joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15233d6
Capabilities:
Encode data using base64

Disassembly:
jmp 0xcc67c4
dec ebx
mov dword [ecx + edx*2 - 0xe8], edi
call fcn.00d418e1
mov dword [ebp - 4], ebx
jmp 0xcaf3c5
inc esp
movsx edx, si
sbb eax, 0x8b9e3e06
inc cx
add ebp, 0x8040de20
div byte [eax - 0x74be2f09]
int 0x45
cmovnp esp, edx
jne 0xcbaf0d
dec eax
mov dword [esp + ebx - 0x5398311a], 0x5ca44e3d
dec eax
lea ecx, [esp + ecx + 8]
pop esi
mul dx
jb 0x1530f13
ror dword [ebx + 0x29], 1
out dx, al
push ss
pushfd
mov cl, 0xc3
jg 0x1523477
insd dword es:[edi], dx
imul esi, dword [eax - 0x52], 0x5cf5bd9f
jae 0x1523447
mov cs, word [ecx + eax*2 - 0x5b400d2e]
jno 0x1523435
in al, dx
inc esp
movsx ebp, dx
inc di
mov dword [ecx + ebp*4 - 0x804c], edx
imul si, dx
dec ecx
lea ebp, [ebp + ebp - 0x2017]
inc ecx
mov eax, dword [ebp + ebp - 0x2013]
inc esp
mov esp, edi
inc ebp
mov esi, esp
inc cx
dec esp
inc ecx
xor eax, eax
dec eax
imul edi, edx
jo 0xd7a6f4
hlt
salc
mov al, byte [0xe8e29185]
push ds
pop edx
stosb byte es:[edi], al
stc
insd dword es:[edi], dx
stosd dword es:[edi], eax
adc dl, byte [eax]
fdiv dword [esi - 0x21]
add eax, 0xcbe4d3a3
fild dword [ebx]
sahf
mov byte [ecx - 9], ch
mov ecx, 0x18a2d8b8
out dx, al
jmp 0x99cfd8f
dec eax
mov edi, dword [ebx + ecx - 0x5398311a]
inc ecx
mov ecx, esp
dec ebp
lea ecx, [ecx + ebx - 0x53983122]
dec eax
and edx, 0xf9927d3f
jno 0xd41229
add byte [eax], al
add byte [edi + 0x65], al
je 0x1530f90
jb 0x1530fb0
imul ebp, dword [edi + 0x6e], 0x417845
jmp esi
fcom st(6)
movsb byte es:[edi], byte [esi]
jb 0x1531021
cmp esp, dword [eax + 0x5f]
inc ebx
daa
sbb eax, 0x4df44898
xchg dword [eax + eax*8], edi
popal
shr byte [ecx + 0x47], 1
and dh, byte [ebx - 0x73519ea9]
push ds
and byte [esi - 0x21], 0xe1
add eax, 0x834fe2a9
inc ebx
cmp byte [ebx], dl
add al, 0x28
aad 0x88
invalid
push edi
cmp dword [ebp + 8], eax
jbe 0xd10b8d
mov ebx, 5
sub ebx, esi
jmp 0xd55a46

Function at 0x15299b8
Capabilities:
Encode data using base64

Disassembly:
push 0xe805be17
dec dword [esp + 0xc]
dec eax
push 0x3522302d
call fcn.00ccb3f4
Function at 0x152ac85
Capabilities:
Encode data using base64

Disassembly:
inc ecx
sal ch, 0x21
inc edx
xor dword [esp - 0x688d00a2], edi
inc ecx
pop eax
dec eax
arpl di, di
push eax
inc edx
neg dword [esp + ebx*4 - 0x8028]
inc edx
add dword [esp + ebx - 0x2009], 0xef18da89
dec esp
adc edi, edi
inc ecx
div esp
dec eax
sal edx, 0xba
sbb edx, 0xcfa5b8a1
dec ebx
mov eax, dword [ecx + ebx*2 - 0x4014]
dec eax
lea ecx, [ebx*2 + 0x1ea47e95]
dec eax
sar edx, 0x14
inc esp
mov esp, dword [eax + edx*2 - 0x60a]
movzx edi, dl
dec edi
lea ecx, [ebx + ecx - 0x2006]
movzx eax, dx
inc edi
mov dword [ecx + ebx*4 - 0x8028], esp
xor bl, 0x1d
dec esi
mov dword [esp + ebx - 0x200a], edi
ret
ror al, 1
mov edi, dword [esp + edx*8 - 0x42fb69ac]
pop ebx
xor edi, 0xdda2a704
sbb al, 0xae
inc edx
sal dword [esp + edx - 0x55336fed], cl
inc edx
sbb dword [esp + edx - 0x55336fed], edi
dec edx
lea ebx, [esi*8 + 0x600530af]
xor al, 0x1a
inc esp
xor al, al
sar dword [esp + edx - 0x85f6d37], cl
dec eax
lea eax, [esp + eax + 8]
dec ecx
or ebp, 0x53a128a8
rol dword [esp + edx*4 - 0x217db4db], 0x75
inc cx
movzx edx, byte [edx + eax - 0x55336fef]
inc edx
sar byte [esp + edx - 0x55336fec], 0x86
inc ecx
push esi
dec edi
lea ecx, [ecx + edx - 0x55336ff1]
inc bx
mov dword [edx + ecx - 0x55336fef], edx
dec eax
bts esi, 0x17
neg esi
sete bl
inc ecx
pop ebp
inc ecx
pop esp
jno fcn.00cf78e6
inc ecx
mov esp, 0x688d00a2
inc ebp
movsx ebx, sp
dec edx
lea ebp, [ebp - 0x688d00a6]
inc ecx
mov edi, dword [esp + ebp - 0x688d00a2]
inc ecx
movsx edx, sp
dec edx
lea ebx, [0x7b3cf529]
inc ecx
xor edi, eax
neg edi
movsx eax, bl
cwde
ror ax, 0xc2
ror edi, 2
bswap edi
movsx esi, dl
not edi
dec eax
lea ebx, [eax + edx - 0x33722c68]
inc cx
ror ebx, 0x44
dec esi
lea ebp, [ebx*8 + 0x16b59e98]
inc ecx
lea edi, [esp + edi - 0x5b596b9a]
ror dword [ebp - 0x3ebe9934], cl
retf
xchg sp, ax
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
btr ebx, edx
inc ecx
push eax
jae 0xce850c
add byte [eax], al
push edx
inc ebx
jb 0x152addb
popal
je 0x152adde
dec ebx
jns 0x152adc2
js 0x152adc0
invalid

Function at 0x152af48
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
dec eax
mov dword [esp], 0x2995eb94
dec eax
inc edi
rol byte [esp + 3], 0xe1
push 0x15a73d27
call fcn.00ce4556
mov ebx, esp
xor ebx, esi
Function at 0x152c674
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x140bf339
not eax
shr ecx, cl
mov dword [edi + ecx*2 - 0x14], eax
btc ecx, 0x1d
lea ecx, [ecx + ecx*2 + 0x5034b2af]
mov ecx, dword [ebp]
mov edx, 0x6f80ea2b
lea ebp, [edx + ebp - 0x6f80ea27]
ror edx, 0x21
lea edx, [edx - 0x5c4876c3]
xor ecx, ebx
inc ecx
movsx eax, dl
shr eax, 0xbf
dec eax
rol ecx, 1
call fcn.00cbca89
xor esp, esp
pop es
in al, 0x29
mov esi, ss
or cl, byte [ecx]
push 0xc604
sub cl, byte [ecx]
push 0x7644
retf 0x6609
test edx, edx
push 0x752c851d
lea esp, [esp + 0x10]
je 0xd0ec7d
jmp 0xccb4b7
add edi, 4
xor eax, eax
push 0xc32ce3a8
shl dword [esp], 0x5e
jae 0xd791a2
mov ecx, 0xe625b3a4
mov dx, word [edi]
lea eax, [ecx*8 - 0x72617275]
inc ecx
push ecx
mov cx, word [edi + 2]
btr eax, 0xad
add eax, dword [esp]
add dx, cx
mov cx, dx
mov ax, word [edi + 4]
or cx, ax
push 0xb28d3707
not cx
ror byte [esp], 1
mov word [edi + 4], cx
mov edx, dword [esp + 4]
adc edi, 3
mov ecx, dword [ebp]
dec dword [esp + 4]
sub ebp, 0xfffffffc
movsx eax, dx
xor ecx, ebx
rol eax, 0xeb
sbb edx, 0x31a3a60b
inc ecx
cbw
bts edx, 0x31
call fcn.01549f12
not dl
mov word [edi], dx
mov edx, dword [ebp]
add ebp, 4
cwde
xor edx, ebx
mov ecx, eax
neg edx
cwde
dec word [esp + 1]
neg word [esp + 2]
not edx
dec cl
adc dword [esp], ecx
neg edx
call fcn.01556080
Function at 0x1531b34
Capabilities:
Execute syscall

Disassembly:
inc ecx
add bl, 0xa9
dec cl
inc ebp
movzx edx, bl
lea edi, [ebx + edi - 0x7b200350]
inc ebp
imul ebx, ebx
inc ecx
mov edx, ebx
xor edi, 0xda144108
not edi
call fcn.01540372
mov eax, 0x16173192
add eax, eax
mov ecx, dword [ebp + eax*2 - 0x585cc648]
lea eax, [eax + eax*8 + 0x71bb2835]
push eax
xor ecx, ebx
lea edx, [eax + eax*4 - 0x4f55b9ef]
ror dl, 0xe3
jb 0xd78789
neg ecx
mov word [esp + 2], 0x980c
neg eax
not ecx
bswap eax
dec byte [esp]
xor ecx, 0xbf8d363e
mul dl
xchg word [esp + 1], ax
call fcn.00d15354
inc ebp
xor esi, eax
xadd dword [esp + ecx*4 - 0x131fd7b8], edx
neg word [esp + ecx - 0x4c7f5ea]
dec ecx
shl ebx, cl
inc ecx
rol esi, 3
dec esp
or dword [esp + ecx - 0x4c7f5ee], ebx
inc ecx
inc esi
inc ecx
push ebp
dec ecx
inc esp
dec eax
cwde
inc ecx
rol esi, 1
dec esi
lea edx, [0x9c9f2489]
inc ecx
inc ah
cwd
inc ebp
lea esi, [esi + ecx*4 - 0x20412e65]
dec eax
dec dword [esp + ecx*4 - 0x131fd7b3]
dec esp
mov dword [esp + ecx*2 - 0x98febd4], eax
inc cx
shr edx, cl
dec eax
lea ebx, [ecx + 0x1887b412]
dec ecx
div ebx
inc esp
xor dword [esp + ecx*2 - 0x98febd4], esi
neg dword [esp + ecx - 0x4c7f5ed]
inc ecx
mul bl
dec edx
dec esp
mov eax, dword [esp + ecx*8 - 0x263faf68]
dec eax
mov dword [esp + ecx*2 - 0x98febd4], 0x642c2e92
dec ebp
arpl si, si
dec ebp
adc edi, esi
inc cx
dec esp
shr cx, 0x86
inc sp
xchg dword [esp + ecx - 0x4c703d1], esp
dec esp
mov dword [esp + ecx - 0x4c703d7], edi
ret 8
xor dword [esp + esi*2 - 0x13e], ecx
not al
dec esp
mov eax, dword [esp + esi*2 - 0x13e]
dec eax
mov dword [esp + esi - 0xab], ebx
dec eax
arpl cx, cx
add bl, 0x20
dec eax
mov dword [esp + esi - 0xa3], 0x6c38d888
dec esp
add edi, ecx
ror dx, 0x64
dec esp
mov dword [esp + esi - 0x93], esi
cdq
inc si
mov ebx, dword [esi + ecx - 0xab]
imul dword [esp + esi*8 - 0x53c]
inc bp
mov ebp, dword [ecx + esi*2 - 0x154]
inc ecx
mov ecx, edx
dec ebp
lea ecx, [ecx + esi*2 - 0x154]
inc cx
not ebx
and bl, 0x93
dec byte [esp + esi*2 - 0x156]
inc sp
sbb esp, dword [esp + esi - 0x8e]
inc cx
not ebp
dec eax
cdq
inc ecx
div dh
dec eax
and edx, 0xd5badb32
inc bp
or ebx, ebp
xadd ax, bx
push eax
dec esp
adc esp, esi
inc bp
mov dword [ecx + esi*4 - 0x2ac], ebx
jbe 0xcd2e5b
dec esp
mov dword [esp + esi - 0xab], edi
ret 0x20

Function at 0x1531dfa
Capabilities:
Encode data using base64

Disassembly:
inc ecx
inc ebp
mov edi, 0x5b8e332f
inc ecx
ror ebp, 3
inc ecx
bswap ebp
dec edx
lea eax, [ebx + edx + 0x3a084694]
dec esi
mov dword [esp + ebx*8 - 0x758], eax
inc esp
mov eax, edi
inc ecx
sub ebx, 0x5ba7921f
inc esi
xor dword [esp + esi - 0xeb], ebp
dec eax
sub ecx, 0xb1a40c10
call fcn.0152a600
Function at 0x15386fb
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ecx + ebp - 0x2460]
sbb eax, eax
xor edx, ebx
push eax
sal byte [esp + ecx - 0x2465], cl
xor edx, 0x8ba89b20
ror eax, cl
shr cl, 0x44
dec edx
xchg dword [esp + ecx*2 - 0x480c], eax
sar dword [esp + ecx - 0x2406], 0x23
xor edx, 0x4b864886
ror edx, 2
bswap edx
xchg ecx, eax
xor ebx, edx
sub cl, cl
adc esi, edx
inc ecx
xor dword [esp + ecx*4 - 4], esi
ret
xor edx, edx
adc cl, dh
mov word [edi + ecx*2 - 0x4866], ax
neg dx
lea edi, [edi + ecx*2 - 0x4866]
and dx, 0x6a18
dec cx
adc edx, dword [ebp + ecx - 0x2431]
movsx eax, cl
xadd ecx, eax
jp 0xd7a6ae
mov dword [esp + edx*2 - 0x68cc40d4], edx
push edx
dec al
movsx ecx, word [esp + edx*2 - 0x68cc40cc]
sub dword [esp + edx - 0x34662064], edx
not al
bts ecx, edx
ror al, 1
shr word [esp + edx - 0x3466206b], cl
xor al, 7
add al, 0x82
neg dx
xor bl, al
pop ecx
call fcn.014f318b
ror dword [ebx + 0x29], 1
in al, dx
sbb al, byte [ecx + 0x7a68f6b2]
jl 0x1538780
jl 0x15386ca
mov ch, 0xac
wait
btc eax, 0x20
bswap eax
xor cl, 0xb1
or eax, 0xaf97a320
add ax, ax
shl al, 0xe1
not cl
or ax, 0xb3c
neg cl
lea eax, [eax + eax*4 - 0xfab6de]
inc cl
xor cl, 0x98
call fcn.00cc1d7a
dec esp
mov dword [esp + 8], eax
inc ebp
movzx esi, dl
inc edx
xor dword [esp + esi*4 - 0x260], edx
movsx ebx, si
dec eax
dec ebx
dec dword [edi]
mov edi, 0xcbff48de
inc ecx
setg ch
dec esi
mov eax, dword [esp + esi - 0x92]
dec eax
arpl dx, dx
pop eax
inc sp
xchg esi, esi
shr esi, 0x93
dec esp
adc edi, edx
dec eax
mov dword [esp + esi - 0xab3], ecx
dec eax
lea ebp, [esi + ebp - 0xab4]
sar dword [esp + esi - 0xab2], 0x4d
dec eax
not eax
movzx edx, byte [esi + ebp - 0xab3]
inc esp
xchg byte [esp + esi - 0xab2], dh
neg byte [esp + esi*2 - 0x1564]
inc sp
xadd dword [esp + esi*2 - 0x1565], esi
inc ecx
xor dl, al
rol byte [esp + esi - 0xaae], 0xc3
inc esp
movsx ebx, si
rol dl, 1
inc ecx
btc ebp, 0xb4
dec ecx
sbb esi, 0xd8add628
xor dl, 0xa7
sal word [esp + esi - 0xab2], 0xc6
inc esp
cmove ebp, eax
neg dl
inc ecx
add dl, ch
btr cx, bx
rol dl, 1
shl byte [esp + esi*8 - 0x5593], 0x46
inc esp
adc dword [esp + esi - 0xab2], ebp
inc esp
xor al, dl
dec ecx
ror edx, cl
xchg byte [esp + esi - 0xab3], ch
inc esp
and dh, byte [esp + esi*2 - 0x1560]
dec eax
lea edx, [esp + edx + 8]
call fcn.00d7f0f7

Function at 0x153f413
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], ecx
shr cl, 0x24
sbb dl, 0xbb
neg ecx
adc cl, ch
bts cx, cx
ror dl, 1
sal cx, 0xc4
shr cx, 0xe4
dec word [esp + ecx - 0x3fffffff]
sbb dl, 0x3f
imul ecx, ecx
not dl
adc dl, 0x23
call fcn.00d0a091
shl dx, 0x41
lea ecx, [eax + ecx + 0x320dd514]
bswap ecx
pop eax
xor word [esp + edx - 0x4ec080ee], 0xaeba
shr dl, 0x43
inc ecx
xor dx, dx
add word [esp + edx - 0x4ebfffff], dx
xor ebx, ecx
mov eax, dword [esp + edx - 0x4ebffffe]
xor eax, edx
adc esi, ecx
mov eax, dword [edi + edx - 0x4ebffffc]
lea edi, [edi + edx - 0x4ebffff8]
movzx edx, byte [ebp + edx - 0x4ebffffc]
sub ebp, 0xfffffffb
mov ecx, dword [esp + 4]
sal ecx, 0x7e
xor dl, bl
jmp 0x150a8e8
Function at 0x154c8be
Capabilities:
Encode data using xor

Disassembly:
neg eax
inc dx
sub ecx, 0xe9c4526
sbb eax, 0xb58a6807
push edx
btr edx, edx
sal dx, 0x4c
neg eax
neg dl
mov edx, dword [esp + 4]
adc edx, 0xfffb3995
jmp edx
xor eax, ebx
or edx, dword [esp + edx*2 - 0x743583e]
or edx, 0x7a9ea83c
jns 0xd408e0
Function at 0x15532ad
Capabilities:
Encode data using xor

Disassembly:
push 0xa3b19428
xor eax, eax
jmp 0x15588f0
push edi
mov edi, 0x60225c33
shl edi, 0x42
lea edi, [edi + edi*4 - 0x2ffe0e53]
movzx edi, byte [ecx + edi - 0x52b125a9]
xor edi, eax
and edi, 0xff
push 0x7f81d387
mov edi, dword [edi*4 + 0xcd3a48]
shr eax, 8
sub dword [esp], 0x51a406b9
xor eax, edi
call fcn.00d73f89
mov ecx, 0x20b51038
movsx edx, cx
not eax
and ecx, 0x503f8198
mov dword [edi + ecx*2 - 0x6a0030], eax
btr cx, dx
imul ecx, ecx
mov eax, dword [ecx + ebp - 0x9f00240]
btc dx, cx
sub edx, edx
lea ebp, [ebp + ecx - 0x9f0023c]
bt cx, cx
xor eax, ebx
add cl, ch
neg edx
inc eax
rol eax, 1
bswap edx
neg eax
and edx, ecx
sbb eax, 0xd68e5096
or ecx, 0x36129703
inc cx
rol eax, 3
imul edx, ecx
sal dl, 0xe1
imul edx, ecx
neg eax
xor ecx, edx
call fcn.00d760ad
outsd dx, dword [esi]
insb byte es:[edi], dx
xor esi, dword gs:[edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x7f], cl
in eax, dx
add dword [eax], eax
add byte [eax], al
mov eax, 0x8c0638ab
inc esp
movzx edx, byte [ebp]
movzx ebx, al
inc esp
movzx ebx, al
inc ebp
xor dl, al
inc ecx
dec dl
movsx edi, bx
inc ecx
neg dl
shr di, 0xa4
inc ecx
inc dl
cbw
call fcn.00ce9f62
and eax, 0x7ef9ac57
cld
in eax, 0x13
push ebp
push ds
rol ah, cl
in eax, 0x13
push ebp
jbe 0xd47865
xchg esp, eax
in eax, 0x13
push ebp
xchg esi, eax
rcl bh, cl
sal eax, cl
mov bl, 0x59
add al, 0x49
pop edi
xlatb
rcl bh, 0x32
sbb dword [edi], edi
inc edi
mov ebp, dword [edx + 0x6f]
xchg ebx, eax
daa
push eax
dec esp
jmp 0x57e40cf9
jmp 0xcad8dc
jmp 0xca9bbb
not byte [esp + 2]
ror dword [esp], 0x9c
test edx, edx
lea esp, [esp + 8]
je 0xd4780c
jmp 0x14a027f

Function at 0x1555f74
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not esp
inc ecx
mov esi, 0x3c127309
inc ecx
push esi
dec ebx
lea edx, [esi + esi*4 + 0x479ed6a9]
inc edi
mov dword [ecx + esi*2 - 0x7824e612], esp
inc ecx
neg dh
inc edx
shl dword [esp + esi*2 - 0x7824e7ed], 0xd6
inc esi
movzx edx, word [esp + esi*2 - 0x7824e7eb]
dec esi
mov dword [esp + esi*2 - 0x7824e7ee], edi
ret
inc ecx
movsx esi, dh
dec esp
lea esi, [0x98d2f]
mov esi, 0xc501d42f
sub esi, 0x5289b79c
dec eax
lea esi, [esi + esi*2 - 0x3976d7db]
movzx esi, byte [eax]
call fcn.00cda3fd
dec eax
mov dword [esp], 0x3a1fba36
inc ebp
xor esp, esp
dec eax
test ebx, ebx
dec eax
lea esp, [esp + 0x10]
je 0xcbdf61
inc ecx
mov esi, 0x3a3fec86
jmp 0xcc8e86
Function at 0x46bb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0x46b0ac]
push esi
push edi
test eax, eax
jne 0x46bbcd
mov esi, 0x46b284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0x46bb8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x46bb7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0x46b29c
mov dword [edx], eax
jl 0x46bb6d
mov ecx, dword [0x46b0ac]
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
push 0x46b2ac
push ecx
mov dword [0x46b0a4], eax
call fcn.0046bd80
add esp, 0xc
mov dword [0x46b0a8], eax
mov dword [ebp - 4], 0
mov esi, 0x46b284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0x46bc16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0x46bc16
cmp al, 0x5a
jg 0x46bc02
cmp al, 0x41
jl 0x46bc02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0x46bc08
xor al, 0x55
cmp cl, al
jne 0x46bc16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0x46bbe1
cmp byte [edx], 0
je 0x46bc36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0x46b29c
mov dword [ebp - 4], edx
jl 0x46bbd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0x46b280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret
Function at 0x404475
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x404496
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40448d
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x404485
mov eax, ebx
leave
ret

Function at 0x4044bc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40451b
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x404548
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x404537
xor ecx, eax
xor edx, ebx
dec edi
jne 0x404528
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40456e
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40450f
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x404dae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.0040443b
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x404f8d
push dword [ebp - 4]
call fcn.0040441f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404e7e
jmp 0x404f8d
push dword [ebp - 4]
call fcn.0040441f
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x404ed2
lea eax, [ebp - 4]
push eax
call fcn.00404d94
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.00404646
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404ed2
mov eax, 1
jmp 0x404ed4
xor eax, eax
test eax, eax
je 0x404f82
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x404f7a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.00404bb1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x404f69
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.00404d6d
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x404f1c
add esp, 0xc
jmp 0x404f8d
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x404e57
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x404fae
mov esp, ebp
pop ebp
ret 8
Function at 0x439360
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cec7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004c2bf0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4393e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004c012d
mov eax, dword [eax]
push 0x547d38
push eax
call fcn.004b1114
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004c2e7b
test bl, bl
je 0x4393e2
push 0x547d38
lea ecx, [esp + 0xc]
call fcn.004c320b
push 0x547d44
lea ecx, [esp + 0xc]
call fcn.004c320b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43941e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004c2e7b
jmp 0x4394e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4394a2
lea edx, [esp + 0x7c]
push 0x547d40
push edx
call fcn.004b1114
add esp, 8
test eax, eax
je 0x4394a2
lea eax, [esp + 0x7c]
push 0x547d3c
push eax
call fcn.004b1114
add esp, 8
test eax, eax
je 0x4394a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x439432
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004c2e7b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x439d00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x439d62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc