joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100588b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100588e0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100588e0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100589b5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10058909
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10058915
movsx eax, bl
jmp 0x1005894c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100589b5
cmp eax, 1
jle 0x10058976
cmp eax, 3
jne 0x100589b5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10058994
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100589b5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100589b5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066c19
mov esp, ebp
pop ebp
ret 4
Function at 0x10061960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10061a1c
cmp byte [esi + 0x3d], 0
je 0x10061a1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10061a0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100619d1
sub eax, 1
je 0x100619d5
sub eax, 2
jne 0x10061a0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100619f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10061a0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10066c19
mov esp, ebp
pop ebp
ret
Function at 0x100669b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073f7d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1009500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10066850
cmp byte [ebp - 0x84], 0
jne 0x10066b01
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10066a45
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x10096418
call fcn.10066850
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10066850
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10066ab4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10066900
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10066b43
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10066b39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10066b39
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10067540
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066c19
mov esp, ebp
pop ebp
ret
Function at 0x10d1bb63
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 3]
push dword [esp + 3]
jbe 0x10d1bbd0
ja 0x10d1bb94
in al, dx
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
test eax, 0xdbf8990e
mov word [esp + 1], bx

Function at 0x10d1bb9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.WINMM.dll_midiStreamRestart
sub esp, 0x13
pop di
mov ch, cl
jmp 0x10d1bbfe
lea esp, [esp + 1]
xchg dword [esp + 0x10], edx
bt edi, edi
xchg esi, ebx
mov bx, word [esp]
lea edx, [edx + 0x2e]
jmp 0x10d1bbe8

Function at 0x10d1d64a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xad56a379
lodsd eax, dword [esi]
mov edx, esi
mov eax, dword [edx]
jmp 0x10d1d582
lea edx, [edx + ebx]
mov dword [edx], eax
bt edx, esp
jne 0x10d1d56c
je 0x10d1d58e
salc
je 0x10d1d546
lea edi, [ebx + edi*8 - 0x1f]
and byte [ebx - 0x66], ah
cmc
mov dx, bx
setbe dl
jmp 0x10d1d542
xchg bx, ax
rdtsc
jmp 0x10d1d602
mov edx, ebx
lea edx, [ebx + ebx]
mov edx, dword [esp]
mov edx, edi
jmp 0x10d1d54d
xchg bx, ax
rdtsc
jmp 0x10d1d602
bsf ax, cx
jbe 0x10d1d564
mov dx, bx
setbe dl
mov edx, 0xad56a379
jmp 0x10d1d547
add esi, 4
not al
lea eax, [esp + 0x8e]
not edx
jmp fcn.10d1be13
and ebx, 0x3c
jmp 0x10d1d5a5
pop word [esp]
lea esp, [esp + 2]
push edx
push ax
call 0x10d1d665
jge 0x10d1d6a8
fbld tbyte [esi]
push ecx
ror byte [ecx - 0x2d14dbf4], 1
mov dword [esp], eax
jmp 0x10d1d66e
lea esp, [esp + 2]
mov dword [esp], ebx
pushfd
push dword [esp + 2]
jbe 0x10d1d6d3
ja 0x10d1d6a9
push cs
mov ebx, dword [ebx]
jle 0x10d1d610
xor eax, 0xc5a22ca4
xor al, 0xf6
mov ecx, 0xf820310f
js 0x10d1d642
jns 0x10d1d642
mov dword [esp + 8], ebp
jmp 0x10d1d6e0
das
mov dword [esp + 4], esp
pushfd
push dword [esp + 2]
jmp 0x10d1d693
mov dword [esp + 4], esp
pushfd
push dword [esp + 2]
mov dword [esp + 8], ebp
call fcn.10d1d6b4
mov byte [esp + 4], dh
jmp 0x10d1d780
pushfd
call 0x10d1d72c
cmpsd dword [esi], dword es:[edi]
mov si, word [esp]
bswap ecx
xchg dword [esp], eax
xchg dl, bh
dec bx
sub esp, 0xf
jmp 0x10d1d7bb
mov dword [esp + 1], ebp
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x10d1d752
btr ebx, esi
pop esi
lea esp, [esp + 3]
push dword [esp + 8]
ret 0xc
Function at 0x10d1d665
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xad56a379
lodsd eax, dword [esi]
mov edx, esi
mov eax, dword [edx]
jmp 0x10d1d582
lea edx, [edx + ebx]
mov dword [edx], eax
bt edx, esp
jne 0x10d1d56c
je 0x10d1d58e
salc
je 0x10d1d546
lea edi, [ebx + edi*8 - 0x1f]
and byte [ebx - 0x66], ah
cmc
mov dx, bx
setbe dl
jmp 0x10d1d542
xchg bx, ax
rdtsc
jmp 0x10d1d602
mov edx, ebx
lea edx, [ebx + ebx]
mov edx, dword [esp]
mov edx, edi
jmp 0x10d1d54d
xchg bx, ax
rdtsc
jmp 0x10d1d602
bsf ax, cx
jbe 0x10d1d564
mov dx, bx
setbe dl
mov edx, 0xad56a379
jmp 0x10d1d547
add esi, 4
not al
lea eax, [esp + 0x8e]
not edx
jmp fcn.10d1be13
and ebx, 0x3c
jmp 0x10d1d5a5
pop word [esp]
lea esp, [esp + 2]
push edx
push ax
call 0x10d1d665
jge 0x10d1d6a8
fbld tbyte [esi]
push ecx
ror byte [ecx - 0x2d14dbf4], 1
mov dword [esp], eax
jmp 0x10d1d66e
lea esp, [esp + 2]
mov dword [esp], ebx
pushfd
push dword [esp + 2]
jbe 0x10d1d6d3
ja 0x10d1d6a9
push cs
mov ebx, dword [ebx]
jle 0x10d1d610
xor eax, 0xc5a22ca4
xor al, 0xf6
mov ecx, 0xf820310f
js 0x10d1d642
jns 0x10d1d642
mov dword [esp + 8], ebp
jmp 0x10d1d6e0
das
mov dword [esp + 4], esp
pushfd
push dword [esp + 2]
jmp 0x10d1d693
mov dword [esp + 4], esp
pushfd
push dword [esp + 2]
mov dword [esp + 8], ebp
call fcn.10d1d6b4
mov byte [esp + 4], dh
jmp 0x10d1d780
pushfd
call 0x10d1d72c
cmpsd dword [esi], dword es:[edi]
mov si, word [esp]
bswap ecx
xchg dword [esp], eax
xchg dl, bh
dec bx
sub esp, 0xf
jmp 0x10d1d7bb
mov dword [esp + 1], ebp
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x10d1d752
btr ebx, esi
pop esi
lea esp, [esp + 3]
push dword [esp + 8]
ret 0xc

Function at 0x10d1f068
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x555af056
mov byte [esp + 1], al
pop word [esp]
lea esp, [esp + 2]
push edx
call 0x10d1f068
loop 0x10d1f052
add dword [eax], reloc.WINMM.dll_midiStreamRestart
adc byte [ebp + 0x1b5fe821], dl
add byte [eax], al
Function at 0x10d1f246
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd0a45c
jmp 0x10d1f159
jmp 0x10d1f16c
lea edi, [esp + 4]
mov bx, ax
sub esp, 0xc
jae 0x10d1f17d
mov bp, 0x266a
jmp 0x10d1f1d3
mov si, 0xb952
sub esp, 3
ja 0x10d1f134
lea esp, [esp + 3]
jmp 0x10d1f170
lea esp, [esp + 3]
mov esi, dword [esp + 0x2c]
call 0x10d1f136
jns 0x10d1f141
js 0x10d1f141
jmp 0x10d1f1cf
lea esp, [esp + 0x18]
pushfd
jmp 0x10d1ef4d
jmp 0x10d1f215
mov ch, al
xchg ecx, edx
lea edx, reloc.WINMM.dll_midiStreamRestart
mov ecx, esi
bsr edx, ebx
jl 0x10d1f19d
rdtsc
jmp 0x10d1f1f3
mov bp, 0x266a
sub esp, 0xb0
mov ebp, esp
jmp 0x10d1f1b3
mov dx, word [esp]
jmp 0x10d1f225
lea ebx, reloc.WINMM.dll_midiStreamRestart
xchg bx, ax
mov eax, esp
jmp 0x10d1f1dd
xchg dh, bh
jmp 0x10d1f2ab
rdtsc
lea ebx, reloc.WINMM.dll_midiStreamRestart
xchg bx, ax
mov eax, esp
mov dx, word [esp]
mov ebx, 0x4a9050f0
bsr bx, sp
jns 0x10d1f1ff
xchg dh, bh
jmp 0x10d1f2ab
pop word [esp]
mov byte [esp], dl
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
jmp 0x10d1f193
call 0x10d1f25e
pushal
btr bx, bx
bsr ax, dx
mov eax, 0x4eaf6757
jmp 0x10d1f2ed
not esi
bsr bx, dx
je 0x10d1f274
jne 0x10d1f274
bsr ax, dx
mov eax, 0x4eaf6757
jmp 0x10d1f2ed
call fcn.10d1f33e
cmp dword [eax + reloc.WINMM.dll_midiStreamRestart], edi
adc dword [ebp + reloc.WINMM.dll_midiStreamRestart], edx
add dword [esi], reloc.WINMM.dll_midiStreamRestart
aaa
push ds
lea esp, [esp + 0x20]
not esi
lea ebx, [eax*4]
rcr ah, cl
jo 0x10d1f2d4
add bx, 0x3a92
not bx
xchg edx, ebx
jmp 0x10d1f4f3
xchg edx, ebx
mov ah, dl
neg dx
jg 0x10d1f44f
jle 0x10d1f44f
retf
bswap edx
add dl, bh
mov dx, 0xe6c1
jmp 0x10d1f41c
inc al
jmp 0x10d1f432
jmp 0x10d1f4ac
mov dx, word [esp]
call fcn.10d1f48e
sbb ecx, dword [ebp - 0x57a470]
inc dword [ebx]
aaa
add esi, dword [edi]
lea ebx, [ecx*4]
mov eax, dword [esp]
inc ax
jmp 0x10d1f55b
rol esi, 0
cmc
jae 0x10d1f44b
inc al
bswap edx
add dl, bh
mov dx, 0xe6c1
xchg edx, ebx
jmp 0x10d1f41e
not esi
mov eax, dword [esp]
inc bx
jae 0x10d1f451
mov dx, word [esp]
jmp 0x10d1f50e
lea eax, [edx + ebx]
jmp 0x10d1f47a
jmp fcn.10d1f537
lea edx, reloc.WINMM.dll_midiStreamRestart
jmp 0x10d1f461
adc ch, dl
adc eax, 0x97641d8d
push eax
test dword [esi], ebx
mov ebx, gs
xchg esi, eax
out dx, eax
je 0x10d1f4f8
jne fcn.10d1f537
in al, dx
je 0x10d1f54c
lea edi, [ecx + ecx*8 - 6]
popal
int1

Function at 0x10e5f3a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
mov byte [esp + 0xd], dh
xchg dl, cl
bsf dx, dx
clc
jmp 0x10e5f3d3
mov dword [esp + 4], ebp
mov bp, 0x5890
xchg word [esp + 5], ax
lea eax, reloc.WINMM.dll_midiStreamRestart
jmp 0x10e5f392
pop word [esp + 8]
mov ebp, dword [esp + 8]
xchg dword [esp + 6], ebp
Function at 0x10e5fcbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edx
mov dword [esp + 7], eax
mov dword [esp + 0xd], edx
pop eax
xchg dh, bl
mov byte [esp], dh
jmp 0x10e5fb84
sub esp, 0x17
clc
popal
xchg ch, al
shl ebp, cl
rdtsc
jmp 0x10e5fb0f
xchg bx, di
bswap ebx
cpuid
bswap esi
std
xchg di, cx
jmp 0x10e5fb58
xchg ecx, esi
cmc
mov bh, byte [esp + 1]
dec dh
mov byte [esp], al
pop cx
jmp 0x10e5fb32
clc
mov eax, 0x37e9bd6d
lea esp, [esp]
xchg byte [esp], ch
lea esp, [esp]
cpuid
jmp 0x10e5fbb3
xor bx, cx
bsf bp, bx
neg eax
mov dl, 0xe3
xchg edi, esi
inc dx
jmp 0x10e5fb9d
lea esp, [esp + 0xb]
rdtsc
mov ebp, 0x8efd3526
rdtsc
mov si, ax
lea eax, [eax*4]
jmp 0x10e5fb48
ror edi, cl
cpuid
mov bh, al
cld
lea edx, [esp + ecx]
xchg byte [esp], bh
jmp 0x10e5fbeb
xchg cx, dx
mov edi, 0xfa821e4a
lea esp, [esp]
std
lea ecx, [esi + 0x95]
not ch
jmp 0x10e5fb6b
bswap ebp
push esp
mov ah, 0xc4
std
bsr si, cx
mov esi, dword [esp + 7]
jmp 0x10e5fc38
lea esp, [esp]
pushfd
mov ebx, dword [esp + 3]
lea edi, [ebx + esi]
inc ebp
neg ah
jmp 0x10e5fbc9
xchg bp, si
lea esi, [edx + edi]
mov byte [esp + 2], al
pop edx
mov bh, byte [esp]
jmp 0x10e5fc54
mov ax, word [esp + 3]
lea ebx, [eax + edi]
mov ecx, 0x6425678f
std
xchg esi, eax
pop esi
jmp 0x10e5fbfb
mov ebp, 0x8a867e8f
push word [esp + 8]
mov bx, word [esp + 9]
mov ah, 5
lea esp, [esp + 2]
mov dx, word [esp + 3]
jmp 0x10e5fc11
seto bl
cmc
rdtsc
setnp dh
mov edx, edi
mov al, dh
jmp 0x10e5fca5
and bh, dh
xchg byte [esp + 0x11], cl
add esp, 6
cmp eax, ebx
mov dword [esp + 0x11], eax
push word [esp + 2]
jmp 0x10e5fb25
mov ax, sp
clc
xchg cx, di
add esp, 0
sete ah
lea esp, [esp]
jmp 0x10e5fd26
clc
rdtsc
xchg byte [esp], al
mov ah, byte [esp]
cpuid
not bh
jmp 0x10e5fc8f
neg bh
lea ebx, [eax + esi]
sbb bl, 0xe4
jmp 0x10e5fc76
xchg ebp, edi

Function at 0x10e5ff18
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
dec ch
jmp 0x10e5ff56
mov dword [esp + 1], edi
add esp, 6
mov byte [esp + 0x10], bh
cmc
xchg byte [esp + 6], al
sub esp, 0x1b
jmp 0x10e5ff40
Function at 0x10e6433a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 3]
sub esp, 0x1b
pop bp
lea esp, [esp + 4]
jmp 0x10e6448f
mov bx, word [esp + 0xc]
pop word [esp + 3]
xchg byte [esp + 4], dh
jmp 0x10e643db
mov ah, 0xef
dec dx
cld
xchg byte [esp + 0xb], bh
cpuid
mov dx, 0xc209
jmp 0x10e64381
pop edx
mov ebx, dword [esp + 9]
pop esi
cld
bsf ax, ax
mov di, bx
jmp 0x10e64397
mov ax, word [esp + 3]
mov bh, ch
pop si
pushfd
cld
sub esp, 0x12
jmp 0x10e64455
mov byte [esp + 2], dl
pop dx
push dword [esp + 9]
neg ch
xchg word [esp + 4], dx
jmp 0x10e643c5
xchg dword [esp + 0x12], edx
neg dx
mov dx, 0x1441
mov dl, 0x16
lea ebp, [esi + esi]
lea esp, [esp + 1]
jmp 0x10e643b5
rcr ecx, cl
xchg dx, ax
mov dh, byte [esp + 0xf]
pop ax
push dword [esp + 9]
xchg esi, eax
jmp 0x10e64436
rdtsc
mov dword [esp + 0x16], edi
lea ebp, [esp + ebp]
xchg byte [esp + 0x1a], dh
neg bl
xchg byte [esp + 0x13], ah
jmp 0x10e6440b
lea eax, [ecx*4]
mov ebp, ebx
push dword [esp + 1]
mov byte [esp + 5], ah
push dword [esp + 3]
xchg dword [esp + 0xb], esi
jmp 0x10e64469
inc di
rdtsc
mov ch, byte [esp + 0x1f]
pop dword [esp + 4]
cld
mov bp, word [esp + 0xa]
jmp 0x10e64421
stc
bt edx, edi
inc bh
pop word [esp + 0x1b]
push esp
xchg bl, cl
jmp 0x10e644cb
lea edi, [esp + eax]
bswap edi
mov dh, 0xfd
bswap eax
rdtsc
push di
jmp 0x10e644a3
mov ch, cl
xchg dword [esp + 0xc], edi
mov eax, ebx
neg esi
mov di, cx
mov al, cl
jmp 0x10e643f5
lea esp, [esp + 0x22]
btr dx, sp
pop si
xchg word [esp + 3], si
btc ebx, ebp
mov byte [esp + 3], ch
jmp 0x10e644fe
bsf di, si
xchg byte [esp + 0x24], ah
cpuid
mov ah, byte [esp + 0x27]
rcr ebx, 0xb
xchg dword [esp + 5], ecx
jmp 0x10e64479
push dword [esp + 4]
xchg byte [esp + 5], ah
mov dword [esp + 2], eax
xchg ecx, eax
xchg bp, dx
push dword [esp + 6]
jmp 0x10e6450d
neg al
neg eax
pop esi
neg bx
bsr ecx, edi
inc ah
jmp 0x10e644e2
mov bl, 3
xchg si, ax
mov dword [esp + 2], ecx
push word [esp + 4]
add esp, 2
add esp, 7
jmp 0x10e64b2f
push word [esp + 3]
sub esp, 0x1c
pop dword [esp + 0x10]
cpuid
push dword [esp + 2]
call fcn.10e64834
ljmp 0xcc88
xchg byte [esp + 4], dl
pop word [esp + 1]
lea ebx, [ebp*4]
xchg dword [esp], eax
pushal
add esp, 0xd
jmp 0x10e6486b
Function at 0x4065a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4900db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00485006
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406622
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00482eec
mov eax, dword [eax]
push 0x54bc58
push eax
call fcn.00475134
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00485291
test bl, bl
je 0x406622
push 0x54bc58
lea ecx, [esp + 0xc]
call fcn.00485621
push 0x54bc64
lea ecx, [esp + 0xc]
call fcn.00485621
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40665e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00485291
jmp 0x406729
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4066e2
lea edx, [esp + 0x7c]
push 0x54bc60
push edx
call fcn.00475134
add esp, 8
test eax, eax
je 0x4066e2
lea eax, [esp + 0x7c]
push 0x54bc5c
push eax
call fcn.00475134
add esp, 8
test eax, eax
je 0x4066e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406672
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00485291
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x406f20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406f82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x406f90
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49015b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x55b008]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4070c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x406ff6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00485291
xor eax, eax
jmp 0x40713f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004853ce
push esi
lea ecx, [esp + 0xc]
call fcn.0048565d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40711d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00406f20
test eax, eax
jne 0x40711d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00406f20
test eax, eax
jne 0x40711d
lea eax, [esp + 0x14]
push 0x54bc74
push eax
call fcn.004761d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4070fc
lea ecx, [esp + 0x14]
push 0x54bc70
push ecx
call fcn.00476150
mov esi, eax
add esp, 8
test esi, esi
jne 0x4070fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4070ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048537e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40700e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00485291
xor eax, eax
jmp 0x40713f
mov byte [esi], 0
push 0x54bc6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00485291
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4