joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6104b8
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [eax]
mov edi, 1
jmp 0x6b22a1
call fcn.006858ce
nop
movsb byte es:[edi], byte [esi]
xor al, 0x1a
jns 0x6103b8
wait
sub bl, 0xae
insd dword es:[edi], dx
adc eax, 0xb8e58006
rcr dword [edi + 0x1a], 0x26
jp 0x61048f
dec eax
divps xmm0, xmmword [ecx]
mov word [ecx - 0x28], fs
mov byte [edx], ah
and dl, dh
insd dword es:[edi], dx
sbb eax, 0x9f395fbb
shr dword [edx], 0x65
jecxz 0x610420
ror edx, 1
add eax, 0xa873c9b0
salc
invalid
shl dword [eax - 0x755021c6], 1
inc ebp
arpl word [ebp + edx*2 - 0x57dc7546], di
xor dword [ecx], edi
xor dword [0x5e10c467], eax
pop esp
xchg ecx, eax
mov dl, 0xdc
sub ebx, edx
xchg esp, eax
in eax, 0x4d
add al, 0x25
nop
sub eax, 0x855c2291
movsd dword es:[edi], dword es:[esi]
movsd dword es:[edi], dword [esi]
lahf
mov eax, dword [0x2aab028b]
out 0xab, al
out 0xab, al
mov cl, 0x84
xor byte [eax - 0x2d], 0x33
mov ch, 0xac
in al, dx
out dx, eax
jnp 0x6104c0
xchg edi, eax
leave
les esp, [edx - 0x78]
out dx, al
pushal
lea ecx, [esp + edx]
aas
push ss
idiv dword [esi + 0x6fd4785c]
int3
mov byte [esp], ah
push dword [esp]
push 0xef48312f
mov dword [esp + 0x10], edi
pop edi
movzx di, cl
lea edi, [eax + 0x3b9cacdd]
pop edi
mov edi, 0x449642
pushal
mov edi, dword [edi + 0x288a0e]
call fcn.005dbf77

Function at 0x64e0f1
Capabilities:
Encode data using xor

Disassembly:
call fcn.005efc02
clc
mov byte [0x7e9d1836], al
wait
add byte [ecx], 0x23
inc edx
dec edi
sub dl, byte [edx]
invalid

Function at 0x65ea79
Capabilities:
Packed with generic packer

Disassembly:
add eax, 0x5dfdc781
jns 0x65ea88
leave
scasb al, byte es:[edi]
xchg esi, eax
call fcn.007ed431
call 0x931c82cd

Function at 0x665764
Capabilities:
Encode data using xor

Disassembly:
call fcn.005f331d
jmp 0x781452
jmp 0x788630
mov dword [esp + 0x34], eax
push 0xbd56843b
lahf
lea eax, [edi + 0xcef898f]
mov eax, 0x42fe96
lea esp, [esp + 0x38]
js 0x5fe175

Function at 0x6ab45c
Capabilities:
Packed with generic packer

Disassembly:
push edi
push esi
pushfd
xchg dword [esp + 0xc], eax
mov word [esp + 8], sp
xchg dword [esp + 8], eax
setg ah
pushal
movzx ax, dl
mov word [esp + 4], 0x6950
mov eax, 0x458401
jmp 0x67838e
lea esp, [esp + 0x28]
jle 0x6a8ada
mov eax, dword [eax + 0x17013b]
pushfd
pushal
call fcn.0077037a
mov byte [esp + 8], ah
jmp 0x6448bc
jmp 0x6290a0
call fcn.007f200f
pushfd
mov dword [esp + 8], 0x5a0dc826
mov dword [esp + 0x40], edx
mov byte [esp + 4], 0x61
mov dword [esp + 0x3c], eax
jmp fcn.00621a5d
lea esp, [esp + 0x30]
jne 0x69b7fe
xchg dword [esp], eax
call fcn.005d91a3
jmp 0x780d6c
pushal
pushfd
call fcn.005fc86a
mov edi, 0x6f68e6f2
imul ebx, dword [ebx - 0xd8c4ece], 0xffffffc3
pop eax
dec edx
sbb ecx, dword [esi + 0x752c39eb]
invalid

Function at 0x6ae789
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [eax]
pushfd
call fcn.007427a0
fcmovne st(0), st(2)
and ebx, dword [ebx - 0x6a]
js 0x6ae731
aas
stosb byte es:[edi], al
fild word [esi - 0x3c498501]
test eax, esp
fisttp qword [eax + 0x2059580d]
or byte [ebp + 0x30], bl
xor eax, 0x461ff980
mov ah, 0xda
invalid
Function at 0x6bc939
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov byte [esp], 0x23
call fcn.006e36b8

Function at 0x6e8111
Capabilities:
Execute syscall

Disassembly:
xor eax, 0x1ba8f88e
add byte [esi + 0x2aab1c4b], al
dec ebx
out dx, al
mov dword [0xbb0a6a35], eax
syscall
test al, 0x15
ret

Function at 0x6e9127
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6ca456
mov ebp, dword [ebp + 0x27bd34]
call fcn.0061eeb0
inc esp
and al, 0x20
call fcn.006c64da
mov dword [esp + 0x54], ebp
bswap bp
mov ebp, 0x45e4c9
jmp 0x656e83
mov dword [esp + 0x34], ecx
push 0xc012997f
mov ecx, 0x494c39
call fcn.007d3934
xchg byte [ebx], dl
fisub dword [ebx + ebp*8 + 0x17f69b74]
jae 0x6e914b
push ss
dec edi
push esi
and esp, dword [ecx]
cli
xchg esp, eax
sal dword [eax - 0x194b9837], 1
jg 0x6e9186
inc edi
int 0x98
int1
sub ch, byte [eax - 0x4d]
fistp word [edx + 0x79]
sbb eax, 0x5ff47729
dec esi
pop edi
ficomp word [esi + 0x55]
dec edi
pop esp
adc dword [edx + 0x59e2b10b], esp
push ebx
pop ss
pushfd
adc dword [edx], esi
je 0x6e910e
xchg edi, eax
jo 0x6e919e
mov esi, 0x63d305b8
cmpsb byte [esi], byte es:[edi]
xchg dword [edx + 0x651d1bb3], esp
and edx, 0x4d
loop 0x6e91d5
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebp
lodsb al, byte [esi]
pop es
shr ah, 0xb3
pop es
cmp al, dl
invalid
mov ah, 0x56
mov ebx, 0xce249614
outsd dx, dword fs:[esi]
xchg esi, eax
insb byte es:[edi], dx
pushfd
and eax, 0xf36a9321
lodsb al, byte [esi]
iretd
push ebp
movsd dword es:[edi], dword [esi]
arpl sp, bx
sub cl, dl
mov edx, 0x46a05e43
xor esp, dword [eax]
or dword [ecx - 0x6af50102], esi
fld dword [ecx - 0x56]
dec esi
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x6edf9c
Capabilities:
Encode data using xor

Disassembly:
dec edx
sbb ebx, dword [esi - 0xb60fe83]
invalid
cmp esp, dword [edi + edx - 0xc4717b9]
lodsd eax, dword [esi]
out dx, al
dec ebx
sahf
fcomp qword [ebx - 0x3f]
loopne 0x6edfc8
cmp eax, 0xbff6dd75
cmpsb byte cs:[esi], byte es:[edi]
invalid
shr dword [ecx], 0xa6
mov esp, 0xb25ff834
inc edx
fld st(1)
pop ss
lea ecx, [esi]
or al, 0xe2
jb 0x6ee00d
in al, dx
popal
mov ebp, 0xbcb7a15d
jecxz 0x6edf6a
aad 0xb8
js 0x6ee061
and dword [ebp + ecx*2 + 0x6d], 0x68
pop edi
pop ebx
mov ebx, 0x345d51ba
daa
push ecx
pop ebp
xor al, 0x27
jns 0x6ee045
cli
fcmovnb st(0), st(2)
xchg byte [edi + 0x4a], ah
sbb esi, dword [edx + 0x3d]
cli
movsd dword es:[edi], dword [esi]
sbb byte [edi], 0x9b
dec edi
in eax, 0xbb
or ch, ah
xchg ebp, eax
invalid
js 0x6edff1
daa
inc edx
cmp dword [edx + ebx*8], ebp
inc ebp
pop eax
invalid
stc
sbb byte [esp + eax + 0x642d428f], 0xff
mov eax, dword [0xb4ec6b26]
call edx
xchg ebp, eax
or ebx, dword [esp + eax + 0x8890ac7]
inc edi
xchg ecx, eax
inc esp
lcall 0x16f5, 0xb87f9e08
or byte [esi + 0x16f5b87f], bl
and byte [eax], 0x77
sbb bl, byte [ecx]
aas
xor ebp, 0x2d51a27
cmc
xor ebx, 0x3ed8893a
test bh, bl
xor esi, 0xe622c8
pushfd
clc
push dword [esp + 0xc]
popfd
push 0xcec8919
pushal
push dword [esp + 0x34]
ret 0x38
Function at 0x6ef4ff
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + 0x4f], dh
sub dword [ecx + ebx*2], 0x54
mov edi, 0xb128c8f2
pop edx
sub edi, dword [edx]
cmp cl, byte [edi + 0x51]
cmp cl, byte [edi + 0x51]
jb 0x6ef559
inc edx
sub eax, 0xfe397c5c
jle 0x6ef4f1
add bl, al
test eax, 0xff462bae
push 0x2f
mov dword [0xdb88494c], eax
in al, dx
add dword [ebx + ebx*8 - 0x661564c3], ecx
pop eax
jp 0x6ef502
out 0x6a, eax
jmp [edi + 0x2d]
popal
and eax, 0xc9a80590
leave
div dword [ecx + 0x18]
dec ebp
push esp
invalid

Function at 0x72b36e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.007a6144
mov dword [esp], 0xe413ad
lea ebx, [ebx + 1]
call fcn.007c95f9
mov word [esp], sp
lea edx, [edx - 0x51573d88]
jmp 0x6e9442

Function at 0x7946d6
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call 0x6c9e65
invalid
pushfd
mov dword [esp], ebp
pushal
movzx bp, bl
mov ebp, dword [esp + 0x24]
call fcn.00616939
nop
lea esp, [esp + 4]
js 0x6ab574
pushfd
push dword [esp]
mov word [esp], 0x94f3
mov dword [esp + 4], ebp
movsx bp, bl
not bp
mov ebp, dword [esp + 8]
jmp 0x6183be

Function at 0x79521e
Capabilities:
Encode data using xor

Disassembly:
adc dword [eax + 0x17], 0x77c4cdba
pop edx
xor dword [eax - 0x39], esp
or dh, byte [ecx + 0x20]
or edx, dword [ebp - 0x3e2f70fe]
lcall 0xbd47, 0x6c9954f7
invalid
xor edx, 0xf523b4e3
test sp, si
bt sp, di
xor esi, 0xc25e2f72
bt di, 3
xor dword [esp], 0x14
bt si, ax
xor eax, 0x30b0eb8d
stc
xor ebx, 0xfa181874
stc
xor ebp, 0xbabcce49
call fcn.005c991f
mov edx, 0x3f66e8f0
jb 0x713d5a
xor al, 0x9f
sbb bl, byte [edi - 0x4b]
mov al, 0xd9
mov word [ecx], gs
cmp al, 0x61
add al, 0xb5
xor byte [ecx - 0x29], cl
xor byte [ecx - 0x29], cl
mov ss, word [edi]
bound edi, qword [edx - 0x4a840155]
mov al, 0xd
sub al, 0xa2
sti
movsb byte es:[edi], byte [esi]
in al, 0xbe
sub dword [eax + 0x55], ebx
sal cl, 0x31
cld
lds ebx, [eax - 0x1b245f42]
lodsd eax, dword [esi]
sahf
add bl, byte [ebp - 0x713637fd]
adc cl, byte [ecx + 0x62f99817]
jp 0x713dcd
shr al, cl
add edi, eax
sub al, 0xac
xor al, 0x67
dec ebx
frstor dword [ecx]
retf 0xfaf3
in al, 0xad
cmpsb byte [esi], byte es:[edi]
and dword [ecx], esi
xor edx, esi
mov ebx, 0xe9f35a32
pop es
int3
fst dword [ebx + ecx*2 + 0x6344dff9]
push esp
fadd qword [ebp + 0x26]
xchg dword [ecx], ebx
mov cl, byte [esi - 0x4e]
inc esp
inc ecx
out 0x98, eax
cmp ebp, dword [edx - 0x22]
mov edi, 0x2694abe6
inc ecx
mov ebx, 0x7ccc93fe
pop ebp
push eax
mov byte [ebx + 0x61c8122c], bl
inc edx
arpl word [0x8ad15f8e], di
mov byte [ebx - 0x1f], bh
js 0x795286
push ss
div dword [esi - 0x19bab3e5]
aam 0x34
push eax
push ebp
jl 0x795268
inc ecx
fdiv dword [esi + 0x51e7cc37]
cmp al, 0xce
scasd eax, dword es:[edi]
or dl, byte [esi - 0x3f4b33df]
sub ebx, dword [ebx + 0x60]
inc ecx
insb byte es:[edi], dx
jno 0x7951fa
xor dword [ebp + 0x34], ebx
das
into
pushfd
mov word [esp], bp
pushfd
pop dword [esp]
bt sp, dx
and al, 0x66
bt esp, edx
jmp 0x713d80
Function at 0x7b7141
Capabilities:
Encode data using xor

Disassembly:
pushfd
xor ecx, 0x2fcc5e46
bt eax, edi
xor ebx, 0x9fbbd0f4
jmp 0x7b02da
call fcn.0065f210
push 0x2705e9a0
pushfd
mov dword [esp], 0xf6f61dee
push esp
mov byte [esp], 0xe4
pushal
mov word [esp + 4], bp
lea esp, [esp + 0x24]
jmp fcn.0059013e
xor ebp, 0x261168c9
cmp dh, 0x7d
xor edi, 0x17cd4fbf
jmp 0x739547
mov esp, 0xa2f7bcdf
in al, 0xf
out dx, eax
hlt
bswap ecx
jns 0x7b7122
mov ch, 0xf
push 0xc7a68233
jle 0x7b70c3
xor eax, dword [edx - 0x5581385a]
daa
push 0xf6b9e7b3
stosb byte es:[edi], al
add eax, 0x1dd0da43
mov ecx, 0x584b9f11
fcmovbe st(0), st(0)
sbb eax, 0x4b9f11b9
pop eax
sti
sahf
xor ecx, dword [eax - 0x70]
in eax, dx
jnp 0x7b7113
cdq
aad 0xca
dec esi
cli
xchg ecx, eax
and dword [edi + 0x20], edi
cmpsd dword [esi], dword es:[edi]
mov esp, 0x4d328811
stosb byte es:[edi], al
mov edi, esi
out dx, eax
mov eax, fs
add bl, ah
sbb eax, 0x3c9c3c76
xchg ebx, eax
sbb dword [eax], esp
inc esi
insd dword es:[edi], dx
push ss
xchg edi, eax
salc
jns 0x7b718d
pop ebp
faddp st(2)
aad 0xf2
and al, 0x40
dec ecx
jle 0x7b7113
scasd eax, dword es:[edi]
nop
sbb eax, 0x9e9586d0
aad 0xc7
test al, 5
mov word [ebx - 0x408837cb], fs
out dx, eax
mov esi, 0xd8353861
aad 0xbc
ja 0x7b71a7
jb 0x7b710b
pushfd
pushfd
pushfd
pop dword [esp + 4]
stc
xor edx, 0x79d27363
pushfd
jns 0x7b712b
xor dword [esp + 8], 0x801
clc
xor eax, 0xd21f6e0d
jmp 0x5c6606
mov dword [esp + 4], 0x44c646c9
and al, 0x10
jge 0x7b71b2
je 0x7b71d9
cmp dl, al
cmp al, 0
jmp 0x7851ed
and al, 0xff
je 0x7b7201
dec eax
ret 0x4c
add al, ch
lodsd eax, dword [esi]
ljmp 0xf787
Function at 0x401260
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413208
push 0x402c94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffea0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x170]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
mov esi, esp
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4012d6
mov eax, 0xfffffcdd
jmp 0x40139b
mov dword [ebp - 4], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0
mov esi, esp
push 0x104
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp esi, esp
call fcn.004029f0
test eax, eax
jne 0x401377
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004013c0
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x401363
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x130]
jmp 0x40139b
mov eax, dword [ebp - 0x128]
add eax, 1
mov dword [ebp - 0x128], eax
jmp 0x4012f1
mov dword [ebp - 4], 0xffffffff
call fcn.00401385
jmp 0x401399
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x170
cmp ebp, esp
call fcn.004029f0
mov esp, ebp
pop ebp
ret 4
Function at 0x4016b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4016f7
xor eax, eax
jmp 0x40174f
mov esi, esp
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
jne 0x40173a
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.004029f0
mov eax, 1
jmp 0x40174f
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.004029f0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.004029f0
mov esp, ebp
pop ebp
ret 0x18

Function at 0x401770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov esi, esp
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4017c1
xor eax, eax
jmp 0x401819
mov esi, esp
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x1c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x401801
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.004029f0
xor eax, eax
jmp 0x401819
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.004029f0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.004029f0
mov esp, ebp
pop ebp
ret 0x18
Function at 0x401830
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413240
push 0x402c94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffac
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x64]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
je 0x401873
cmp dword [ebp + 0xc], 0
jne 0x40187a
xor eax, eax
jmp 0x401936
cmp dword [ebp + 0x10], 0
jne 0x4018ac
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4018a2
xor eax, eax
jmp 0x401936
mov eax, 1
jmp 0x401936
mov esi, esp
lea edx, [ebp - 0x20]
push edx
push 0xf003f
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4018d6
xor eax, eax
jmp 0x401936
mov dword [ebp - 4], 0
mov esi, esp
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp esi, esp
call fcn.004029f0
test eax, eax
jne 0x401912
push 0xffffffffffffffff
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x24]
jmp 0x401936
mov dword [ebp - 4], 0xffffffff
call fcn.00401920
jmp 0x401934
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x64
cmp ebp, esp
call fcn.004029f0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402f9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004070a0
add esp, 4
or eax, 0xffffffff
jmp 0x402fca
mov ecx, dword [ebp - 4]
and ecx, 1
test ecx, ecx
je 0x402fc8
mov edx, dword [ebp + 0xc]
and edx, 2
test edx, edx
je 0x402fc8
mov dword [0x416f0c], 0xd
mov dword [0x416f10], 5
or eax, 0xffffffff
jmp 0x402fca
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4089db
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x4089fd
mov eax, 0xfffffffd
jmp 0x408a75
mov ebx, dword [0x4a61f8]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x408a43
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x4a61f8]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x408a6b
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x408a75
mov esp, ebp
pop ebp
ret 4
Function at 0x41076b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret
Function at 0x420e70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47c40b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00470ea3
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x420ef2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046edba
mov eax, dword [eax]
push 0x498230
push eax
call fcn.00461ad4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047112e
test bl, bl
je 0x420ef2
push 0x498230
lea ecx, [esp + 0xc]
call fcn.004714be
push 0x49bdac
lea ecx, [esp + 0xc]
call fcn.004714be
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x420f2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047112e
jmp 0x420ff9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x420fb2
lea edx, [esp + 0x7c]
push 0x49bda8
push edx
call fcn.00461ad4
add esp, 8
test eax, eax
je 0x420fb2
lea eax, [esp + 0x7c]
push 0x49bda4
push eax
call fcn.00461ad4
add esp, 8
test eax, eax
je 0x420fb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x420f42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047112e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4217f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x421852
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x421860
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47c48b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4a2250]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x421998
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4218c6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047112e
xor eax, eax
jmp 0x421a0f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047126b
push esi
lea ecx, [esp + 0xc]
call fcn.004714fa
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4219ed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.004217f0
test eax, eax
jne 0x4219ed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.004217f0
test eax, eax
jne 0x4219ed
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.00462b50
mov esi, eax
add esp, 8
test esi, esi
jne 0x4219cc
lea ecx, [esp + 0x14]
push 0x49bdbc
push ecx
call fcn.00462ad0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4219cc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4219cf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047121b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4218de
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047112e
xor eax, eax
jmp 0x421a0f
mov byte [esi], 0
push 0x49bdb8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047112e
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4