joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b28d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
mov al, byte [esp + 3]
mov ebp, dword [esp + 4]
neg ax
jmp 0x9b28a9
mov edx, dword [esp + 1]
rdtsc
xchg dx, ax
add bp, 0xdf14
cld
setle ah
jmp 0x9b2880
pop dx
btr dx, bp
pop word [esp]
mov bp, word [esp + 1]
not ebp
xchg byte [esp], ah
jmp 0x9b292b
xchg word [esp], ax
mov word [esp + 9], ax
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0x9b28f8
neg dh
adc dl, 0x36
not al
mov bp, 0xbe2a
jmp 0x9b2896
dec dx
lea edx, [esp + ebp]
pop eax
rdtsc
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
inc dx
jmp 0x9b290c
setl ah
sub esp, 7
mov dh, bh
mov eax, dword [esp + 0x13]
mov edx, dword [esp + 0x14]
not edx
jmp 0x9b28e2
mov eax, ebp
xchg dh, al
mov word [esp + 0xd], bp
push dword [esp + 0x17]
not al
xchg dx, ax
jmp 0x9b2952
mov ebp, 0x9b4c7357
xchg ebp, edx
mov dh, byte [esp + 1]
clc
rol dl, 1
pushal
jmp 0x9b28bf
mov ax, cx
mov ax, 0x7863
pop edx
mov edx, 0x8d3ac5a3
bswap edx
jmp 0x9b299a
add esp, 0x12
stc
cld
mov bp, word [esp]
not dx
lea esp, [esp + 0x13]
jmp 0x9b293c
xchg bp, dx
mov ax, word [esp]
sub esp, 0x1a
mov eax, 0x36211bf3
clc

Function at 0x9b2c42
Capabilities:
Execute anti-debugging instructions

Disassembly:
seto dl
mov al, byte [esp + 2]
mov byte [esp + 0x13], bh
push dword [esp + 0xb]
jmp 0x9b2c63
rdtsc
bswap ebp
xchg byte [esp + 0x18], dl
pushfd
jmp 0x9b2c2c
mov dh, byte [esp + 0x37]
pop word [esp + 0x15]
cmc
bswap ebp
push dx
neg dl
jmp 0x9b2cf1
mov eax, dword [esp + 0x30]
xchg dh, dl
add esp, 4
mov dl, byte [esp + 0x15]
mov word [esp + 0x1f], cx
jmp 0x9b2c4d
lea esp, [esp + 3]
push esi
push word [esp]
mov edx, ecx
rdtsc
mov word [esp + 3], dx
jmp 0x9b2cd8
xchg word [esp + 0x15], ax
lea edx, [eax + 0x71]
mov word [esp + 0x30], bx
mov eax, 0xd5922d12
pop dword [esp + 6]
mov ah, byte [esp + 5]
jmp 0x9b2c8a
mov dl, byte [esp]
xchg edx, eax
bsf dx, bx
mov eax, dword [esp + 0x58]
jmp 0x9b2d34
lea esp, [esp + 2]
mov ebp, dword [esp + 0x50]
xchg dx, ax
mov edx, 0x2cb43ec2
setbe al
jmp 0x9b2cc2
bts dx, ax
inc dh
neg dh
mov edx, dword [esp + 0x30]
lea ebp, [esp + ebx]
not dl
jmp 0x9b2ca6
lea esp, [esp + 0x74]
popfd
jmp 0x9b2d97
lea edx, [ebp*4]
bts edx, ebp
bt dx, cx
mov dl, cl
mov dl, 0x10
mov edx, dword [esp + 0x5d]
jmp 0x9b2d1a
Function at 0x9b348d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x12]
bswap eax
mov byte [esp + 4], dl
cld
dec dx
ror edx, cl
jmp 0x9b29d4
mov al, byte [esp + 0x18]
push dword [esp + 0x1a]
pop ebp
lea esp, [esp + 4]
xchg byte [esp + 0x10], dl
mov al, 0xd9
jmp 0x9b2356
not al
setle dl
pop edx
push word [esp + 0x24]
bsf bp, cx
jmp 0x9b23cc
xchg byte [esp], ah
bswap eax
neg eax
mov ah, byte [esp + 0xa]
bswap eax
lea ebp, [ecx + ebx]
jmp 0x9b2381
mov dl, cl
stc
cmc
mov ebp, 0x42bf8f6c
rdtsc
mov ax, 0x36c3
jmp 0x9b2397
mov ebp, 0x8348f274
mov eax, dword [esp + 0x19]
xchg dword [esp + 0x1b], eax
add esp, 0x21
pushfd
rdtsc
jmp 0x9b244f
fld xword [esi]
mov esp, 0x3acfa83a
mov ebp, 0xffedf29b
je 0x9b241d
push dword [esp + 0x16]
push ss
pop word [esp + 0xa]
mov edx, 0x5763712f
mov ebp, 0xbb2faa95
mov ah, byte [esp + 0x1a]
and ah, ch
jmp 0x9b23bb
push edi
aam 0x4a
sub eax, 0x66c104dc
mov eax, ecx
mov ax, cx
clc
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
mov byte [esp + 0xa], ah
xchg edx, eax
xchg bp, ax
jmp 0x9b23f6
mov byte [esp + 0xe], bh
std
call 0x9b2439
fstp qword [edx + esi*8 - 0x6b]
xchg ebx, eax
sub eax, 0xab5839a9
dec eax
jmp 0x9b23eb
sub esp, 0x1f
bt edx, ebp
mov dx, cx
mov byte [esp + 6], bh
rcr dl, cl
not ebp
jmp 0x9b2424
pop ebp
xchg ah, al
pop dword [esp + 7]
xchg dh, al
mov ax, cx
setle ah
jmp 0x9b2467
not eax
dec bp
pushal
xchg dword [esp + 4], edx
pop dword [esp + 0xb]
neg dx
jmp 0x9b236c
xor ax, ax
xor ah, bh
rdtsc
mov eax, dword [esp + 4]
pushal
lea esp, [esp + 0x43]
jmp 0x9b2acc
bsr bp, ax
lea edx, [ebp*4]
jmp 0x9b3203

