joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc63b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009db8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x1009f210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.0048aacf
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x3038], bl
mov dword [esi], 0x100a1a90
mov dword [esi + 4], 0x100a1a80
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4fe0b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x4fe0fc
cmp ecx, 0x8000
jae 0x4fe146
neg eax
and eax, 0x7fff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x20]
cmp eax, edx
jb 0x4fe114
call fcn.0048abbd
mov byte [esp + 8], al
jmp 0x4fe11d
mov dl, byte [eax]
inc eax
mov byte [esp + 8], dl
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
shl eax, 8
and ecx, 0xff
or eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
shl ecx, 8
shl eax, 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], eax
jmp 0x4fe0d7
pop esi
ret 4
Function at 0x501f34
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, 1
xor bl, bl
push edi
mov edi, dword [esp + 0x38]
cmp esi, eax
mov dword [esp + 0x10], ecx
jbe 0x501f5c
mov cl, byte [eax + edi]
xor bl, cl
inc eax
cmp eax, esi
jb 0x501f52
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.004878c0
mov dword [ebp + 0x14], 0xffffffff
mov al, byte [edi]
cmp bl, al
jne 0x501f9a
xor ebx, ebx
cmp esi, ebx
jbe 0x501f9c
mov edx, esi
mov ecx, edi
call fcn.00502004
cmp eax, ebx
mov dword [ebp + 0x14], eax
jge 0x501fed
mov ecx, dword [esp + 0x10]
dec esi
push ebp
inc edi
push esi
push edi
call fcn.00501c24
jmp 0x501f9c
xor ebx, ebx
mov eax, 3
mov ecx, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004878e9
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
shl edi, 5
add edi, esi
mov ecx, 8
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, edx
mov dword [ebp + 8], edx
shl eax, 5
mov dword [eax + ecx - 0x20], 0x16
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x5057f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x100bc040]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jl 0x50580b
add edi, 4
cmp edi, 0x10
jl 0x505800
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x506064
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x507344
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa8
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x507375
lea ecx, [esp + 0x4c]
call fcn.00506064
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0
push 0x40
push eax
mov dword [esp + 0x78], 0
call fcn.00506874
mov ecx, dword [esp + 0xb8]
push ecx
lea ecx, [esp + 0x50]
call fcn.00506964
pop edi
pop esi
pop ebx
add esp, 0xa8
ret 4

Function at 0x509274
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x50929b
pop esi
ret

Function at 0x50efa4
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x50efb4
pop edi
pop ebx
ret

Function at 0x50efe4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x50eff4
pop esi
pop ebp
pop ebx
ret 4
Function at 0x50f294
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x50f405
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x50f31e
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x50f2f4
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x50f2d8
cmp edx, 0x10
jae 0x50f39f
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x50f344
cmp edx, dword [esp + 0x1c]
jae 0x50f405
or eax, 8
xor edi, edi
cmp eax, 1
je 0x50f385
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x50f358
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x50f344
cmp edx, dword [esp + 0x1c]
jae 0x50f405
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x50f3b4
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x50f3ea
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x50f3c4
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x50f3b4
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x510f34
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x510f54
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x510f64
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x510f54
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x510fc4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x511055
jmp 0x511018
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x511014
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x510fd7
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x5110ff
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x5110f3
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x5110c4
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x5110b4
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x511122
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x51110c
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x511144
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x5110a4
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0x5165e4
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x5173e4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test edx, edx
je 0x51741f
push esi
push edi
mov edi, dword [esp + 0x10]
mov edi, edi
movzx esi, byte [ecx]
xor esi, eax
shrd eax, edi, 8
and esi, 0xff
xor eax, dword [esi*8 + 0x100be060]
shr edi, 8
xor edi, dword [esi*8 + 0x100be064]
inc ecx
dec edx
jne 0x5173f4
mov edx, edi
pop edi
pop esi
ret 8
mov edx, dword [esp + 8]
ret 8
Function at 0x1003cde
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
push edi
xor edi, edi
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
je 0x1003cee
cmp eax, edi
je 0x1003cee
mov eax, dword [esi + 0x2c]
cmp dword [eax], edi
jne 0x1003cee
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x1003cb9
cmp dword [eax], edi
jne 0x1003cb9
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
je 0x1003cb9
push eax
call fcn.010030b2
push dword [esi + 0x3c]
call fcn.010051df
pop ecx
pop ecx
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x1003cdc
cmp dword [eax], edi
jne 0x1003cdc
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
je 0x1003cdc
push eax
call fcn.010030b2
push dword [esi + 0x3c]
call fcn.01005175
pop ecx
pop ecx
push dword [esi + 0x2c]
call fcn.010030b2
push dword [esi + 0x3c]
call fcn.010030b2
pop ecx
pop ecx
mov eax, dword [esi + 0x40]
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
je 0x1003d11
cmp eax, edi
je 0x1003d11
cmp dword [eax], edi
jne 0x1003d11
push eax
call fcn.010030b2
push dword [esi + 0x44]
call fcn.010030b2
pop ecx
pop ecx
mov eax, dword [esi + 0x50]
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
je 0x1003d38
cmp eax, edi
je 0x1003d38
cmp dword [eax + 0xb4], edi
jne 0x1003d38
push eax
call fcn.01004fdb
push dword [esi + 0x50]
call fcn.010030b2
pop ecx
pop ecx
push esi
call fcn.010030b2
pop ecx
pop edi
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10024b62
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x10024b6b
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x10024b8e
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x10024b8e
mov eax, ebx
jmp 0x10024ba3
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x10024b7a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x1002cc00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100aa050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1009f561
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.1002ddd0
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1002cc54
jmp dword [ecx*4 + 0x1002cdbc]
mov al, byte [esi]
test al, al
je 0x1002cc82
cmp al, 0x20
je 0x1002cc6e
cmp al, 0xa1
jne 0x1002cc82
cmp byte [esi + 1], al
jne 0x1002cc82
test al, 0x80
je 0x1002cc7a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1002cc82
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002cc61
test ecx, ecx
je case.default.0x1002cc54
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1002cc54
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1002ccc8
cmp dl, 0xa1
jne 0x1002ccbc
cmp byte [eax + 1], 0xa1
jne 0x1002ccbc
test ecx, ecx
jne 0x1002ccb4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1002ccdc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1002ccf6
jmp 0x1002ccdc
cmp dl, 0x20
jne 0x1002ccda
test ecx, ecx
jne 0x1002ccd3
mov edi, eax
mov ecx, 1
jmp 0x1002ccdc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1002cc9c
cmp ecx, 1
jne case.default.0x1002cc54
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1002cc54
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1002cc54
mov al, byte [esi]
test al, al
je 0x1002cd4e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1002cd34
mov cl, byte [esi + 1]
test cl, cl
je 0x1002cd4e
cmp al, 0xa1
jne 0x1002cd24
cmp cl, al
je 0x1002cd31
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.1002e0a0
inc esi
jmp 0x1002cd46
cmp al, 0x20
je 0x1002cd46
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.1002e0e0
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002cd0d
push 0
lea ecx, [esp + 0x14]
call fcn.1002e0e0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100384c0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1002cd81
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100b2aa8
call fcn.1002dfd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1009f4f3
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10032af0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100aa55b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1009f268
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10032b72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.1009d17a
mov eax, dword [eax]
push 0x100c8cd0
push eax
call fcn.1008fc84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1009f4f3
test bl, bl
je 0x10032b72
push 0x100c8cd0
lea ecx, [esp + 0xc]
call fcn.1009f883
push 0x100c8cdc
lea ecx, [esp + 0xc]
call fcn.1009f883
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10032bae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1009f4f3
jmp 0x10032c79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10032c32
lea edx, [esp + 0x7c]
push 0x100c8cd8
push edx
call fcn.1008fc84
add esp, 8
test eax, eax
je 0x10032c32
lea eax, [esp + 0x7c]
push 0x100c8cd4
push eax
call fcn.1008fc84
add esp, 8
test eax, eax
je 0x10032c32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10032bc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1009f4f3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10033470
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100334d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x100334e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100aa5db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100d2a9c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x10033618
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x10033546
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1009f4f3
xor eax, eax
jmp 0x1003368f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.1009f630
push esi
lea ecx, [esp + 0xc]
call fcn.1009f8bf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1003366d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.10033470
test eax, eax
jne 0x1003366d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.10033470
test eax, eax
jne 0x1003366d
lea eax, [esp + 0x14]
push 0x100c8cec
push eax
call fcn.10090d00
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003364c
lea ecx, [esp + 0x14]
push 0x100c8ce8
push ecx
call fcn.10090c80
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003364c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1003364f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1009f5e0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1003355e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1009f4f3
xor eax, eax
jmp 0x1003368f
mov byte [esi], 0
push 0x100c8ce4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1009f4f3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4