joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eb2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407e02
and dword [ebp - 4], 0
cmp dword [0x4b2b34], 0
mov ebx, eax
jne 0x40ebdc
push 0x402c6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ec8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c60
push edi
call esi
test eax, eax
je 0x40ec8d
push eax
call fcn.00407d90
mov dword [esp], 0x402c50
push edi
mov dword [0x4b2b34], eax
call esi
push eax
call fcn.00407d90
mov dword [esp], 0x402c3c
push edi
mov dword [0x4b2b38], eax
call esi
push eax
call fcn.00407d90
mov dword [esp], 0x402c20
push edi
mov dword [0x4b2b3c], eax
call esi
push eax
call fcn.00407d90
pop ecx
mov dword [0x4b2b44], eax
test eax, eax
je 0x40ebdc
push 0x402c08
push edi
call esi
push eax
call fcn.00407d90
pop ecx
mov dword [0x4b2b40], eax
mov eax, dword [0x4b2b40]
cmp eax, ebx
je 0x40ec34
cmp dword [0x4b2b44], ebx
je 0x40ec34
push eax
call fcn.00407e0b
push dword [0x4b2b44]
mov esi, eax
call fcn.00407e0b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ec34
test edi, edi
je 0x40ec34
call esi
test eax, eax
je 0x40ec2b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ec2b
test byte [ebp - 0xc], 1
jne 0x40ec34
or dword [ebp + 0x10], 0x200000
jmp 0x40ec6d
mov eax, dword [0x4b2b38]
cmp eax, ebx
je 0x40ec6d
push eax
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec6d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ec6d
mov eax, dword [0x4b2b3c]
cmp eax, ebx
je 0x40ec6d
push eax
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b2b34]
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ec8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401100
Capabilities:
Get disk size

Disassembly:
mov eax, dword [0x411f44]
sub esp, 0x17c
cmp word [0x422c0a], 0x3a
push esi
push edi
mov edi, eax
jne 0x40121a
mov edx, 0x40f724
lea ecx, [esp + 0x38]
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40113f
mov word [ecx], ax
add ecx, 2
lea eax, [esp + 0x56]
cmp ecx, eax
jb 0x401126
mov eax, dword [0x422d48]
test eax, eax
mov word [ecx], 0
mov cx, word [0x422c08]
mov word [esp + 0x38], cx
je 0x401176
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x48]
push edx
call eax
jmp 0x4011bf
mov edx, dword [0x422d34]
push 0
push 0
push 0x104
lea eax, [esp + 0x84]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x88]
push ecx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4011e2
mov eax, dword [esp + 0x10]
mul dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edx
push eax
call fcn.0040d7a0
pop edi
pop esi
add esp, 0x17c
ret
mov esi, dword [sym.imp.kernel32.dll_SetFilePointer]
push 2
push 0
push 0
push edi
call esi
push 1
push 0x422bf4
push 0
push edi
call esi
cmp eax, 0xffffffff
mov dword [0x422bf0], eax
je 0x40129d
mov edx, dword [0x422bf4]
pop edi
pop esi
add esp, 0x17c
ret
mov esi, dword [sym.imp.kernel32.dll_DeviceIoControl]
push 0
lea edx, [esp + 0x1c]
push edx
push 0x20
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
push 0x74004
push eax
call esi
test eax, eax
je 0x40124f
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
pop edi
pop esi
add esp, 0x17c
ret
push 0
lea edx, [esp + 0x1c]
push edx
push 0x18
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x70000
push edi
call esi
test eax, eax
je 0x40129d
mov eax, dword [esp + 0x2c]
mul dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
push ecx
push edx
push eax
call fcn.0040d7a0
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.0040d7a0
pop edi
pop esi
add esp, 0x17c
ret
pop edi
xor eax, eax
xor edx, edx
pop esi
add esp, 0x17c
ret
Function at 0x401e10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x2a4
cmp word [0x422c0a], 0x3a
jne 0x401e8a
mov edx, 0x40f724
lea ecx, [esp]
jmp 0x401e30
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x401e49
mov word [ecx], ax
add ecx, 2
lea eax, [esp + 0x1e]
cmp ecx, eax
jb 0x401e30
push 0
push 0
push 0
push 0
push 0
push pe_nt_image_headers32
lea edx, [esp + 0x38]
mov word [ecx], 0
mov cx, word [0x422c08]
push edx
lea eax, [esp + 0x1c]
push eax
mov word [esp + 0x20], cx
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
test eax, eax
je 0x401e8a
mov ecx, 0x40f794
lea eax, [esp + 0x20]
call fcn.00403f80
jmp 0x401e91
mov word [esp + 0x20], 0
push 0x40f798
push ecx
call fcn.00401100
add esp, 4
push 0
add eax, 0x7ffff
push 0x100000
adc edx, 0
push edx
push eax
call fcn.0040d980
push eax
lea ecx, [esp + 0x28]
push ecx
push 0x422c00
push str._s__s__i_s_
lea edx, [esp + 0xb4]
push 0x100
push edx
call fcn.00404710
mov ecx, dword [0x422bf8]
add esp, 0x1c
lea eax, [esp + 0xa0]
push eax
push 0
push 0x143
push 0x3eb
push ecx
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call fcn.00404330
add esp, 0x2a4
ret

Function at 0x4035e0
Capabilities:
Create thread

Disassembly:
push ecx
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x422bfc], eax
call dword [sym.imp.comctl32.dll_InitCommonControls]
call fcn.00403c20
call fcn.00403570
mov word [0x4129d8], 0
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x403629
push 0
push 0x40f548
push 0x40f610
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
xor al, al
pop ecx
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x422cb4], eax
je 0x403689
push 0
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x4129d0], eax
je 0x403689
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x4012b0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x403689
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
Function at 0x403740
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x108
cmp word [edi], 0
je 0x403886
cmp byte [esp + 0x10c], 0
jne 0x403774
mov eax, dword [edi + 0x208]
push 0x2bf20
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
jne 0x403886
cmp dword [edi + 0x20c], 0
je 0x403866
push ebx
push ebp
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ebp, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ebx, dword [sym.imp.kernel32.dll_CreateFileA]
add eax, 0x2bf20
mov dword [esp + 0xc], eax
nop
mov eax, dword [0x422d28]
test eax, eax
push 0
push 0
je 0x4037bd
push 4
push 0
push 0
push 0x40000000
push edi
call eax
jmp 0x4037eb
mov edx, dword [0x422d34]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edi
push 0
push edx
call ebp
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x403829
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 3
je 0x403859
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
call esi
mov ecx, dword [esp + 0xc]
sub ecx, eax
test ecx, ecx
jle 0x403859
call esi
xor edx, edx
mov ecx, 0x64
div ecx
add edx, 0x32
push edx
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4037a0
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [edi + 0x20c]
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [edi + 0x210]
push ecx
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop esi
pop ebp
mov dword [edi + 0x20c], 0
pop ebx
cmp byte [esp + 0x10c], 0
jne 0x403886
mov edx, dword [edi + 0x208]
add esp, 0x108
mov dword [esp + 4], edx
jmp dword [sym.imp.kernel32.dll_ReleaseMutex]
add esp, 0x108
ret 4
Function at 0x4039e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x31c
push esi
mov esi, dword [esp + 0x324]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403a06
xor eax, eax
pop esi
add esp, 0x31c
ret 0xc
push 0
lea eax, [esp + 0x18]
push eax
push 0x104
push esi
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
mov esi, eax
test esi, esi
je 0x403b8f
cmp esi, 0x104
jb 0x403a41
push 0x6f
call dword [sym.imp.kernel32.dll_SetLastError]
xor esi, esi
mov eax, esi
pop esi
add esp, 0x31c
ret 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.shell32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x403b8f
push 0x104
lea edx, [esp + 0x11c]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.kernel32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
add eax, 1
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x403a9c
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x403a95
push 0x6f
call dword [sym.imp.kernel32.dll_SetLastError]
xor esi, esi
jmp 0x403b83
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x124]
push edx
push 0
push 0
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jge 0x403af4
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x403ae5
movzx edx, ax
push edx
call dword [sym.imp.kernel32.dll_SetLastError]
xor esi, esi
jmp 0x403b83
push 0xd
call dword [sym.imp.kernel32.dll_SetLastError]
xor esi, esi
jmp 0x403b83
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.shell32.dll_SHGetPathFromIDList]
mov esi, eax
test esi, esi
jne 0x403b1a
cmp byte [esp + 0x14], al
je 0x403b1a
push 0xd
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x403b57
push edi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.kernel32.dll_lstrlen]
mov esi, eax
mov eax, dword [esp + 0x330]
lea edi, [esi + 1]
cmp edi, eax
jbe 0x403b42
push 0x7a
call dword [sym.imp.kernel32.dll_SetLastError]
mov esi, edi
jmp 0x403b56
mov ecx, dword [esp + 0x32c]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrcpyn]
pop edi
lea edx, [esp + 8]
push edx
call dword [sym.imp.shell32.dll_SHGetMalloc]
test eax, eax
jl 0x403b83
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 0x31c
ret 0xc
Function at 0x404480
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1000
call fcn.0040d330
mov ecx, dword [0x422d40]
test ecx, ecx
mov eax, dword [esp + 0x1004]
je 0x4044ab
push esi
push edi
push 0xd
push eax
call ecx
add esp, 0x1000
ret 4
lea ecx, [esp]
push ecx
push 0x1000
push 0xd
push eax
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [0x422d34]
push edi
push esi
push 0xffffffffffffffff
lea edx, [esp + 0xc]
push edx
push 0
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov word [esi + edi*2 - 2], 0
cmp word [esi], 0
mov eax, esi
je 0x4044ec
add eax, 2
cmp word [eax], 0
jne 0x4044e3
sub eax, esi
sar eax, 1
add esp, 0x1000
ret 4

Function at 0x404500
Capabilities:
Get file version info

Disassembly:
mov eax, dword [0x422cf4]
sub esp, 0x104
test eax, eax
je 0x40451d
push esi
push edi
push 0
push ecx
call eax
add esp, 0x104
ret
push 0
push 0
push 0x104
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
push ecx
mov ecx, dword [0x422d34]
push 0
push ecx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push edi
push 0
lea edx, [esp + 0xc]
push edx
call sub.version.dll_GetFileVersionInfoA
add esp, 0x104
ret

Function at 0x4045d0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [0x422d48]
sub esp, 0x104
test eax, eax
push ebp
mov ebp, dword [esp + 0x10c]
je 0x4045f8
push esi
push edi
push ebx
push ebp
push ecx
call eax
pop ebp
add esp, 0x104
ret 4
push 0
push 0
push 0x104
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push ecx
mov ecx, dword [0x422d34]
push 0
push ecx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push edi
push ebx
push ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
pop ebp
add esp, 0x104
ret 4

Function at 0x408c65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411420]
jne 0x408c6f
repz ret
jmp fcn.0040b909
Function at 0x40925f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00406aec
xor ebx, ebx
cmp dword [0x412580], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x409334
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40929f
xor eax, eax
jmp 0x4093f8
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x409298
push eax
call fcn.00406a89
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412580], eax
call esi
push eax
call fcn.00406a89
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412584], eax
call esi
push eax
call fcn.00406a89
mov dword [0x412588], eax
lea eax, [ebp - 8]
push eax
call fcn.00405d6f
test eax, eax
pop ecx
pop ecx
je 0x409302
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407c75
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x409334
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00406a89
cmp eax, ebx
pop ecx
mov dword [0x412590], eax
je 0x409334
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a89
pop ecx
mov dword [0x41258c], eax
mov eax, dword [0x41258c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4093ad
cmp dword [0x412590], esi
je 0x4093ad
push eax
call fcn.00406af5
pop ecx
call eax
cmp eax, ebx
je 0x40937a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x412590]
call fcn.00406af5
pop ecx
call eax
test eax, eax
je 0x40937a
test byte [ebp - 0x18], 1
jne 0x4093ad
lea eax, [ebp - 0xc]
push eax
call fcn.00405da6
test eax, eax
pop ecx
je 0x409395
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407c75
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4093a4
or dword [ebp + 0x10], 0x200000
jmp 0x4093de
or dword [ebp + 0x10], 0x40000
jmp 0x4093de
mov eax, dword [0x412584]
cmp eax, esi
je 0x4093de
push eax
call fcn.00406af5
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4093de
mov eax, dword [0x412588]
cmp eax, esi
je 0x4093de
push dword [ebp - 4]
push eax
call fcn.00406af5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x412580]
call fcn.00406af5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406004
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
cmp dword [eax + 0x3d32f2b3], esp
fstp st(5)
inc ecx
popfd
xor bh, byte [0x9d41dddd]
enter 0x79bc, 0x21
insd dword es:[edi], dx
mov esp, 0x5a4b9c27
jge 0x406009
xchg ebp, eax
enter 0xffffffffffffc62b, 0xffffffffffffffe3
cmp byte [esi], dh
insd dword es:[edi], dx
or dword [edx], eax
stosb byte es:[edi], al
add bl, byte [ebx - 0x20516603]
mov cl, 0xaa
mov eax, dword [0x6d2a4912]
mov esp, 0xb0c9fb54
stosd dword es:[edi], eax
dec ebp
jg 0x406071
loope 0x406091
cmp dword [ebx + 0x13], esi
insd dword es:[edi], dx
js 0x406044
jmp [edi]
das
sbb edi, dword es:[esp + edi*8 - 0x107b7476]
jb 0x4060ac
imul dword [edx]
xor al, 0x77
add eax, 0x942a2819
sbb byte es:[edi + 0x60], 0xe4
and byte [ebx], dh
xor al, 0x95
dec edx
mov word [esi + 0x3ba95e8e], fs
insb byte es:[edi], dx
in eax, dx
movsd dword es:[edi], dword [esi]
mov dl, 0x37
dec eax
cmc
xor dword [edx], edi
outsd dx, dword [esi]
sub dl, byte [ebp - 0x60]
insd dword es:[edi], dx
push eax
push ebp
pop ebx
cmp ch, byte [edi + 0x2a]
push ebp
mov al, byte [0x5b55506d]
dec ecx
inc edx
ljmp 0x3bc0
enter 0xffffffffffffb8c0, 0xffffffffffffffc6
das
jo 0x4060bf
dec ebx
iretd
and dword [edx + 0x76], ebp
add ah, dl
sub edi, dword [ebx + 0xa]
mov dh, 0x2a
inc ebp
xacquire xchg byte [edx - 0xc721277], cl
fild dword [ebx]
mov eax, 0x51d436ea
jb 0x4060bf
xchg dword [eax + 0xd], ebp
adc eax, 0x6de35c06
mov edx, 0xfb41281
sub byte [edi + 0x1f52b8b8], 0x94
adc eax, 0x5d6dead1
cmc
int3
Function at 0x55f5f9
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
mov esi, 0x9c513d99
mov esp, 0xb71533bd
mov dl, 0x85
lodsd eax, dword [esi]
aaa
xor ebp, dword [ebp + 0x118351d3]
pop esp
ja 0x52386a
lodsd eax, dword [esi]
rcl dword [ecx - 0x4a], cl
cdq
sub esp, dword [ebp - 0x48a3fb77]
sbb ebp, dword [ebp + 0x335d1e8]
rol dword [ebp + eax + 0x48dba738], cl
push ecx
xor al, bh
xor edi, dword [eax]
wait
rcl dword [ebp*4 + 0x363351d3], cl
loopne 0x52384f
rcl dword [ecx + 0x33], cl
loopne 0x52384f
xchg edx, eax
and dl, bl
adc dl, byte [0xbd1bd6b6]
mov edx, 0xada8b16f
test al, 0xad
xchg esp, eax
cmp al, byte [eax + edx*2 + 0x6b]
mov cl, 0xa8
lodsd eax, dword [esi]
cmp eax, 0x31391b53
push edx
xor eax, dword [esi]
pop eax
adc ch, byte [ecx + 0x1b6e3db5]
jno 0x523858
push ecx
xor eax, dword [esi]
mov ebx, 0xd3ad8f88
salc
and bl, bl
mov ebx, 0x52859543
xor ebp, dword [ebp + 0x3729852c]
dec eax
dec esi
sbb al, 0x12
sub eax, 0xe8ac3352
aaa
add edx, ebx
hlt
pop esi
jae 0x55f61b
invalid
add esi, 0xffffff94
jmp 0x55f646
cmp dword [esi], 0
jmp 0x55f674
je 0x55f831
jmp 0x55f6a8
mov ecx, esi
jmp 0x55f6d3
add esi, 4
jmp 0x55f6fb
mov edx, dword [esi]
jmp 0x55f712
add edx, esi
clc
jmp 0x55f736
mov eax, dword [esi + 4]
jmp 0x55f761
sub dword [edx], 0xad3351d3
jmp 0x55f776
add edx, 4
jmp 0x55f78b
sub eax, 1
stc
jb 0x55f7b9
push 0xffffffffffffff8e
pop ebp
in al, dx
cmp eax, 0x1341a27a
mov esi, 0x863637c8
sbb al, 0x79
hlt
cli
cmc
xchg edx, eax
add byte [edx], dl
cmp dword [esi + 0x15], ebx
lodsb al, byte [esi]
and bh, byte [esi - 0x6fbd2324]
adc byte [ebx + 0x23e0dfc5], al
not dword [esi + 0xf]
test dword [edx - 1], edi
invalid
jne 0x55f739
jb 0x55f7ce
push es
sti
je 0x55f7f1
or byte [edx], bl
out 0xae, al
aas
jle 0x55f7a2
rcr dword [ebx + eax*4 + 0x3eb08c6], 0x5b
xor eax, dword [ebx - 0x6fed67d]
add esi, 8
jmp 0x55f7d6
sub dword [ecx], 1
stc
jmp 0x55f7f2
sub dword [edi], ecx
test esi, ebx
invalid
jne 0x55f6d6
clc
jmp 0x55f824
mov ebx, esi
stc
jmp 0x55f82c
call fcn.0055f86c
jmp 0x55f858
popal
clc
jmp 0x55f867
jmp 0x52381d
Function at 0x40378f
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040393f
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40388d
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x403830
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x403873
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x403847
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x403862
test al, 0x40
je 0x403859
mov ecx, dword [edi + 0x20]
jmp 0x403860
test al, 0x80
je 0x403873
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x403873
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4037ff
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40e8f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47588b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046837b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e972
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00465dcd
mov eax, dword [eax]
push 0xea71d0
push eax
call fcn.00458a84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00468606
test bl, bl
je 0x40e972
push 0xea71d0
lea ecx, [esp + 0xc]
call fcn.004689e2
push 0xeaad44
lea ecx, [esp + 0xc]
call fcn.004689e2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e9ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00468606
jmp 0x40ea79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ea32
lea edx, [esp + 0x7c]
push 0xeaad40
push edx
call fcn.00458a84
add esp, 8
test eax, eax
je 0x40ea32
lea eax, [esp + 0x7c]
push 0xeaad3c
push eax
call fcn.00458a84
add esp, 8
test eax, eax
je 0x40ea32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e9c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00468606
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f270
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f2d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc