eax
jne 0x1000b0dd
lea eax, [esp + 0x14]
push 0x1016bc78
push eax
call fcn.1006e840
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000b0bc
lea ecx, [esp + 0x14]
push 0x1016bc74
push ecx
call fcn.1006e7c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000b0bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1000b0bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1007cfab
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000afce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1007cebe
xor eax, eax
jmp 0x1000b0ff
mov byte [esi], 0
push 0x1016bc70
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1007cebe
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4