joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e330
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1001e3fc
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x1001e351
cmp al, 0x6b
jne 0x1001e3fc
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x1001e3bd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x1001e371
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x1001e371
cmp al, 0xbb
jne 0x1001e39a
inc ecx
cmp ecx, esi
jl 0x1001e361
sub esi, ecx
test ecx, ecx
jne 0x1001e3c0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1000f270
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1000f270
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x1001e3e9
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.1000f270
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.1005fed0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.1000f270
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100271e0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100272c3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x1002725e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x10086c60]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x10086c60]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x10086c60]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x10086c60]
mov byte [ecx], dl
jmp 0x100272b0
shl edx, 0x10
cmp edi, 2
jne 0x1002726f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x10086c60]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x10086c60]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x1002729d
lea edx, [edi + 0x3c]
jmp 0x100272aa
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x10086c60]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x10027200
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x10041700
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x10041719
mov esi, edi
mov edi, eax
jmp 0x1004171b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1004172b
mov eax, ebx
jmp 0x10041735
push eax
push ebx
call fcn.10012990
add esp, 8
test eax, eax
jne 0x1004173d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x10041759
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x10041744
cmp eax, dword [esi + 4]
jge 0x10041770
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x10041760
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x10041791
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1004178e
dec eax
test eax, eax
jg 0x10041780
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10045da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.10060ff0
mov eax, dword [0x100b0bc0]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.10028490
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x10045e03
xor eax, eax
jmp 0x10045f8d
lea ecx, [esp + 0x2c]
push ecx
call fcn.100577e0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x10045e28
mov dword [esp + 0x148], edi
jmp 0x10045e52
cmp dword [esp + 0x148], 0xffffffff
jne 0x10045e52
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x10045e40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10045e40
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x10045f7b
jmp 0x10045e68
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x10045e6e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.10057520
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.10057720
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.10057720
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.10057730
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.1005fed0
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x10045f66
dec eax
mov dword [esp + 0x10], eax
jmp 0x10045f10
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.100578f0
add esp, 0x1c
test esi, esi
jle 0x10045f5f
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x10045f50
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x10045f10
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10045e60
lea eax, [esp + 0x2c]
push eax
call fcn.10057880
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005f49d
add esp, 0x130
ret
Function at 0x10057520
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.10060ff0
mov eax, dword [0x100b0bc0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x1005756f
mov eax, 1
mov dword [esi], ebp
jmp 0x10057571
mov ebp, dword [esi]
test ecx, ecx
je 0x10057654
push ebp
call fcn.1002cf00
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x100575a0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.10010830
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x100575f7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.10031820
add esp, 0xc
test eax, eax
je 0x100576f6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.100319d0
add esp, 0xc
test eax, eax
je 0x100576f6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.100319e0
add esp, 0xc
test eax, eax
je 0x100576f6
jmp 0x10057631
cmp edi, 0x80
jbe 0x10057613
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.10010830
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.1005fed0
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x1005765c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.1005fb70
add esp, 0xc
jmp 0x1005765c
test eax, eax
je 0x100576e2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x10057660
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.10031820
add esp, 0xc
test eax, eax
je 0x100576f6
push ebp
call fcn.1002cf00
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100319d0
add esp, 0x10
test eax, eax
je 0x100576f6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100576a4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.10031820
add esp, 0xc
test eax, eax
je 0x100576f6
push ebp
call fcn.1002cf00
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100319d0
add esp, 0x10
test eax, eax
je 0x100576f6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.10031b40
add esp, 8
test eax, eax
jne 0x100576fa
xor eax, eax
jmp 0x100576ff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005f49d
add esp, 0x8c
ret
Function at 0x1005a3a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.10060ff0
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.10028490
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x1005a5e1
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x1005a467
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.10012750
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.1000e0b0
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x1005a419
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x1005a49b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x1005a4d9
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.10010180
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x1005a4c7
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.1000f270
add esp, 0x14
jmp 0x1005a5c4
cmp esi, 0xfffffffe
jne 0x1005a471
jmp 0x1005a3dd
jge 0x1005a3dd
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.1000f270
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x1005a425
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.1000f270
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.10014e30
add esp, 8
test eax, eax
jle 0x1005a5c0
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.100317d0
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.10031820
push 8
lea eax, [esp + 0x34]
push 0x100a04e8
push eax
call fcn.100319d0
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.100319d0
add esp, 0x28
test esi, esi
je 0x1005a534
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.100319d0
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.10031b10
lea ecx, [esp + 0x2c]
push ecx
call fcn.10031a60
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.1001d9c0
add esp, 0x24
test eax, eax
jne 0x1005a5c0
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x1005a596
xor ecx, ecx
test esi, esi
jle 0x1005a596
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x1005a587
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1005a5af
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x1005a4bb
push ebp
call fcn.10010320
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x10072dab
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b0bc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1006d67f
mov dword [ebp - 0x14], eax
cmp dword [0x100b54fc], edi
jne 0x10072e9c
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10072e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10072f7c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10072f7c
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10072f7c
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x100b54fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x100b5500], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100a405c
push esi
mov dword [0x100b5504], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100b550c], eax
test eax, eax
je 0x10072e99
push 0x100a4078
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100b5508], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10072ec1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10072eb4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10072ed6
push 4
pop eax
jmp 0x10072f7e
cmp dword [ebp - 0x14], edi
je 0x10072ed6
push dword [0x100b54fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10072ebb
mov eax, dword [0x100b5508]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10072f34
cmp dword [0x100b550c], esi
je 0x10072f34
push eax
call ebx
push dword [0x100b550c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10072f34
test eax, eax
je 0x10072f34
call ecx
test eax, eax
je 0x10072f29
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10072f29
test byte [ebp - 8], 1
jne 0x10072f34
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10072f64
mov eax, dword [0x100b5500]
cmp eax, esi
je 0x10072f61
push eax
call ebx
test eax, eax
je 0x10072f61
call eax
mov edi, eax
test edi, edi
je 0x10072f61
mov eax, dword [0x100b5504]
cmp eax, esi
je 0x10072f61
push eax
call ebx
test eax, eax
je 0x10072f61
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x100b54fc]
call ebx
test eax, eax
je 0x10072f7c
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10072f7e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f49d
leave
ret
Function at 0x7aa434
Capabilities:
Encode data using xor

Disassembly:
or ch, byte [ebx - 6]
sar dword [esi + 0x69], 0x86
mov byte [0xbf92ce84], al
xchg byte [edi], dh
jg 0x7aa472
add byte [ebx], 0x8f
scasb al, byte es:[edi]
xor ebx, dword [edi]
mov edx, 0xbfe87728
sub ecx, dword [edx - 0x17]
inc eax
pop esi
add byte [eax], al
add bl, ch
jmp 0x7aa43e
add al, ah
invalid
jmp 0x7aa43e
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
pushal
call 0x7aa444
pop ebp
sub ebp, 0x10
sub ebp, 0x3aa434
jmp 0x7aa45a
mov eax, 0x3aa434
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b1
mov edx, 0x98438781
xor byte [eax], dl
inc eax
dec ecx
adc byte [eax + 0x49], al
jne 0x7aa471
jmp 0x7aa484
or cl, byte [edx + ecx + 8]
mov ebp, 0x818181
inc eax
jns 0x7aa411
add dword [ecx - 0x7ac6b37e], 0x3b818181
test eax, 0x76818181
arpl word [edx - 0x72fff5b7], ax
add dword [ecx - 0x2ebb7d7f], 0xf049e9d1
pop dword [ecx - 0x524c1717]
add dword [eax + 0x7be9a5ad], 0x69dfc168
test byte [ecx - 0x56977e7f], al
add dword [ecx + 0x6d0ad481], 0x8189040a
add dword [ecx - 0x7e72ebf6], 0xc0a8181
xchg ecx, eax
add dword [ecx - 0x7c97bf7f], 0x430283b0
test eax, ecx
mov es, word [esi*2 - 0x23818182]
inc ebx
lea eax, [ecx - 0x7a5af2f6]
add dword [ecx - 0xfb6167f], 0xe8e9818f
mov bl, 0xad
add dword [eax + 0x69d0a5ad], 0x81818184
push 0x818183b2
aam 0xa
insd dword es:[edi], dx
add dword [ecx - 0x7e7c4d98], 0x6d0ad481
jle 0x7aa508
lea edi, [esi - 0xc]
mov dword [ecx - 0x19], ebp
add dword [ecx - 0x76c3f57f], 0xb2818181
dec eax
mov dl, 0x53
add ch, byte [ecx - 0x7c]
leave
mov es, word [0x818181cf]
mov cs, word [ecx]
leave
add dword [ecx - 0x62f5187f], 0x697a01b8
mov es, word [0x8181819b]
add dword [edx + 0x68], edi
mov es, word [0x81818190]
out 0, eax
jp 0x7aa5cf
movsb byte es:[edi], byte [esi]
mov es, word [0x81818194]
shr byte [eax + 0x4d], 0x7e
jle 0x7aa5dc
test al, 0xcd
mov eax, 0x84400280
add ch, byte [ecx - 0x7b]
push 0x7e7e7e3c
test al, 0xd5
mov eax, 0x87400283
add ch, byte [ebx - 0x7b]
add ch, byte [ecx - 0x7c]
push 0x7e7e7e2a
fadd qword [ebx - 0x73]
adc esp, 0xd6d76d0a
aam 0xa
hlt
adc dword [ebx - 0x72], 4
test byte [ecx - 0x68f47e7f], al
invalid
mov es, word [edx]
stosd dword es:[edi], eax
add byte [ecx - 0x71ac7c7f], 4
test byte [ecx - 0x68f47e7f], al
invalid
Function at 0x40a5c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x466acb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045b4e6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a642
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004593fd
mov eax, dword [eax]
push 0x5a81c0
push eax
call fcn.0044c264
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045b771
test bl, bl
je 0x40a642
push 0x5a81c0
lea ecx, [esp + 0xc]
call fcn.0045bb01
push 0x5abd34
lea ecx, [esp + 0xc]
call fcn.0045bb01
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a67e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045b771
jmp 0x40a749
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a702
lea edx, [esp + 0x7c]
push 0x5abd30
push edx
call fcn.0044c264
add esp, 8
test eax, eax
je 0x40a702
lea eax, [esp + 0x7c]
push 0x5abd2c
push eax
call fcn.0044c264
add esp, 8
test eax, eax
je 0x40a702
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a692
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045b771
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40af40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40afa2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40afb0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x466b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5b21e0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40b0e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b016
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045b771
xor eax, eax
jmp 0x40b15f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045b8ae
push esi
lea ecx, [esp + 0xc]
call fcn.0045bb3d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40b13d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040af40
test eax, eax
jne 0x40b13d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040af40
test eax, eax
jne 0x40b13d
lea eax, [esp + 0x14]
push 0x5abd48
push eax
call fcn.0044d2a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b11c
lea ecx, [esp + 0x14]
push 0x5abd44
push ecx
call fcn.0044d220
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b11c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40b11f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045b85e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b02e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045b771
xor eax, eax
jmp 0x40b15f
mov byte [esi], 0
push 0x5abd40
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045b771
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4