joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053e0]
test esi, esi
jle 0x401ccd
mov edi, dword [0x4053e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401c14
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401cc6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401c00
mov dword [esp], eax
mov ebx, eax
call fcn.00402510
test eax, eax
mov edi, eax
je 0x401d0a
lea ebx, [esi + esi*2]
mov esi, dword [0x4053e4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00402610
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4053e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401cea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401cbf
sub eax, 0x40
and eax, 0xffffffbf
je 0x401cbf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4053e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401cd4
add dword [0x4053e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401c1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401b80
mov eax, dword [0x4053e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401b80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401b80
lea esi, [esi]

Function at 0x402180
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4021d5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021ce
test esi, esi
je 0x4021ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021b0
mov dword [esp], 0x4053f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402430
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402468
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40245e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40246a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402450
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4015245
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4008bc0]
jne 0x401524e
ret
jmp fcn.040155ef

Function at 0x4015f13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4015f22
pop dword [ebp - 0x44]
mov eax, 0x4015f22
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xebaa5b58
add dword [ebp - 0x54], 0x62a7e9f3
mov dword [ebp - 0x50], 0xe26b9a6c
add dword [ebp - 0x50], 0x4fc7b1d9
mov dword [ebp - 0x4c], 0x3c95559b
sub dword [ebp - 0x4c], 0xf049116d
mov dword [ebp - 0x48], 0xa00b390
add dword [ebp - 0x48], 0xf5ff4c70
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x78a3d4e2
add dword [ebp - 0x54], 0xfbce9474
mov dword [ebp - 0x50], 0x8e780849
add dword [ebp - 0x50], 0xb2f4592c
mov dword [ebp - 0x4c], 0x482ee43b
sub dword [ebp - 0x4c], 0xe4bf77cf
mov dword [ebp - 0x48], 0xfeaeeebe
sub dword [ebp - 0x48], 0xfeaeeebe
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x338d4
push 0
call eax
mov ecx, 0x6083ba4a
sub ecx, 0x60837e1c
xor edi, edi
add edi, eax
mov edx, 0x2ab65405
add edx, 0xd953abfb
add edx, dword [ebp - 0x44]
mov esi, 0x2bfd0536
add esi, 0x73f01585
xor dword [ebp - 0x30], ebx
mov ebx, dword [edx]
add dword [ebp - 0x14], edi
add ebx, esi
xor dword [ebp - 0x3c], ecx
mov dword [edi], ebx
xor dword [ebp - 0x38], edx
add edi, 0xe1aae37e
sub edi, 0xe1aae37a
add edx, 0xb2922a38
sub edx, 0xb2922a34
loop 0x4016037
add eax, 0xf271b1fe
sub eax, 0xf270ce73
xor ebx, ebx
add ebx, eax
add eax, 0xa33848dd
add eax, 0x5cc7b728
mov ecx, sym.acewstr.dll_Ordinal_6
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x76510d4d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x49be62fe
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401a38
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.004063ff
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x401a7f
cmp dword [ebp + 0x14], 0
je 0x401a7f
xor eax, eax
jmp 0x401a84
mov eax, 1
test eax, eax
je 0x401ab8
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetCursorPos]
nop
nop
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00406c70
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401aed
push ebx
call fcn.004063f9
add esp, 4
pop eax
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
nop
nop
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
call fcn.00401b6a
push eax
push 0x100
push 0xd
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x401b41
push eax
mov ebx, eax
call fcn.004019cd
inc eax
push eax
call fcn.004063ff
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x401b46
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004063f9
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401b63
push ebx
call fcn.004063f9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40306e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x4030ae
mov eax, 0
jmp 0x40317f
cmp dword [ebp + 0x14], 0
je 0x4030c2
mov eax, 0x100
jmp 0x4030c7
mov eax, 0x200
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x18]
push 2
mov ebx, 0xc8
call fcn.004070c0
add esp, 0x1c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x40310d
add eax, 8
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403132
mov eax, 0
jmp 0x40317f
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x403150
add eax, 8
push eax
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
nop
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x40317f
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4048ee
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x404935
cmp ebx, 0x20
je 0x404935
cmp ebx, 0xffffffe0
je 0x404935
jne 0x40493e
add eax, 1
cmp esi, eax
je 0x40494b
jne 0x40491a
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x40494f
jne 0x404916
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x404963
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x404a24
test ecx, ecx
je 0x404a24
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x404a24
test ebx, ebx
je 0x404a24
mov ebx, eax
add ebx, edx
je 0x404a24
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x404a24
cmp dword [edx + eax + 0x14], 0
je 0x404a24
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x404a24
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x404a14
test dl, dl
je 0x404a10
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x404a14
add edi, 2
add esi, 2
test dl, dl
jne 0x4049f4
xor eax, eax
jmp 0x404a19
sbb eax, eax
or eax, 1
test eax, eax
je 0x404a30
inc ebp
cmp ebp, dword [esp + 4]
jb 0x4049e1
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x405991
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4059bf
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4059b6
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4059ae
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4059e0
mov esp, ebp
pop ebp
ret

Function at 0x4059e4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x405a50
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x405a7d
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x405a6c
xor ecx, eax
xor edx, ebx
dec edi
jne 0x405a5d
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x405aa3
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x405a44
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405acf
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4070e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4070fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4070f3
pop esi
ret
Function at 0x401612
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x401748
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x401635
cmp dword [edx + 0x10], esi
jne 0x40162d
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], closesocket
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x401748
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x401741
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x4016c2
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x4016c2
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x4016c7
jmp 0x401741
add edx, 0x28
jmp 0x4016a1
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x401741
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x401741
cmp dword [ebp - 0x24], 8
jne 0x401741
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x401741
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x40174c
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x401760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x401769
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x40178c
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x40178c
mov eax, ebx
jmp 0x4017a1
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x401778
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x41b3a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x41b3d4
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0041dc75
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b3e5
push ebx
call fcn.0041dc87
add esp, 4
pop eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41b44d
mov ecx, dword [eax + 4]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b44d
mov edx, ebx
mov esp, ecx
or bh, bl
cmp edx, 0xff
cmovbe edx, ebx
mov ebx, edx
and esp, 0xfffffffc
shl ebx, 0x10
sub ecx, esp
or bx, dx
cmp edx, 0xffff
cmovbe edx, ebx
lea ebx, [eax + 8]
test esp, esp
je 0x41b42e
add esp, ebx
xor dword [ebx], edx
add ebx, 4
cmp esp, ebx
jne 0x41b425
test ecx, ecx
je 0x41b44d
xor byte [ebx], dl
test ecx, 2
je 0x41b44d
xor byte [ebx + 1], dh
test ecx, 1
je 0x41b44d
shr edx, 0x10
xor byte [ebx + 2], dl
leave
ret 8
Function at 0x42cb10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5f80fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005d31c6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42cb92
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005cf275
mov eax, dword [eax]
push 0x1b26c64
push eax
call fcn.004af4b3
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005d3451
test bl, bl
je 0x42cb92
push 0x1b26c64
lea ecx, [esp + 0xc]
call fcn.005d382d
push 0x1b26c70
lea ecx, [esp + 0xc]
call fcn.005d382d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42cbce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005d3451
jmp 0x42cc99
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42cc52
lea edx, [esp + 0x7c]
push 0x1b26c6c
push edx
call fcn.004af4b3
add esp, 8
test eax, eax
je 0x42cc52
lea eax, [esp + 0x7c]
push 0x1b26c68
push eax
call fcn.004af4b3
add esp, 8
test eax, eax
je 0x42cc52
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42cbe2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005d3451
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4
Function at 0x42d4b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5f817b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x1b40b40]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x42d5e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x42d516
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005d3451
xor eax, eax
jmp 0x42d65f
push 0x1b26cac
lea ecx, [esp + 0xc]
call fcn.005d35da
push esi
lea ecx, [esp + 0xc]
call fcn.005d3869
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x1b26ca4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42d63d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x1b26c9c
push closesocket
call fcn.004f08a0
test eax, eax
jne 0x42d63d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x1b26c88
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004f08a0
test eax, eax
jne 0x42d63d
lea eax, [esp + 0x14]
push 0x1b26c80
push eax
call fcn.004b0a00
mov esi, eax
add esp, 8
test esi, esi
jne 0x42d61c
lea ecx, [esp + 0x14]
push 0x1b26c7c
push ecx
call fcn.004b0850
mov esi, eax
add esp, 8
test esi, esi
jne 0x42d61c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42d61f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005d358a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42d52e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005d3451
xor eax, eax
jmp 0x42d65f
mov byte [esi], 0
push 0x1b26c78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005d3451
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4