joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4934e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00465310
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00465390
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00465390
lea ecx, [esi + 0xc]
call fcn.00481c17
lea ecx, [esi + 0x10]
call fcn.00481c17
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00467bc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00467bc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00467bc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00481c8c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00481c8c
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x466408
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x493708
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x466418
call fcn.00466930
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4664fb
cmp byte [edi], 0
je 0x4664fb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x46643d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00465130
test eax, eax
jne 0x46645d
push 0x4fd0a0
lea ecx, [esi + 0x38]
call fcn.00481e15
jmp 0x4664fb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00465180
test eax, eax
jne 0x46648c
mov ecx, esi
call fcn.00465280
push edi
add esi, 0x38
push 0x4fd07c
push esi
call fcn.0047f26a
add esp, 0xc
jmp 0x4664fb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004671b0
test eax, eax
je 0x4664f4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004665d0
test eax, eax
jne 0x466510
push edi
lea eax, [esi + 0x38]
push 0x4fd058
push eax
call fcn.0047f26a
add esp, 0xc
mov ecx, esi
call fcn.00466930
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4665b8
mov ecx, dword [0x4fd310]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0047f26a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00465230
test eax, eax
jne 0x46657a
push 0x4fd03c
lea ecx, [esi + 0x38]
call fcn.00481e15
jmp 0x46658a
push 0xfa
mov ecx, esi
call fcn.004671b0
test eax, eax
jne 0x4665a7
mov ecx, esi
call fcn.00466930
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00481c8c
jmp 0x4664fb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00481c8c
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x48407f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4840b7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00482133
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048210b
jmp 0x4840c3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x485771
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4857b3
call fcn.0048b55b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4857b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4857aa
xor eax, eax
jmp 0x4857bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004857c1
pop edi
pop esi
pop ebx
ret 4

Function at 0x48ba8b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48bab9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48bad7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048b9f1
jmp 0x48bad7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48bad7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048b9f1
test edi, edi
mov eax, edi
jne 0x48bac1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100041d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100362c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esi], sym.InputAirPcapAdapter.dll_const_processor_plugin::vftable
call dword [0x1003b0b8]
xor ebx, ebx
lea eax, [esi + 0x30]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x50], 8
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
lea ecx, [esi + 0x68]
mov byte [esp + 0x14], 1
call fcn.10010ab0
lea ecx, [esi + 0x6c]
mov byte [esp + 0x14], 2
call dword [0x1003b0b8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10004530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003631c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esi], vtable.__n___zaLpA:y1.0
call dword [0x1003b0b8]
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], ebx
call dword [0x1003b0b8]
lea eax, [esi + 0x58]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], bl
mov eax, 8
mov dword [esi + 0x68], eax
lea ecx, [esi + 0x7c]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x90], ebx
mov byte [esi + 0x94], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100068b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100364f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable._4r_3pXh__3h__qkCy_mk7hUDqy9_oSz1o_bF:_k_Uag._gfLjb_qe_EwnV_gAAoFObycm.0
lea ecx, [esi + 0x90]
mov dword [esp + 0x18], 5
call dword [0x1003b0b4]
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 4
call fcn.10010ac0
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 3
call dword [0x1003b0b4]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call dword [0x1003b0b4]
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call dword [0x1003b0b4]
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x20]
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 0x18], bl
je 0x1000694f
mov edx, dword [esp + 0xc]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.10005770
mov eax, dword [edi + 4]
push eax
call fcn.100330cc
add esp, 0x14
lea ecx, [esi + 4]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x18], 0xffffffff
call dword [0x1003b0b4]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10006ac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100364f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
mov dword [esi], vtable._4r_3pXh__3h__qkCy_mk7hUDqy9_oSz1o_bF:_k_Uag._gfLjb_qe_EwnV_gAAoFObycm.0
call dword [0x1003b0b0]
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], 0
call fcn.10006140
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call dword [0x1003b0b0]
lea eax, [edi + 0x4c]
push eax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call dword [0x1003b0b0]
lea ecx, [edi + 0x68]
push ecx
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 3
call dword [0x1003b0b0]
mov dl, byte [edi + 0x84]
mov byte [esi + 0x84], dl
mov eax, dword [edi + 0x88]
mov dword [esi + 0x88], eax
mov ecx, dword [edi + 0x8c]
mov dword [esi + 0x8c], ecx
add edi, 0x90
push edi
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 5
call dword [0x1003b0b0]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10008bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10036721
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov esi, dword [esp + 0x40]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], ebx
mov dword [esp + 8], 1
call dword [0x1003b0b8]
mov byte [esp + 0x2c], 1
push str.index::none
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 1
call dword [0x1003b0bc]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], 1
call fcn.100089d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call dword [0x1003b0b4]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x1000ab20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100368e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ebx
call dword [0x1003b0b8]
lea edi, [ebx + 0x30]
mov ecx, edi
mov dword [esp + 0x264], 0
mov dword [esp + 0x18], edi
call dword [0x1003b240]
mov ecx, ebx
mov byte [esp + 0x264], 1
call fcn.100094a0
mov ecx, dword [ebx + 0x10]
test ecx, ecx
lea esi, [ebx + 0xc]
jne 0x1000ab86
xor edx, edx
jmp 0x1000ab8e
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp eax, edx
je 0x1000ad2e
mov byte [ebx + 0x2c], 1
xor edi, edi
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000abdd
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x1000abdd
test ecx, ecx
je 0x1000abc3
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x1000abc9
call dword [0x1003b198]
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
push ecx
call fcn.1000f3ae
add esp, 4
add edi, 1
jmp 0x1000aba0
mov ebp, dword [esi + 8]
cmp ecx, ebp
jbe 0x1000abea
call dword [0x1003b198]
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x1000abf8
call dword [0x1003b198]
cmp edi, ebp
je 0x1000ac26
mov eax, dword [esi + 8]
sub eax, ebp
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + edi]
jle 0x1000ac1f
push ecx
push ebp
push ecx
push edi
call dword [0x1003b184]
add esp, 0x10
mov dword [esi + 8], ebx
mov ebx, dword [esp + 0x10]
mov edi, dword [ebx + 0x24]
cmp dword [ebx + 0x20], edi
lea ebp, [ebx + 0x1c]
jbe 0x1000ac37
call dword [0x1003b198]
mov ebx, dword [ebp + 4]
cmp ebx, dword [ebp + 8]
jbe 0x1000ac45
call dword [0x1003b198]
push edi
push ebp
push ebx
push ebp
lea edx, [esp + 0x48]
push edx
mov ecx, ebp
call fcn.10005eb0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.1000f3f0
add esp, 8
test eax, eax
jne 0x1000ac7c
mov edx, dword [esp + 0x10]
mov byte [edx + 4], al
mov eax, dword [esp + 0x18]
push eax
jmp 0x1000ad2f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x1000ad21
mov bl, 2
lea ebx, [ebx]
mov ecx, dword [edi + 4]
push ecx
lea ecx, [esp + 0x20]
call dword [0x1003b0bc]
push 3
push 0
push 0x1003bb8c
lea ecx, [esp + 0x28]
call dword [0x1003b0ec]
mov edx, dword [0x1003b0e8]
cmp eax, dword [edx]
jne 0x1000ad13
mov ecx, dword [edi + 4]
lea eax, [esp + 0x5c]
push eax
push ecx
call fcn.1000f3de
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
je 0x1000ad13
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10016170
mov eax, dword [edi + 4]
push eax
lea ecx, [esp + 0x44]
call dword [0x1003b0c4]
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
mov byte [esp + 0x268], bl
call fcn.1000ebb0
lea ecx, [esp + 0x40]
mov byte [esp + 0x264], 1
call dword [0x1003b0b4]
mov edi, dword [edi]
test edi, edi
jne 0x1000ac90
mov edi, dword [esp + 0x14]
push edi
call fcn.1000f3e4
mov edi, dword [esp + 0x1c]
add esp, 4
push edi
call dword [0x1003b03c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x264], 0xffffffff
call dword [0x1003b0b4]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x258
ret
Function at 0x1000adb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100368f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esi + 0x30]
push edi
mov dword [esp + 0x10], ecx
call dword [0x1003b240]
mov ecx, dword [esp + 0x2c]
lea eax, [esi + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.1000dc30
mov ebx, dword [esp + 0x30]
mov edi, dword [ebx + 8]
cmp dword [ebx + 4], edi
jbe 0x1000ae02
call dword [0x1003b198]
mov ebp, dword [ebx + 4]
cmp ebp, dword [ebx + 8]
jbe 0x1000ae10
call dword [0x1003b198]
push edi
push ebx
push ebp
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.10005eb0
xor edi, edi
xor ebp, ebp
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000ae85
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1000ae85
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000ae6a
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000ae70
call dword [0x1003b198]
mov edx, dword [esi + 0x20]
add edx, ebp
push edx
mov ecx, ebx
call fcn.1000ebb0
add edi, 1
add ebp, 0x1c
jmp 0x1000ae24
mov eax, dword [esp + 0x10]
push eax
call dword [0x1003b03c]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x1001caf0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push esi
mov esi, edx
lea eax, [ecx + 0x58]
mov ecx, edx
and esi, 3
shr edx, 2
je 0x1001cb36
push ebx
push edi
jmp 0x1001cb10
movzx edi, word [eax]
add ecx, edi
movzx edi, word [eax + 2]
mov ebx, ecx
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor ecx, edi
mov edi, ecx
shr edi, 0xb
add eax, 4
add ecx, edi
sub edx, 1
jne 0x1001cb10
pop edi
pop ebx
sub esi, 1
je 0x1001cb75
sub esi, 1
je 0x1001cb60
sub esi, 1
jne 0x1001cb87
movzx edx, word [eax]
movsx eax, byte [eax + 2]
add eax, eax
add ecx, edx
add eax, eax
xor eax, ecx
shl eax, 0x10
xor ecx, eax
mov edx, ecx
shr edx, 0xb
jmp 0x1001cb85
movzx eax, word [eax]
add ecx, eax
mov edx, ecx
shl edx, 0xb
xor ecx, edx
mov eax, ecx
shr eax, 0x11
add ecx, eax
jmp 0x1001cb87
movsx edx, byte [eax]
add ecx, edx
mov eax, ecx
shl eax, 0xa
xor ecx, eax
mov edx, ecx
shr edx, 1
add ecx, edx
lea eax, [ecx*8]
xor ecx, eax
mov edx, ecx
shr edx, 5
add ecx, edx
mov eax, ecx
shl eax, 4
xor ecx, eax
mov edx, ecx
shr edx, 0x11
add ecx, edx
mov eax, ecx
shl eax, 0x19
xor ecx, eax
mov eax, ecx
shr eax, 6
add eax, ecx
pop esi
ret 4
Function at 0x100354d0
Capabilities:
Authenticate hmac
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfc
mov eax, dword [0x10062890]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x104]
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
push 0x40
mov edi, edx
lea edx, [esp + 0xcc]
push 0x36
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.10033916
push 0x40
lea eax, [esp + 0x98]
push 0x5c
push eax
call fcn.10033916
add esp, 0x18
xor edx, edx
test ebp, ebp
jbe 0x10035557
lea esi, [esp + 0xc8]
lea ebx, [esp + 0x88]
sub esi, edi
mov eax, edi
sub ebx, edi
nop
cmp edx, 0x40
jae 0x10035557
mov cl, byte [eax]
xor byte [esi + eax], cl
xor byte [ebx + eax], cl
add edx, 1
add eax, 1
cmp edx, ebp
jb 0x10035540
lea ecx, [esp + 0x18]
mov ebp, 0x98badcfe
mov ebx, 0x10325476
mov edi, 0xc3d2e1f0
push ecx
lea eax, [esp + 0xcc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], 0x40
call fcn.10033d60
mov eax, dword [esp + 0x11c]
add esp, 4
test eax, eax
je 0x100355c2
mov edx, dword [esp + 0x14]
push edx
lea esi, [esp + 0x1c]
call fcn.10035260
add esp, 4
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.100352f0
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x90]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x20], 0x40
call fcn.10033d60
mov eax, dword [esp + 0x20]
mov esi, eax
mov ebx, 0x14
and esi, 0x3f
mov edi, 0x40
add eax, ebx
add esp, 8
sub edi, esi
cmp eax, ebx
lea ebp, [esp + 0x74]
mov dword [esp + 0x18], eax
jae 0x10035638
add dword [esp + 0x1c], 1
test esi, esi
je 0x10035691
cmp edi, ebx
ja 0x10035691
push edi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + esi + 0x3c]
push eax
call fcn.100331e4
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x44]
call fcn.10033d60
sub ebx, edi
add esp, 0x10
xor esi, esi
cmp ebx, 0x40
lea ebp, [esp + edi + 0x74]
jb 0x1003568d
mov edi, ebx
shr edi, 6
lea edx, [esp + 0x18]
push edx
mov eax, ebp
call fcn.10033d60
add esp, 4
sub ebx, 0x40
add ebp, 0x40
sub edi, 1
jne 0x10035673
test ebx, ebx
je 0x100356a0
push ebx
lea eax, [esp + esi + 0x38]
push ebp
push eax
call fcn.100331e4
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100352f0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10033606
add esp, 0xfc
ret
Function at 0x10035ab0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10062890]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push edi
mov edi, edx
push edi
push eax
lea eax, [esp + 0x38]
push eax
mov ebx, ecx
mov dword [esp + 0x24], ebp
call fcn.100331e4
mov ecx, ebx
sar ecx, 0x18
mov edx, ebx
sar edx, 0x10
mov eax, ebx
mov byte [esp + edi + 0x3c], cl
mov byte [esp + edi + 0x3d], dl
mov edx, dword [esp + 0x6c]
sar eax, 8
mov byte [esp + edi + 0x3e], al
mov byte [esp + edi + 0x3f], bl
add edi, 4
push edi
lea ecx, [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x34]
mov edx, ebp
call fcn.100354d0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esi], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x4b]
sub eax, esi
mov dword [esp + 0x28], eax
lea edi, [esp + 0x48]
lea ebx, [esp + 0x49]
lea ebp, [esp + 0x4a]
lea eax, [esp + 0x4c]
add esp, 0x18
sub edi, esi
sub ebx, esi
sub ebp, esi
sub eax, esi
mov dword [esi + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xfff
jmp 0x10035b70
mov eax, dword [esp + 0x60]
push 0x14
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call fcn.100354d0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0xc
mov dword [esp + 0x2c], edx
mov eax, esi
mov ecx, 4
jmp 0x10035bc0
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ebx + eax]
xor byte [eax + 1], dl
movzx edx, byte [eax + ebp]
xor byte [eax + 2], dl
mov edx, dword [esp + 0x10]
movzx edx, byte [edx + eax]
xor byte [eax + 3], dl
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
xor byte [eax + 4], dl
add eax, 5
sub ecx, 1
jne 0x10035bc0
sub dword [esp + 0xc], 1
jne 0x10035b70
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10033606
add esp, 0x4c
ret
Function at 0x470e90
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e130b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004d1b80
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x470f12
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004cf45d
mov eax, dword [eax]
push 0x50d21c
push eax
call fcn.004c1524
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004d1e0b
test bl, bl
je 0x470f12
push 0x50d21c
lea ecx, [esp + 0xc]
call fcn.004d21e7
push 0x510d8c
lea ecx, [esp + 0xc]
call fcn.004d21e7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x470f4e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004d1e0b
jmp 0x471019
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x470fd2
lea edx, [esp + 0x7c]
push 0x510d88
push edx
call fcn.004c1524
add esp, 8
test eax, eax
je 0x470fd2
lea eax, [esp + 0x7c]
push 0x510d84
push eax
call fcn.004c1524
add esp, 8
test eax, eax
je 0x470fd2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x470f62
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004d1e0b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x471810
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x471872
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc