joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000266f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
mov ecx, dword [0x1013ac60]
xor esi, esi
cmp ecx, 0xffff
movzx eax, cx
mov dword [ebp - 0x18], ecx
cmova eax, edx
movzx ebx, ax
test edi, edi
je 0x1000274f
mov eax, dword [edi + 0x3c]
mov ecx, esi
mov dword [ebp - 4], ecx
mov edx, dword [eax + edi + 0x78]
add edx, edi
mov dword [ebp - 0x1c], edx
mov eax, dword [edx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x24]
add eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x1c]
add eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x18]
cmp eax, dword [edx + 0x14]
cmovbe eax, dword [edx + 0x14]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1000274f
mov eax, esi
mov dword [ebp - 0x14], ebx
cmp eax, dword [edx + 0x14]
jae 0x100026f3
mov ecx, dword [ebp - 8]
mov ebx, dword [ecx + eax*4]
mov ecx, dword [ebp - 0xc]
add ebx, edi
movzx eax, word [ecx + eax*2]
jmp 0x100026f8
mov ebx, esi
movzx eax, cx
movzx ecx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4]
add eax, edi
mov dword [ebp - 0x24], eax
mov eax, dword [edx + 0x10]
add eax, ecx
cmp dword [ebp - 0x14], eax
je 0x1000274c
test ebx, ebx
je 0x1000273b
mov eax, dword [0x1013ad84]
test eax, eax
jne 0x1000272e
push ecx
mov ecx, 0x258ad2dd
call fcn.1000203e
pop ecx
mov dword [0x1013ad84], eax
push dword [ebp - 0x18]
push ebx
call eax
test eax, eax
je 0x1000274c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
inc ecx
movzx eax, cx
mov dword [ebp - 4], ecx
cmp eax, dword [ebp - 0x20]
jb 0x100026dd
jmp 0x1000274f
mov esi, dword [ebp - 0x24]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x100027d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x100027fc
push ebx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov eax, esi
push 0x1c
pop ebx
div ebx
mov al, byte [edx + ecx]
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x100027e5
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x100027ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.100183e0
push ebx
push esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], edx
push eax
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.10002974
push 0x12
pop edi
lea ebx, [eax + 2]
mov edx, ebx
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x10002828
xor ecx, ecx
mov word [eax + 0x26], cx
mov eax, dword [0x1013ae80]
test eax, eax
jne 0x10002857
push ecx
mov ecx, 0xd03b7a91
call fcn.1000203e
pop ecx
mov dword [0x1013ae80], eax
push esi
push esi
push esi
push esi
push ebx
call eax
mov ebx, eax
test ebx, ebx
je 0x1000296d
mov eax, dword [0x1013adc8]
test eax, eax
jne 0x10002882
push ecx
mov ecx, 0xe2cf6f66
call fcn.1000203e
pop ecx
mov dword [0x1013adc8], eax
push esi
push 0x84000000
push esi
push esi
push dword [ebp - 4]
push ebx
call eax
mov edi, eax
test edi, edi
je 0x10002959
push 0x1000
lea eax, [ebp - 0x1034]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.1000de70
add esp, 0xc
jmp 0x10002929
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1000294e
mov edx, dword [ebp - 0xc]
cmp dword [edx], esi
jne 0x100028d8
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x100028ef
mov eax, dword [ebp - 4]
add eax, ecx
push eax
push dword [edx]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
test eax, eax
je 0x10002959
push dword [ebp - 8]
add eax, dword [ebp - 4]
lea ecx, [ebp - 0x1034]
push ecx
push eax
call fcn.1000d8f0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
push 0x1000
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1034]
push esi
push eax
call fcn.1000de70
add esp, 0x18
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x1000
lea eax, [ebp - 0x1034]
push eax
push edi
call fcn.1000b6a0
call eax
test eax, eax
jne 0x100028b4
jmp 0x10002959
mov eax, dword [ebp + 8]
xor esi, esi
mov ecx, dword [ebp - 4]
inc esi
mov dword [eax], ecx
push ebx
call fcn.1000b6bb
call eax
test edi, edi
je 0x1000296d
push edi
call fcn.1000b6bb
call eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1000306a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1001e1e0]
mov eax, dword [0x1013ae90]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
mov word [ebp - 0x1c], 0x6991
mov byte [ebp - 0x1a], 0xe7
push edi
mov edi, edx
movups xmmword [ebp - 0x2c], xmm0
test al, 1
jne 0x100030d9
xorps xmm0, xmm0
mov byte [0x1013ad13], 1
or eax, 1
movlpd qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [0x1013ae90], eax
mov al, byte [ebp + ecx - 0x2c]
mov byte [ecx + 0x1013ad00], al
add ecx, 1
adc edx, ebx
jne 0x100030ce
cmp ecx, 0x13
jb 0x100030b8
push 0x10018672
call fcn.1000ca28
pop ecx
mov esi, 0x1013ad00
cmp byte [0x1013ad13], bl
je 0x10003103
push 0x1010101
push 0x65e759bf
push ebx
push 0x13
mov ecx, esi
call fcn.10001f28
add esp, 0x10
mov byte [0x1013ad13], bl
mov eax, dword [0x1013aed0]
test eax, eax
jne 0x1000311d
push ecx
mov ecx, 0xe23b96e7
call fcn.1000203e
pop ecx
mov dword [0x1013aed0], eax
push ebx
push ebx
push ebx
push ebx
push esi
call eax
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x10003185
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, dword [0x1013acf4]
test eax, eax
jne 0x1000315f
push ecx
mov ecx, 0xf4cf8bbc
call fcn.1000203e
pop ecx
mov dword [0x1013acf4], eax
xor edi, edi
push edi
push 0x84000000
push edi
push edi
push dword [ebp - 0xc]
push esi
call eax
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1000318c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1000b6bb
call eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 4
push 0x3000
push 0x100000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x100000
push edi
push dword [ebp - 0xc]
call fcn.1000b6a0
call eax
test eax, eax
je 0x10003215
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
je 0x10003212
mov eax, 0x5a4d
cmp word [edi], ax
je 0x100031d2
cmp dword [ebp - 4], 0
je 0x10003212
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [ebp - 4]
push 4
push 0x3000
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x100000
push edi
push esi
call fcn.1000b6a0
call eax
test eax, eax
jne 0x100031bc
mov esi, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1000b6bb
call eax
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
jmp 0x10003187

Function at 0x10003269
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push eax
push eax
push esi
push 0x1000323f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x14]
pop esi
ret
Function at 0x10003dc1
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
push edi
push 0x76
pop edi
push 6
pop ecx
push 0x16
pop esi
push 3
mov word [ebp - 0x1c], cx
xor edx, edx
xor ecx, ecx
mov word [ebp - 0x20], 0x53
mov word [ebp - 0x1a], cx
inc edx
pop ecx
push 0x1c
mov word [ebp - 0x14], cx
xor ebx, ebx
pop ecx
push 0x15
mov word [ebp - 0x10], cx
mov al, 0x53
pop ecx
push 0x1a
mov word [ebp - 0xe], cx
pop ecx
push 0x1f
mov word [ebp - 0xc], cx
pop ecx
push 0xf
mov word [ebp - 0xa], cx
pop ecx
mov word [ebp - 4], cx
xor ecx, ecx
push 0xe
mov word [ebp - 0x16], dx
mov word [ebp - 0x12], dx
mov word [ebp - 0x1e], di
mov word [ebp - 0x18], si
mov word [ebp - 8], si
mov word [ebp - 6], di
mov word [ebp - 2], cx
pop edx
cbw
xor word [ebp + ecx*2 - 0x1e], ax
inc ecx
cmp ecx, edx
jae 0x10003e49
mov al, byte [ebp - 0x20]
jmp 0x10003e38
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [ebp - 2], ax
lea eax, [ebp - 0x238]
push 0x200
push eax
lea eax, [ebp - 0x1e]
push eax
call edi
lea eax, [ebp - 0x32]
push eax
call fcn.10003f48
push 0x17
pop esi
lea ecx, [eax + 2]
mov dword [ebp - 0x38], ecx
mov edx, ecx
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub esi, 1
jne 0x10003e7b
xor ecx, ecx
mov word [eax + 0x30], cx
lea eax, [ebp - 0x438]
push 0x200
push eax
push dword [ebp - 0x38]
call edi
push 0x3c
pop ecx
push 0x1b
mov word [ebp - 0x16], cx
mov al, 0x7a
pop ecx
push 0xc
mov word [ebp - 0x14], cx
pop ecx
push 0x15
mov word [ebp - 0x12], cx
pop ecx
push 8
mov word [ebp - 0x10], cx
pop ecx
push 0x13
mov word [ebp - 0xe], cx
pop ecx
push 0xe
mov word [ebp - 0xc], cx
pop ecx
push 0x1f
mov word [ebp - 0xa], cx
pop ecx
push 9
mov word [ebp - 8], cx
pop ecx
mov word [ebp - 6], cx
push 0x26
pop ecx
mov word [ebp - 4], cx
xor ecx, ecx
mov word [ebp - 0x18], 0x7a
mov word [ebp - 2], cx
cbw
xor word [ebp + ebx*2 - 0x16], ax
inc ebx
cmp ebx, 0xa
jae 0x10003f07
mov al, byte [ebp - 0x18]
jmp 0x10003ef5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov word [ebp - 2], ax
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x238]
push eax
call esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x238]
push eax
call esi
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
leave
ret
Function at 0x10003fe9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
xor ebx, ebx
lea eax, [ebp - 0x68]
push esi
push edi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call fcn.10004192
mov esi, eax
push 0x1f
pop edi
lea ecx, [esi + 2]
mov edx, ecx
movsx ax, byte [esi]
xor word [edx], ax
lea edx, [edx + 2]
sub edi, 1
jne 0x10004022
xor eax, eax
lea edx, [ebp - 4]
mov word [esi + 0x40], ax
lea eax, [ebp - 0x1c]
push eax
call fcn.100027ff
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
call fcn.10002793
push dword [ebp - 8]
mov esi, eax
mov ecx, 0x1001e080
push esi
mov dword [ebp - 0x1c], esi
call fcn.100027d5
add esp, 0xc
lea edi, [ebp - 0x68]
mov eax, 0x5a4d
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp word [ebp - 0x68], ax
jne 0x100040ac
mov ecx, dword [ebp - 0x1c]
call fcn.100024a5
mov esi, eax
test esi, esi
je 0x1000418b
mov ecx, esi
call fcn.1000266f
mov dword [0x1013ac68], eax
test eax, eax
je 0x1000409e
call eax
xor ebx, ebx
inc ebx
mov ecx, esi
call fcn.10002756
mov eax, ebx
jmp 0x1000418d
lea eax, [ebp - 0x68]
push eax
call fcn.1000426b
push 0x1f
pop esi
lea edi, [eax + 2]
mov edx, edi
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub esi, 1
jne 0x100040bd
xor ecx, ecx
lea edx, [ebp - 0xc]
mov word [eax + 0x40], cx
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.100027ff
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
call fcn.10002793
push dword [ebp - 0x10]
mov esi, eax
mov ecx, 0x1001e0a0
push esi
mov dword [ebp - 0x20], esi
call fcn.100027d5
add esp, 0xc
lea edi, [ebp - 0x68]
mov eax, 0x5a4d
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp word [ebp - 0x68], ax
jne 0x1000411c
mov ecx, dword [ebp - 0x20]
jmp 0x1000407a
lea eax, [ebp - 0x68]
push eax
call fcn.10004343
mov esi, eax
push 0x1f
pop eax
lea edx, [esi + 2]
movsx cx, byte [esi]
xor word [edx], cx
lea edx, [edx + 2]
sub eax, 1
jne 0x1000412d
mov word [esi + 0x40], ax
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 2]
call fcn.100027ff
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
call fcn.10002793
push dword [ebp - 0x18]
mov esi, eax
mov ecx, str.grqBnVaPVvADvAdDVHVizFWzeDhY
push esi
mov dword [ebp - 0x24], esi
call fcn.100027d5
add esp, 0xc
lea edi, [ebp - 0x68]
mov eax, 0x5a4d
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp word [ebp - 0x68], ax
jne 0x1000418b
mov ecx, dword [ebp - 0x24]
jmp 0x1000407a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012a2d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10012aca
push ebx
push esi
call fcn.100129f6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001293f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012a77
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012ac9
push edi
push eax
call fcn.10010c7c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012a97
call fcn.10010c42
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012ac8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001293f
add esp, 0x20
test eax, eax
jne 0x10012ab6
push edi
call fcn.10010c42
jmp 0x10012abe
push ebx
call fcn.10010c42
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012cc8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001aaf0
push 0x1001aae8
push str.FlsAlloc
push 0x1e
call fcn.10012be6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012cfc
push dword [ebp + 8]
mov ecx, esi
call dword [0x100191f0]
call esi
jmp 0x10012d02
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012d46
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001ab00
push 0x1001aaf8
push str.FlsGetValue
push 0x20
call fcn.10012be6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012d7d
push dword [ebp + 8]
mov ecx, esi
call dword [0x100191f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100182a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100182cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100182cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ca7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401cc8
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x401cbf
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x401cb7
mov eax, ebx
leave
ret

Function at 0x401cee
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x401d4d
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x401d7a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x401d69
xor ecx, eax
xor edx, ebx
dec edi
jne 0x401d5a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x401da0
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x401d41
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x4025e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.00401c6d
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x4027bf
push dword [ebp - 4]
call fcn.00401c51
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4026b0
jmp 0x4027bf
push dword [ebp - 4]
call fcn.00401c51
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x402704
lea eax, [ebp - 4]
push eax
call fcn.004025c6
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.00401e78
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x402704
mov eax, 1
jmp 0x402706
xor eax, eax
test eax, eax
je 0x4027b4
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x4027ac
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.004023e3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40279b
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.0040259f
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40274e
add esp, 0xc
jmp 0x4027bf
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x402689
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x4027e0
mov esp, ebp
pop ebp
ret 8
Function at 0x4377c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d446b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004c6313
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x437842
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004c3580
mov eax, dword [eax]
push 0x5e5250
push eax
call fcn.004b5204
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004c659e
test bl, bl
je 0x437842
push 0x5e5250
lea ecx, [esp + 0xc]
call fcn.004c697a
push 0x5e8de0
lea ecx, [esp + 0xc]
call fcn.004c697a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43787e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004c659e
jmp 0x437949
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x437902
lea edx, [esp + 0x7c]
push 0x5e8ddc
push edx
call fcn.004b5204
add esp, 8
test eax, eax
je 0x437902
lea eax, [esp + 0x7c]
push 0x5e8dd8
push eax
call fcn.004b5204
add esp, 8
test eax, eax
je 0x437902
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437892
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004c659e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x438140
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4381a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc