joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414959
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x5b1180]
add edi, 0xfffffc50
mov dword [0x5b117c], edi
mov dword [0x5b1188], 0
mov byte [0x5b118c], 0
mov dword [0x5b1180], 0x1e29
mov dword [0x5b1184], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x5b1180]
mov esi, eax
add esi, 0xffffe676
mov dword [0x5b117c], esi
mov esi, dword [0x5b1184]
add esi, 1
mov dword [0x5b1184], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x4149b0
mov eax, dword [ebp - 0x20]
add eax, 0xfffff1df
mov dword [0x5b117c], eax
mov dword [0x5b1184], 0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x414a0e
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x5b1190], 0
mov edx, dword [0x5b1188]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x5b1190], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x5b1188], edx
mov dword [0x5b117c], 0x13cc
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x5b118c], cl
mov dword [0x5b117c], 0x1ae6
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x5b118c]
mov edx, dword [0x5b1188]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x5b1180]
add edx, 0xffffe7b0
mov dword [0x5b117c], edx
mov edx, dword [0x5b1184]
add edx, 1
mov dword [0x5b1184], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x414a0e
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414bc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
xor eax, eax
mov dword [0x5b1180], 0x1952
mov dword [0x5b117c], 0x241b
mov ecx, eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x158
mov edi, edx
add edi, esi
add edi, 0x100
mov esi, dword [edi]
imul edi, eax, 0x158
add edx, edi
add edx, 0x98
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x107
mov ecx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x414bfd
xor eax, eax
mov dword [0x5b1180], 0x1e24
mov dword [0x5b117c], 0x407
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov cl, byte [eax + 0x41774a]
mov dl, byte [eax + 0x41771b]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x140], eax
jne 0x414c72
lea eax, [ebp - 0x12c]
mov dword [0x5b117c], 0xffffef45
mov dword [0x5b1180], 0x161a
mov dword [ebp - 0x144], eax
call fcn.00414eaf
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.00413ce1
mov ecx, eax
mov dword [0x5b119c], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x5b1180], 0x88a
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x158
mov edi, edx
add edi, esi
add edi, 0x100
mov esi, dword [edi]
imul edi, eax, 0x158
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x158
add edx, ebx
add edx, 0x98
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.00413f96
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x107
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x414d23
lea eax, [0x417729]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov esi, dword [0x5b117c]
add esi, 0xffffec63
mov dword [0x5b1180], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.00414959
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.00414018
mov eax, dword [ebp - 0x148]
add eax, 0x475e6
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 4], 0x117c00
mov edx, dword [0x5b117c]
add edx, 0xfffff441
mov dword [0x5b1180], edx
mov edx, dword [ebp - 0x148]
add edx, 0x122d9
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x1f50
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414f7b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x5b117c], 0x234d
call fcn.00401087
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x4150db
lea eax, [esp + 0x38]
mov dword [0x5b117c], 0x1e2a
mov dword [esp + 0x20], eax
call fcn.00414543
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x4150d3
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00414bc4
lea ecx, [0x414b6d]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x74], edx
mov edx, dword [0x5b117c]
add edx, 0xdd
mov dword [0x5b1180], edx
mov dword [esp + 0x70], 0x117c00
mov edx, dword [0x5b1168]
mov dword [esp + 0x64], edx
mov edx, dword [0x5b116c]
mov dword [esp + 0x68], edx
mov edx, dword [0x5b1170]
mov dword [esp + 0x78], edx
mov edx, dword [0x5b1174]
mov dword [esp + 0x48], edx
mov edx, dword [0x5b1178]
mov dword [esp + 0x54], edx
mov dword [0x5b117c], 0xffffe6c3
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x415074
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
cmp dword [eax], 0x4550
je 0x415088
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x415048
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x88], ecx
mov edx, dword [esp + 8]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x3c], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.00414739
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x5b117c], 0x239d
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret

Function at 0x4e6939
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004e6dd5
push 0x35cca856
lea esp, [esp + 0x48]
je 0x50e71d
pushal
pushal
pushfd
lea esp, [esp + 0x44]
jmp 0x4ea76c

Function at 0x50e708
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
jno 0xe0db64
call fcn.00e1c554
call fcn.00e129b0
pushal
lea esp, [esp + 0x20]
jne 0x4ea76c
ror dl, cl
cmc
aaa
mov eax, dword [ecx + 1]
test dl, cl
sbb dx, 0xd451
mov edx, dword [ebp + 0x14]
cmc
push eax
cmc
mov dword [esp], edi
bswap edi
mov edi, dword [ebp + 0x10]
bt sp, si
pushal
push 0xc53f1138
mov word [esp + 8], 0xaf2e
sub eax, 0x13a5b738
push dword [esp]
bt edi, esp
xor eax, dword [ecx + 0x11]
movsx cx, bl
mov ecx, dword [ebp + 8]
mov byte [esp + 4], 0xd2
mov dword [esp + 0x24], edx
pushal
mov dword [esp + 0x40], eax
mov ah, ch
lahf
pushfd
lahf
mov eax, dword [ebp + 0xc]
pushfd
jmp 0x4e8e22
lea esp, [esp + 0x30]
jo 0x51f9f2
pushal
lea esp, [esp + 0x20]
jne 0x4ea76c
jmp 0x4e99d0
call fcn.00e1af68

Function at 0x5435cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
call fcn.00545649
pushfd
stc
cmc
push dword [esp]
cmp byte [ecx], al
jmp 0x511f0a
cmc
shr eax, 8
stc
clc
cmp ch, dh
add esp, 0x28
jne 0x5344c7
cmp byte [ecx], al
push esp
mov byte [esp], 0xc6
lea esp, [esp + 4]
je 0x50e71d
pushfd
push eax
push 0xd5f665b9
lea esp, [esp + 0xc]
jmp 0x4ea76c

Function at 0x545649
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt edi, ebx
bt sp, di
sub eax, 0x13a5b738
mov byte [esp], bl
mov byte [esp], ch
xor eax, dword [ecx + 0x11]
pushfd
lea ecx, [esi*8 + 0x2c6a1cb9]
mov ecx, dword [ebp + 8]
jmp 0xe264c5
lea esp, [esp + 0x24]
call fcn.00e1c554
call fcn.0050f620
pushfd
pushal
jmp 0x530f7a
adc dl, al
xchg edx, eax
sal ax, cl
rcl dl, 7
mov eax, dword [ecx + 1]
pushfd
bts dx, 0xe
cmc
mov word [esp], si
mov edx, dword [ebp + 0x14]
cmp bh, al
cmc
stc
cmp bx, 0x79a
xchg dword [esp], edi
rol edi, cl
neg edi
push 0x2aadcef9
mov edi, dword [ebp + 0x10]
jmp 0x4e8060
inc ecx
clc
stc
cmc
pushfd
cmp byte [ecx], al
push 0xfaf14f1e
call fcn.0050e708
lea esp, [esp + 0x10]
je 0x50e71d
push esi
mov byte [esp], cl
push ebx
mov byte [esp + 4], dh
lea esp, [esp + 8]
jmp 0x4ea76c
pushal
pushal
mov word [esp], 0xbe18
mov dword [esp + 0x3c], eax
call fcn.005245a4
push dword [esp]
mov dword [esp + 8], edx
lea esp, [esp + 8]
jo 0x545c38
push eax
movzx ax, dl
movsx ax, dl
mov eax, dword [ebp + 0xc]
push 0xd6883dff
pushal
jmp 0x4ea0c9
Function at 0x546b82
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x24
call fcn.0053b006
lea edx, [edx + 0x4d544a3f]
jmp 0xe0034b
call fcn.0052b969
mov fs, word [eax - 0x4401de5f]
fcmovne st(0), st(1)
push ds
push eax
inc ecx
fsub qword [esi + 0x1962f468]
inc ecx
cmp esp, dword [esi + eax*8 + 0x40]
div byte [ecx - 0x24]
mov bl, 0xff
push ss
jns 0x531c90
mov edi, 0x3c0c4f13
adc dword [esi + eax*2 - 0x760e8af9], ecx
push edx
or al, 0x5d
or dword [edx + 4], esp
jns fcn.00531cb2
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
xchg edi, eax
add eax, dword [edx + ecx + 0x76]
or byte [edx + ecx - 0x72], bh
enter 0xffffffffffff9680, 0xffffffffffffffcd
popfd
ficom dword [ecx + 0x43]
xchg ebp, eax
jecxz 0x531d3f
mov ch, 0x28
or byte [ebx - 0x67b08d30], bl
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x12d4c301]
inc esp
cmp ecx, dword [edi + 0x32]
clc
inc ebx
push dword [esi - 0x5c]
sbb ch, byte [eax + 0x13]
call [esi + 0x34]
push ebx
pop es
popfd
ror dword [esi + esi*4 + 0x199f8dbd], 1
sbb eax, 0xffb29538
mov ebp, 0x1d199f8d
cmp byte [ebp - 0x41e9004e], dl
cwde
mov dh, 0xbd
movsd dword es:[edi], dword [esi]
lea ebx, [edi - 0x6ac7e2e7]
mov dl, 0xff
push ss
mov esi, 0xa5bdb698
ror byte [eax + edx], 0x8c
inc esi
mov ecx, 0xac66cc62
jb 0x531dc3
invalid
xchg ebx, eax
jae 0x531d51
mov edx, 0xfb74a264
push edi
add al, 0x1a
cmp eax, 0xdbbbff41
mov ebx, 0xb492f660
test eax, 0xc287afc4
push 0xeb21355e
and ebx, ebp
dec ebx
add al, 0x55
mov dl, 0xff
push ss
enter 0xffffffffffffc04e, 0xffffffffffffff8f
inc ebx
adc byte [esi + eax*2 + 0xcd73b1f], cl
push edx
aam 0x9a
mov esp, 0x6ff775a9
insd dword es:[edi], dx
int1
adc eax, dword [ebx]
inc eax
push cs
jbe 0x531d98
call 0x39962133
cmc
mov dword [0xb6f768db], eax
sub bh, bl
adc dword [ecx], ebx
cmp al, 0x67
mov edx, 0x9399875b
jmp 0x531d50
xchg dword [ecx + 0x3f88eb93], ebx
call 0xf47852f4
dec eax
xor ebp, esi
inc esi
not ecx
jl 0x531d8c
and al, 6
dec edi
out dx, eax
xor edi, dword [ebx]
into
js 0x531dfa
out 0x42, eax
js 0x531d6e
push edx
push edx
invalid
dec ebp
jge 0x531e15
invalid
stc
test esp, esi
insb byte es:[edi], dx
insb byte es:[edi], dx
ficomp dword [edx + edx*2 - 0x28]
popal
rcr dword [ecx - 0x30], 8
test al, 0x82
in al, dx
dec ebp
sub bl, dh
imul edi, dword [ecx + 0x28e2073f], 0xfffffff6
jmp [bx + di - 0x23]
pushfd
mov dword [esp + 8], edi
pushal
jmp 0xe00ebe
xchg dword [esp + 0x54], edx
mov word [esp], ax
push dword [esp + 0x54]
ret 0x58
mov byte [esp], bh
jmp 0xdf92c1
jmp 0xe11b9b
mov dword [esp + 0x24], eax
jmp 0x531cde

Function at 0x552c4f
Capabilities:
Encode data using xor

Disassembly:
cmp byte [eax + 0x4f], ah
add byte [edi - 0x63bbdbbc], cl
push ecx
push dword [esp + 0x4c]
ret 0x50
mov dword [esp + 0x30], eax
push 0xd8c6d187
pushfd
call fcn.00df7948
xor ecx, dword [ebx]
dec esi
xor cl, dh
mov ebp, 0x110ddadb
push edi
daa
dec esp
sbb dh, byte [edx - 0x14]
jae fcn.00552c4f
das
or al, 0x28
and esp, dword [edx]
xor dword [esi], esi
or eax, 0xdf5fc86e
outsb dx, byte [esi]
fmul qword [edi + 0x557ae5e9]
mov byte [0x95132945], al
sal dword [ebx + 0x6b55d993], 0xfb
xchg ecx, eax
fld qword [edi + 0x7bfd5977]
jmp 0x552c19
Function at 0x56068a
Capabilities:
Encode data using xor

Disassembly:
cwde
lahf
mov edi, dword [esp + 8]
xchg ah, bl
cwde
pop eax
mov eax, esi
seto bh
bswap bx
pop ebx
jmp 0xe1cb71
mov dword [edi + 8], eax
seto al
pushfd
not bh
mov dword [esi + 0x1c], edi
jmp 0x50c381

Function at 0xe27587
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x10]
jbe 0x54fada
shl dh, cl
rcl dl, cl
rcr dl, cl
sal eax, 1
mov eax, dword [ebx + 0x20]
stc
test edi, edi
mov byte [esp + 4], bl
jmp 0x54cb37

Function at 0xe3aea3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x4c], 0xe32252
push ebx
call 0xe510a2
Function at 0x406a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x406ad6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
add byte [edx], ch
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x406a7a
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x406a7f
jmp 0x4063d2
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x406ac6
lea eax, [ebp - 0x714]
push eax
call fcn.00404a40
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004049f5
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x406ad1
jmp 0x406ad6
jmp 0x4063d2

Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x4081a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408266
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408288
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082a0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0xde2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00de21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xde207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde206a
add dl, dl
jne 0xde2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde20dc
xor eax, eax
add dl, dl
jne 0xde2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde217d
add dl, dl
jne 0xde20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xde20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xde2075
mov eax, 1
add dl, dl
jne 0xde20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde20e1
sub eax, ebx
mov ebx, 1
jne 0xde2128
mov ecx, 1
add dl, dl
jne 0xde210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xde2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xde213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xde214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde2136
cmp eax, 0x7d00
jae 0xde216d
cmp eax, 0x500
jb 0xde2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde2075
cmp eax, 0x7f
ja 0xde2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xde219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xde2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x413f80
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48c3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048083d
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414002
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047e620
mov eax, dword [eax]
push 0x55dd04
push eax
call fcn.004706b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00480ac8
test bl, bl
je 0x414002
push 0x55dd04
lea ecx, [esp + 0xc]
call fcn.00480e58
push 0x55dd10
lea ecx, [esp + 0xc]
call fcn.00480e58
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41403e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00480ac8
jmp 0x414109
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4140c2
lea edx, [esp + 0x7c]
push 0x55dd0c
push edx
call fcn.004706b4
add esp, 8
test eax, eax
je 0x4140c2
lea eax, [esp + 0x7c]
push 0x55dd08
push eax
call fcn.004706b4
add esp, 8
test eax, eax
je 0x4140c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414052
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00480ac8
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414910
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x414972
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x414980
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48c44b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x567954]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x414ab8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4149e6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00480ac8
xor eax, eax
jmp 0x414b2f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00480c05
push esi
lea ecx, [esp + 0xc]
call fcn.00480e94
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x414b0d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00414910
test eax, eax
jne 0x414b0d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00414910
test eax, eax
jne 0x414b0d
lea eax, [esp + 0x14]
push 0x55dd20
push eax
call fcn.00471730
mov esi, eax
add esp, 8
test esi, esi
jne 0x414aec
lea ecx, [esp + 0x14]
push 0x55dd1c
push ecx
call fcn.004716b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x414aec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x414aef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00480bb5
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4149fe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00480ac8
xor eax, eax
jmp 0x414b2f
mov byte [esi], 0
push 0x55dd18
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00480ac8
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4