joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4152a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push str._DRIVE_FIXED_
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.0040fbb0
push eax
call dword [0xb39afc]
test eax, eax
je 0x4152cc
lea edi, [ebx + 1]
push 0
push str._DRIVE_REMOVABLE_
lea ecx, [ebp + 0x7c]
call fcn.0040fbb0
push eax
call dword [0xb39afc]
test eax, eax
je 0x4152ef
mov edi, 1
mov ebx, edi
jmp 0x4152f7
test edi, edi
je 0x415405
lea eax, [ebp - 0x64]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [ebp - 0x64], 0
lea esi, [ebp - 0x64]
je 0x415468
push 0x3e8
lea ecx, [ebp - 0x44c]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test ebx, ebx
je 0x415354
cmp eax, 2
jne 0x415354
lea ecx, [ebp + 0x7c]
call fcn.0040fbb0
push eax
lea edx, [ebp - 0x44c]
push edx
call dword [0xb39c18]
push esi
push 0x423da4
jmp 0x415370
lea ecx, [ebp + 0x7c]
call fcn.0040fbb0
push eax
lea edx, [ebp - 0x44c]
push edx
call dword [0xb39c18]
push esi
push 0x423d94
lea eax, [ebp - 0x44c]
push eax
call fcn.00411090
add esp, 0xc
push eax
lea ecx, [ebp - 0x44c]
push ecx
call dword [0xb39c18]
mov edx, dword [ebp + 0xa0]
mov eax, dword [ebp + 0x98]
mov ecx, dword [ebp + 0x94]
push 0
push edx
push edi
push eax
push 0
push ecx
lea ecx, [ebp + 0x88]
call fcn.0040fbb0
push eax
lea edx, [ebp - 0x44c]
push edx
lea ecx, [ebp + 0x70]
call fcn.0040fbb0
push eax
push 0x4201f1
lea ecx, [ebp + 0xa4]
call fcn.0040fbb0
push eax
sub esp, 0x68
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00401080
call fcn.00414e60
add esp, 0x94
push esi
call dword [0xb39a84]
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
jne 0x415310
jmp 0x415468
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ebp + 0x98]
mov eax, dword [ebp + 0x94]
push 0
push ecx
push 0
push edx
push 0
push eax
lea ecx, [ebp + 0x88]
call fcn.0040fbb0
push eax
lea ecx, [ebp + 0x7c]
call fcn.0040fbb0
push eax
lea ecx, [ebp + 0x70]
call fcn.0040fbb0
push eax
push 0x4201f1
lea ecx, [ebp + 0xa4]
call fcn.0040fbb0
push eax
sub esp, 0x68
lea edx, [ebp + 8]
mov ecx, esp
push edx
call fcn.00401080
call fcn.00414e60
add esp, 0x94
mov eax, dword [ebp + 0xb0]
lea ecx, [ebp + 0x34]
mov dword [eax], 0
call fcn.0040f9f0
lea ecx, [ebp + 0x20]
call fcn.0040f9f0
lea ecx, [ebp + 0x14]
call fcn.0040f9f0
lea ecx, [ebp + 8]
call fcn.0040f9f0
lea ecx, [ebp + 0xa4]
call fcn.0040f9f0
lea ecx, [ebp + 0x88]
call fcn.0040f9f0
lea ecx, [ebp + 0x7c]
call fcn.0040f9f0
lea ecx, [ebp + 0x70]
call fcn.0040f9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x419a0e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x419aed
mov esi, edx
shr esi, 3
push edi
jmp 0x419a30
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x424138]
add ecx, 8
sub edx, 8
dec esi
jne 0x419a30
pop edi
test edx, edx
je 0x419b0a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x424138]
inc ecx
dec edx
jne 0x419af1
not eax
pop esi
pop ebp
ret

Function at 0x419b10
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x424138]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x424138]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x419c60
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x419c83
mov eax, 0x200
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
push ebx
push edi
mov edx, eax
xor edi, edi
and edx, 1
je 0x419c9b
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
test al, 2
je 0x419ca2
or edi, 2
test al, 4
je 0x419ca9
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x419cb3
or edi, 0x10
test al, 0x20
je 0x419cba
or edi, 0x20
test ecx, ecx
je 0x419cc6
or edi, 0x40000000
jmp 0x419ccc
or edi, 0x80000000
or edi, 0x1000000
mov dword [ebp - 8], edi
test edx, edx
jne 0x419ce2
or edi, 0x800000
mov dword [ebp - 8], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0x28
jbe 0x419d89
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 4]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [ebp - 4], dx
jne 0x419d86
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x419d86
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x419d7f
cmp eax, 0x454e
je 0x419d7f
cmp eax, 0x454c
je 0x419d7f
cmp eax, 0x4550
jne 0x419d86
or dword [ebp - 8], 0x400000
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419d92
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x419d9e
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
test esi, esi
je 0x419e18
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.0041c770
mov dword [esi + 4], edx
push 0
mov ecx, ebx
sub ecx, 0xd53e8000
mov edx, edi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi], eax
call fcn.0041c770
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x48]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [esi + 0xc], edx
call fcn.0041c770
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x419e40
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.00419c00
movzx ecx, word [ebp - 4]
movzx edx, word [ebp - 8]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a000
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x41a0eb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41a037
cmp dword [esi + 0x40], edi
jae 0x41a037
push eax
call fcn.00411610
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x41a04f
lea eax, [edi + edi]
push eax
call fcn.00410bd0
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x41a0e8
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x424138]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x424138]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x41a067
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x41a12a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x41a10f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41a14c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41a4f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x41a551
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x41a598
mov edx, dword [ebp + 0xc]
sub edi, eax
cmp edi, edx
jbe 0x41a521
mov edi, edx
mov ebx, dword [ebp + 8]
push edi
add eax, ecx
push eax
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
push edi
push ebx
push eax
call fcn.00419a00
add esp, 0x18
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x41a591
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0xc]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41a598
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
push edi
push ebx
push eax
call fcn.00419a00
add esp, 0xc
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x41b5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x41b7c5
cmp dword [esi + 0x6af90], 3
jb 0x41b627
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x41b667
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x41b667
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x41b64f
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00418f00
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x41b667
mov edi, eax
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x41b744
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.004189d0
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x41b70e
cmp eax, 3
jb 0x41b70e
mov eax, 1
sub edi, eax
lea ecx, [ecx]
add dword [esi + 0x6af84], eax
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub edi, eax
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x41b6b0
add dword [esi + 0x6af84], eax
jmp 0x41b767
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
xor edi, edi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
jmp 0x41b767
movzx edx, byte [ecx + esi + 0x1af70]
push edx
push 0
push esi
call fcn.004189d0
dec dword [esi + 0x6af90]
add esp, 0xc
inc dword [esi + 0x6af84]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x41b7a3
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x41b780
lea ecx, [eax + esi + 0x1af70]
jmp 0x41b782
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0041b420
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x41b7b8
push esi
call fcn.00419060
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x41b5d3
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x41b7d8
lea ecx, [eax + esi + 0x1af70]
jmp 0x41b7da
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.0041b420
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41ceff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x927ee0]
jne 0x41cf09
repz ret
jmp fcn.0041d81b

Function at 0x41dbeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x927ee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041d697
and dword [ebp - 0x14], 0
cmp dword [0xb3a7c0], 0
mov dword [ebp - 0x18], eax
jne 0x41dc9e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41dd46
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41dd46
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xb3a7c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xb3a7c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xb3a7c8], eax
call edi
push eax
call esi
mov dword [0xb3a7d0], eax
test eax, eax
je 0x41dc9e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xb3a7cc], eax
mov eax, dword [0xb3a7cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41dcf7
cmp dword [0xb3a7d0], ecx
je 0x41dcf7
push eax
call esi
push dword [0xb3a7d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41dcf7
test ebx, ebx
je 0x41dcf7
call edi
test eax, eax
je 0x41dcee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41dcee
test byte [ebp - 8], 1
jne 0x41dcf7
or dword [ebp + 0x10], 0x200000
jmp 0x41dd2a
mov eax, dword [0xb3a7c4]
cmp eax, dword [ebp - 0x18]
je 0x41dd2a
push eax
call esi
test eax, eax
je 0x41dd2a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41dd2a
mov eax, dword [0xb3a7c8]
cmp eax, dword [ebp - 0x18]
je 0x41dd2a
push eax
call esi
test eax, eax
je 0x41dd2a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xb3a7c0]
call esi
test eax, eax
je 0x41dd46
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41dd48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ceff
leave
ret
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x663210], al
mov byte [0xa656f4], al
mov eax, 0xd7b0
push esi
mov dword [0x663228], ecx
mov word [0xa6574c], ax
mov word [0xa6574e], ax
mov word [0x663624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x663258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b665
call esi
cmp al, 4
ja 0x44b66b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x663254], eax
pop esi
ret

Function at 0x574402
Capabilities:
Encode data using xor

Disassembly:
mov word [edi + 0x3b30b16f], ss
xor byte [edx], bl
push edx
in al, dx
sbb dl, byte [edx - 0x14]
dec ecx
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
or byte [ecx], ah
push esi
aad 0x34
dec esi
jle 0x574385
pushfd
neg edi
frstor dword [ebp + 0x44e8f6db]
hlt
push ds
pushfd
mov cl, 0xb0
js 0x57436b
lcall 0x3648, 0xd1aab7d4
out 0x12, eax
daa
sti
inc eax
jge 0x5743cb
push esp
push ss
cdq
invalid
aad 0xae
and edi, ecx
mov edx, dword [ecx + 0x54]
adc dword [edi + 0x57db1361], edx
jl 0x5743cf
adc al, 0xd4
je 0x574373
mov eax, dword [0x96f3c18b]
sbb eax, 0xe40aaad5
invalid
mov esp, 0x49ae179d
popal
or eax, 0xc9a99148
or al, 0xd5
test byte [esi + ebp*4], dh
mov ecx, 0x5b3a6b25
aaa
mov byte [eax + esi*4 + 0x7dcad614], bh
test byte [ebx + edi*4 + 0x7fb29d92], ch
mov esp, 0xcad614b0
jge 0x5743a4
lodsb al, byte [esi]
mov ebx, 0x7fb29d92
or eax, 0x9ee76e51
call 0x97ddc514
sbb al, 0xc1
push cs
xchg edx, eax
cmp esi, dword [esi + 0x30]
cdq
mov cl, 0xe7
ror byte [eax + edx*4 - 0x194c5fa0], 0x6a
sbb byte [edi + esi*2], dl
out 0x6d, al
mov edi, 0xe044d481
loop 0x57445f
inc esi
mov ch, 0x87
adc eax, 0x5625a5e7
jecxz 0x574419
push edx
ja 0x5744ae
in al, 0x26
sub bl, byte [ebx - 0x63758cc4]
dec ecx
inc ecx
cmp eax, 0xc253f2f4
out 0x9e, eax
out dx, al
fstp xword [edi - 0x57]
cmp al, 0xa8
sub dword [ecx - 0xe], eax
or edx, dword [ebp + 0x43ccd799]
wait
cmp al, 0x73
mov bl, byte [ecx + ecx*2 - 0xd0bc2bf]
push ebx
ret 0x9ee7
or edx, dword [ebp + 0x43ccd799]
inc ecx
inc ebp
movsb byte es:[edi], byte [esi]
test dword [0x637e12e8], esp
scasb al, byte es:[edi]
push ss
sbb eax, 0xd287c7f4
shr cl, cl
cmc
xchg ecx, eax
inc edx
fnstenv [ecx - 0xbcf159]
retf 0xf8c8
aas
xlatb
and ch, byte [edi - 0x6f]
mov bh, byte [edi]
stosb byte es:[edi], al
xchg esi, eax
mov bh, 0x1c
test byte [0xef6c21a7], dl
xor al, 0x73
or al, 0x7a
mov esp, dword [edi + 0x6ee9f554]
jno 0x5744b0
or ch, al
xchg ebp, eax
push esp
sub al, 0x6c
push cs
mov eax, edi
and eax, 0xa632c0db
mov byte [0x3357dd69], al
cdq
loope 0x574534
mov dl, ah
outsd dx, dword [esi]
ror esp, cl
mov dl, 0xe2
into
pop ds
stosd dword es:[edi], eax
loope 0x574475
in eax, 0xf5
adc dh, byte [ebp + 0x46]
xchg esp, eax
aaa
and byte [eax + 0x36], bh
jmp 0x57448f
cmp eax, 0xf48475c1
bound esp, qword [ecx - 0x19]
inc edi
fimul word [edx + 0x57c5f135]
stosd dword es:[edi], eax
or dword [edx - 0x7f], eax
dec edx
invalid
Function at 0x41b100
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a9b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049e3ac
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41b182
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049bcc8
mov eax, dword [eax]
push 0x4cbcc4
push eax
call fcn.0048de64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049e637
test bl, bl
je 0x41b182
push 0x4cbcc4
lea ecx, [esp + 0xc]
call fcn.0049e9c7
push 0x4cbcd0
lea ecx, [esp + 0xc]
call fcn.0049e9c7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41b1be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049e637
jmp 0x41b289
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41b242
lea edx, [esp + 0x7c]
push 0x4cbccc
push edx
call fcn.0048de64
add esp, 8
test eax, eax
je 0x41b242
lea eax, [esp + 0x7c]
push 0x4cbcc8
push eax
call fcn.0048de64
add esp, 8
test eax, eax
je 0x41b242
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b1d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049e637
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41ba90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41baf2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc