joyce8/EMBER2024-capa huggingface dataset:
Function at 0x521ab0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x521cc6
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x521b49
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x521ca7
cmp ecx, 0xe
jne 0x521bc2
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x521ca7
cmp ecx, 0xf
jne 0x521c38
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x521ca7
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.0045e080
jmp fcn.00521ab0
Function at 0x5238e0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x523a82
sub esp, 0x34
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x523977
cmp eax, 1
jne 0x523913
mov ecx, dword [esp + 0x38]
xor edx, edx
xor ebx, ebx
jmp 0x5239b1
mov ecx, dword [esp + 0x38]
movzx edx, byte [ecx]
test dl, dl
jne 0x523927
movzx ebx, byte [ecx + 1]
test bl, 0x80
je 0x523935
cmp dl, 0xff
jne 0x523971
movzx edx, byte [ecx + 1]
test dl, 0x80
je 0x523971
lea eax, [0x5633d5]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1d
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
lea edx, [0x59a990]
mov ebx, eax
mov eax, dword [esp + 0x3c]
jmp 0x5239b1
xor edx, edx
xor ebx, ebx
jmp 0x5239b1
lea eax, [0x55e4e2]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xd
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
lea edx, [0x59a990]
mov ebx, eax
mov eax, dword [esp + 0x3c]
test edx, edx
jne 0x523a6e
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.00523670
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x523a5a
cmp ebx, esi
setne al
mov ecx, esi
sar esi, 0x1f
cmp ebp, esi
setne dl
or edx, eax
test dl, dl
je 0x523a42
lea eax, [0x55f480]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x11
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x44], 0
lea ecx, [0x59a990]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x34
ret
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x34
ret
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
add esp, 0x34
ret
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
add esp, 0x34
ret
call fcn.0045e080
jmp fcn.005238e0
Function at 0x524060
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52424a
sub esp, 0x3c
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x4c]
xor eax, eax
xor ecx, ecx
xor esi, esi
jmp 0x524094
inc eax
mov edi, ecx
mov ecx, esi
mov esi, edi
mov dword [esp + 0x18], ebp
cmp edx, ebp
jle 0x5241f4
cmp eax, 5
je 0x5241a8
shl esi, 7
mov edi, ecx
shr ecx, 0x19
or ecx, esi
cmp edx, ebp
jbe 0x524240
movzx esi, byte [ebx + ebp]
test eax, eax
jne 0x5240ca
xchg esi, eax
cmp al, 0x80
xchg esi, eax
je 0x5240e7
xchg esi, eax
mov byte [esp + 0xf], al
xchg esi, eax
shl edi, 7
and esi, 0x7f
or esi, edi
inc ebp
movzx edi, byte [esp + 0xf]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x52408d
jmp 0x524133
lea eax, [0x56412d]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x59a9a4]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
cmp esi, 0x7fffffff
seta al
test ecx, ecx
sete cl
setg dl
and ecx, eax
or edx, ecx
test dl, dl
jne 0x524152
xor eax, eax
xor ecx, ecx
jmp 0x524194
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebp
lea eax, [0x562588]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1a
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408be0
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, eax
lea eax, [0x59a990]
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
add esp, 0x3c
ret
lea eax, [0x562588]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x1a
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x59a990]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
lea eax, [0x56282c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x1a
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x59a9a4]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
mov eax, ebp
mov ecx, edx
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00524060
Function at 0x5247f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5248f6
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
jmp 0x524816
inc edx
cmp eax, edx
jle 0x5248be
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x61]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x524815
lea ebp, [ebx - 0x41]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x524815
lea ebp, [ebx - 0x30]
xchg ebp, eax
cmp al, 9
xchg ebp, eax
jbe 0x524815
lea ebp, [ebx - 0x27]
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jbe 0x524815
lea ebp, [ebx - 0x2b]
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jbe 0x524815
cmp bl, 0x20
je 0x524815
cmp bl, 0x3a
je 0x524815
cmp bl, 0x3d
je 0x524815
cmp bl, 0x3f
je 0x524815
cmp bl, 0x2a
je 0x524815
cmp bl, 0x26
je 0x524815
lea eax, [0x566423]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [0x59a9a4]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d150
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x1c
ret
call fcn.0045e080
jmp fcn.005247f0
Function at 0x524900
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x524ade
sub esp, 0x38
mov ecx, dword [esp + 0x40]
test ecx, 1
jne 0x52498f
cmp ecx, 2
jl 0x52494f
mov edx, dword [esp + 0x3c]
movzx ebx, byte [ecx + edx - 1]
test bl, bl
jne 0x524953
lea eax, [ecx - 2]
cmp ecx, eax
jbe 0x524ad8
movzx ebx, byte [ecx + edx - 2]
test bl, bl
jne 0x524953
mov ecx, eax
jmp 0x524953
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], ecx
lea eax, [0x5475c0]
mov dword [esp], eax
mov dword [esp + 4], 0
shr ecx, 1
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
call fcn.00447590
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x30]
xor esi, esi
jmp 0x5249fe
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1d
lea ecx, [0x5634f7]
mov dword [eax], ecx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
add esp, 0x38
ret
mov word [eax + esi*2], bx
add edx, 0xfffffffe
mov edi, edx
neg edx
sar edx, 0x1f
and edx, 2
mov ebx, edi
mov edi, dword [esp + 0x34]
add edi, edx
mov edx, edi
mov edi, dword [esp + 0x30]
add edi, 0xfffffffe
mov esi, ebp
mov ebp, edi
mov edi, ebx
mov ebx, edx
mov edx, edi
test ebp, ebp
je 0x524a74
movzx edi, byte [ebx]
cmp ebp, 1
jbe 0x524acc
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
lea ebp, [esi + 1]
shl edi, 8
movzx ebx, byte [ebx + 1]
add ebx, edi
cmp ecx, ebp
jae 0x5249d2
mov dword [esp + 0x24], esi
mov word [esp + 0x22], bx
mov dword [esp + 0x2c], edx
lea edx, [0x5475c0]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.00447650
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [ecx + 1]
movzx ebx, word [esp + 0x22]
mov esi, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x2c]
jmp 0x5249d2
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.00468260
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.0044d4a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
add esp, 0x38
ret
mov eax, 1
mov ecx, ebp
call fcn.0045f4d0
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00524900
Function at 0x529980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x529b64
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045fb2c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.005293f0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f676
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x529a32
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x529b05
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x529b36
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x529a2b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x529a2b
test byte [eax], al
cmp ebp, 0x20
jb 0x529b28
mov eax, ebp
mov ecx, 0x20
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00529980
Function at 0x533470
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x28]
cmp eax, dword [ecx + 8]
jbe 0x533629
sub esp, 0xa8
lea edi, [esp + 0x48]
xor eax, eax
call fcn.0045f669
nop
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
lea ecx, [esp + 0x28]
mov dword [esp], ecx
mov ecx, dword [esp + 0xac]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xb0]
mov dword [esp + 8], ecx
call fcn.0044d2b0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
lea ebp, [esp + 0x48]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004dd590
lea ecx, [esp + 0x48]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.004dd790
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0xa4], edx
lea ebx, [0x547680]
mov dword [esp], ebx
shl ecx, 1
mov dword [esp + 0x20], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00447590
mov ecx, dword [esp + 0xc]
nop
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0xa4]
xor eax, eax
xor esi, esi
jmp 0x5335a3
mov byte [esi + ecx + 1], dl
inc eax
add esi, 2
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0xa4]
cmp eax, edx
jge 0x5335e5
movzx edi, byte [ebp + eax]
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
xchg edi, eax
shr al, 4
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
lea ebp, [0x55ee0b]
movzx edi, byte [ebp + edi]
cmp esi, ebx
jae 0x53361f
xchg edi, eax
mov byte [ecx + esi], al
xchg edi, eax
lea edi, [esi + 1]
movzx edx, byte [esp + 0x1f]
and edx, 0xf
movzx edx, byte [edx + ebp]
cmp ebx, edi
ja 0x533590
jmp 0x533616
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0044d150
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], ecx
add esp, 0xa8
ret
mov eax, edi
mov ecx, ebx
call fcn.0045f4d0
mov eax, esi
mov ecx, ebx
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00533470
Function at 0x536e80
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x536f73
sub esp, 0x1c
xor eax, eax
jmp 0x536ebe
mov dword [esp + 0x10], eax
mov eax, dword [0x6575c8]
mov dword [esp], eax
lea eax, [0x59a46c]
mov dword [esp + 4], eax
call fcn.004044d0
mov eax, dword [esp + 0x10]
inc eax
cmp dword [0x63c1ec], eax
jge 0x536e9d
mov eax, dword [0x6575c8]
mov dword [esp], eax
call fcn.00404c80
xor eax, eax
jmp 0x536ef9
mov dword [esp + 0xc], eax
mov eax, dword [0x6575cc]
mov dword [esp], eax
lea eax, [0x59a46c]
mov dword [esp + 4], eax
call fcn.004044d0
mov eax, dword [esp + 0xc]
inc eax
cmp dword [0x63c1e8], eax
jge 0x536ed8
mov eax, dword [0x6575cc]
mov dword [esp], eax
call fcn.00404c80
nop
movzx eax, byte [0x63c1c1]
test al, al
je 0x536f6f
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea eax, [0x5615f5]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004b5fe0
add esp, 0x1c
ret
call fcn.0045e080
jmp fcn.00536e80
Function at 0x401d70
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
bswap eax
bswap ecx
xor edx, edx
mov dword [ebp - 4], 0x20
push edi
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0xc]
add eax, esi
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x401d90
mov edx, dword [ebp + 8]
pop edi
bswap eax
bswap ecx
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401e00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x401ec5
push ebx
push esi
push edi
jmp 0x401e23
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x401e2e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x401e48
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x401e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219