Function at 0x9b3c32
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts si, ax
pop dword [esp + 0x13]
mov cl, al
mov dword [esp + 0x15], ebx
jmp 0x9b3c39
mov word [esp + 2], dx
jmp 0x9b3c1c
push dword [esp + 6]
lea eax, [ecx + ebx]
rdtsc
mov edx, ebp
lea eax, [ebx - 0x58]
bsf di, sp
jmp 0x9b3f48
sbb al, 8
lea edx, [esp + 0xfa]
bts ax, ax
push di
stc
mov ch, 0xf8
jmp 0x9b3c5d
rdtsc
xchg ah, al
mov ebp, dword [esp]
rdtsc
rdtsc
add esp, 0
jmp 0x9b3c79
cmc
mov word [esp], si
lea ebx, [ecx*4]
xchg cx, bp
sub esp, 0xb
lea esp, [esp + 0x11]
jmp 0x9b3cae
bsf esi, esi
mov di, 0x8189
lea eax, [edx*4]
lea edi, [eax + ecx]
mov si, 0xe07
sub esp, 9
jmp 0x9b3d7b
mov esi, dword [esp]
not ebp
btc ax, di
xchg dl, ah
bswap esi
lea edi, [edx + esi]
jmp 0x9b3dfa
sub esp, 0x1f
lea esp, [esp + 0x46]
rdtsc
mov bx, 0x46c7
or ch, 0xf8
cmc
jmp 0x9b3e79

Function at 0x9b4452
Capabilities:
Execute anti-debugging instructions

Disassembly:
not si
seto al
mov ebp, dword [esp + 9]
jmp 0x9b442f
Function at 0x401c8c
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00404070
mov dword [esp], eax
mov eax, dword [0x40b2c8]
push eax
push eax
call fcn.00406192
lea ecx, [esp + 8]
pop edx
call fcn.00403100
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [0x40b2c8]
push eax
push eax
push dword [esp + 8]
call fcn.00404090
lea ecx, [0x40b034]
pop edx
call fcn.00403100
push dword [esp]
call fcn.004040e0
push dword [0x40b034]
call fcn.00406100
push dword [0x40b034]
call fcn.004061f3
mov eax, dword [0x40b2c8]
push eax
push eax
call fcn.00406035
lea ecx, [0x40b030]
pop edx
call fcn.00403100
mov eax, dword [esp + 0x14]
call fcn.00404100
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401d55
mov edx, dword [0x40b034]
push dword [0x40b2c8]
call fcn.004077d0
lea ecx, [0x40b030]
pop edx
call fcn.00403100
mov dword [esp + 0xc], 2
jmp 0x401d67
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401d67
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404100
mov dword [0x40b028], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404100
mov dword [0x40b02c], eax
mov eax, 1
jmp 0x401d9a
push dword [esp + 4]
call fcn.00407830
add esp, 0xc
pop ebx
ret 4
Function at 0x402105
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004030f0
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402156
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_LoadResource
mov dword [0x40b078], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x40b074], eax
mov eax, dword [esp + 4]
jmp 0x40215e
push dword [esp]
call fcn.00407830
add esp, 8
ret 8
Function at 0x40283d
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402844
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.004030f0
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.004030f0
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.004030f0
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.dll_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call sub.KERNEL32.DLL_Sleep
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.DLL_GetExitCodeProcess
and eax, eax
je 0x4028eb
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x4028eb
jmp 0x4028ed
jmp 0x4028be
mov eax, 1
jmp 0x4028f6
push dword [esp]
call fcn.00407830
push dword [esp + 4]
call fcn.00407830
push dword [esp + 8]
call fcn.00407830
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x403afa
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b12
push dword [esp + 4]
push 0x403a93
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b4f
push esi
mov esi, dword [0x40b0d8]
test esi, esi
je 0x403b4e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b46
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b0d8
call fcn.00406afd
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b1f
pop edi
pop ebx
pop esi
ret 4

Function at 0x403f37
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x403fdb
mov eax, dword [ebp - 0xc]
dec eax
je 0x403fbe
dec eax
jne 0x403fdb
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403fba
dec eax
je 0x403fb6
dec eax
je 0x403f9c
dec eax
jne 0x403fdb
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x403fdb
cmp byte [ebp - 0x1e], 1
je 0x403fdb
push 0x4b
jmp 0x403fda
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403fb2
dec eax
je 0x403fae
dec eax
jne 0x403fdb
push 0x41
jmp 0x403fda
push 0x3c
jmp 0x403fda
push 0x32
jmp 0x403fda
push 0x14
jmp 0x403fda
push 5
jmp 0x403fda
cmp dword [ebp - 0x14], 0
je 0x403fd8
cmp dword [ebp - 0x14], 0xa
je 0x403fd4
cmp dword [ebp - 0x14], 0x5a
jne 0x403fdb
push 0x28
jmp 0x403fda
push 0x1e
jmp 0x403fda
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x405f9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40600a
push 0x11
call esi
test al, al
js 0x40600a
push 0x10
call esi
test al, al
js 0x40600a
push 0x12
call esi
test al, al
js 0x40600a
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40600a
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40602e
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40602e
dec eax
push eax
push dword [0x40b344]
call fcn.00406970
mov eax, dword [eax + 8]
jmp 0x406030
xor eax, eax
pop esi
leave
ret 4

Function at 0x4061f3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406266
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406248
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406246
cmp dl, 0x5c
je 0x406246
cmp dl, 0x2f
jne 0x406252
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406232
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x406268
xor eax, eax
leave
ret 4

Function at 0x406270
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4062a5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406530
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406579
cmp byte [esi], al
je 0x406579
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b354]
push eax
push ecx
call fcn.00406970
test eax, eax
je 0x4065a7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x406580
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406565
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406610
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406580
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x4065b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406609
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406608
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b354]
push eax
push ecx
call fcn.00406970
test eax, eax
je 0x406604
cmp dword [eax + 4], 0
je 0x4065f2
push esi
push edi
push eax
call fcn.00406610
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406610
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406645
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x4066be
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x4066ab
sub ecx, 1
je 0x406696
sub ecx, 2
je 0x406683
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00406270
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4066eb
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x406c40
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x406df5
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x406df4
mov eax, dword [0x40b004]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x406dec
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x406dae
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x406cd0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x406dcf
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090f0]
add eax, 1
sub edi, 1
jne 0x406db2
cmp edx, 0x1000
je 0x406ca0
mov edx, dword [0x40b004]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x406e00
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x10379b80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10379d3a
pushal
mov esi, section..data
lea edi, [esi - 0x1e8000]
push edi
or ebp, 0xffffffff
jmp 0x10379baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10379bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10379ba0
mov eax, 1
add ebx, ebx
jne 0x10379bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10379bd4
jne 0x10379bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10379bf3
dec eax
add ebx, ebx
jne 0x10379be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10379bb8
add ebx, ebx
jne 0x10379bef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10379c45
xor ecx, ecx
sub eax, 3
jb 0x10379c0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10379c7a
sar eax, 1
mov ebp, eax
jmp 0x10379c16
add ebx, ebx
jne 0x10379c16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10379be4
inc ecx
add ebx, ebx
jne 0x10379c24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10379be4
add ebx, ebx
jne 0x10379c31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10379c26
jne 0x10379c42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10379c26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10379c64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10379c56
jmp 0x10379ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10379c64
add edi, ecx
jmp 0x10379ba6
pop esi
lea edi, [esi + 0x36b000]
mov eax, dword [edi]
or eax, eax
je 0x10379ccc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x37dd80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x37de98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10379c81
mov ecx, edi
jns 0x10379cb0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x37de9c]
or eax, eax
je 0x10379cc6
mov dword [ebx], eax
add ebx, 4
jmp 0x10379c9e
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10379cfd
cmp al, 0xef
ja 0x10379cf0
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10379cd2
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10379cdf
mov ebp, dword [esi + 0x37dea0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10379d31
sub esp, 0xffffff80
jmp 0x1012cddc
Function at 0x47d0a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f124b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004e5acd
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x47d122
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004e358a
mov eax, dword [eax]
push 0x561200
push eax
call fcn.004d5234
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004e5d58
test bl, bl
je 0x47d122
push 0x561200
lea ecx, [esp + 0xc]
call fcn.004e60e8
push 0x564d98
lea ecx, [esp + 0xc]
call fcn.004e60e8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x47d15e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004e5d58
jmp 0x47d229
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x47d1e2
lea edx, [esp + 0x7c]
push 0x564d94
push edx
call fcn.004d5234
add esp, 8
test eax, eax
je 0x47d1e2
lea eax, [esp + 0x7c]
push 0x564d90
push eax
call fcn.004d5234
add esp, 8
test eax, eax
je 0x47d1e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47d172
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004e5d58
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x47da20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x47da82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc