joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e8600
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x1017e164]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1017e0f4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100e8613
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x100e8654
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1017e19c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x100e8686
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100e868a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x100e867b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x100e86a8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100e86ac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x100e869d
xor ecx, ecx
mov eax, 0x1017e104
xor ebx, ebx
mov bl, byte [ecx + 0x1017e1ac]
cmp byte [esp + ebx + 0x14], 0
je 0x100e86d7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1017e1c4]
cmp byte [esp + ebx + 0x14], 0
je 0x100e86ee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x1017e164
jl 0x100e86be
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100e8647
lea edx, [esp + 0x84]
push edx
call fcn.100e8730
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x101d8dd4
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ah, byte [esp]
jmp 0x101d8e14
mov dx, word [esp]
popal
call fcn.101d8dda
lea esp, [esp + 8]
jmp fcn.100084af

Function at 0x101d92b2
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ax, word [esp]
mov bl, bh
popal
call fcn.101d92db
lcall 0x318b, 0xcfd9a04
mov cl, 0x21
inc eax
mov bl, 0x65
xor byte [ebx], dh
sub al, byte [ebp - 0x78]
mov byte [esp], bl

Function at 0x101d9cbd
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 1], dh
lea esp, [esp + 4]
pushfd
mov byte [esp + 1], dl
mov word [esp + 1], sp
lea esp, [esp + 4]
jmp fcn.1003808f
mov dh, ah
xchg edx, edi
mov ax, 0xcf74
popal
push sp
push si
jmp 0x101d9bed
pushal
xchg esi, ebx
lea edi, [ebp*4]
jmp 0x101d9c14

Function at 0x101da123
Capabilities:
Packed with generic packer

Disassembly:
xchg ebp, edi
lea edi, [edi - 0xddeb]
mov edi, dword [esp + 2]
jmp 0x101da05c
lea ebp, [ebx*4]
mov dword [esp + 2], edi
mov edi, dword [esp]
mov edi, 0x17e4c06a
mov bp, sp
xchg bp, di
jmp 0x101da000
mov ebp, 0x302e6bff
mov ebp, dword [esp]
mov ebp, dword [esp]
call fcn.101da031
mov bp, word [esp + 2]
pop ebp
lea esp, [esp]
mov bp, si
lea ebp, [eax + ebx]
xchg dword [esp + 0xa], ebp
jmp 0x101da016
mov bh, byte [ecx + 0x2e]
ror byte [ebp - 0x24], cl
das
lea esp, ss:[esp + 8]
jmp fcn.1003808f
call fcn.101da16b
cmp esp, dword [ecx + 0x16a35031]
jnp 0x101da112
jo 0x101da149
loop 0x101da199
mov dword [0x572435da], eax
rdtsc
lea eax, [ebp*4]
bswap ebp
mov bh, byte [esp]
seto ch
popal
call fcn.101da0ff
lds esp, [ecx - 0x18]
scasd eax, dword es:[edi]
invalid
jle 0x101da185
xchg ebx, eax
test byte [0x5ac444e5], 0x3d
in eax, 0x44
les ebx, [edx + 0x3d]
int3
mov bl, 0xbc
out 0xff, al
jb 0x101da180
xchg dword [edx - 0x70], esi
div dword [edi - 0x19]
xor byte [ecx - 0x6a], 0xef
push 0x886899fe
add eax, 0x241c88b4
mov word [esp], ax
mov word [esp], dx
lea esp, [esp + 2]
push ebp
pushal
jmp 0x101da0d1

Function at 0x101daa24
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov bx, 0xbf7a
push dx
lea esp, [esp + 2]
jmp 0x101daa3f
popal
push di
lea esp, [esp]
call fcn.101dab48
mov cs, word [esi]
pushfd
sti
push ss
neg dword [edi]
xchg cx, ax
adc byte [ebx + 0x424648d], dl
jmp fcn.1001bc19

Function at 0x101dab48
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp fcn.1003808f
lea esp, [esp + 4]
pushal
mov al, byte [esp]
mov bl, cl
mov ch, byte [esp]
popal
jmp 0x101daa90
mov dword [esp], ebp
mov dword [esp], eax
lea esp, [esp + 2]
jmp 0x101daaec

Function at 0x101dacc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0xd3
xchg edi, edx
or dword ds:[eax + 0x66f18acb], ebp
mov edx, ebp
call fcn.101dad24
jp 0x101dacaa
jbe 0x101dacdd
loopne 0x101dad25
test byte [0x8c27d48d], bl
in al, dx
inc esi
inc esp
and al, 8

Function at 0x101db380
Capabilities:
Packed with generic packer

Disassembly:
pushal
rdtsc
mov ch, byte [esp]
popal
push esi
jmp 0x101db38e
mov dword [esp], ecx
lea esp, [esp + 4]
jmp fcn.100380ae
Function at 0x101db5cc
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 3]
jmp 0x101db5d6
mov byte [esp], dl
lea esp, [esp + 1]
mov edi, dword [esp + 0x18]
lea esp, [esp + 0x20]
pushal
xchg dl, al
jmp 0x101db61c
lea ecx, [ecx - 0xab26]
pushal
pop si
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
popal
jmp fcn.1003808f

Function at 0x101db643
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [esp + 0xc]
xchg edi, esi
call fcn.101db5f6
call 0x101db660
or byte [edx + 0x5e8a7f18], cl
stosb byte es:[edi], al
das
mov edi, 0xc2d129da
jge 0x101db6a3
fbld tbyte [esi]
push si
call 0x101db643
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp fcn.1001bc19
mov si, 0x390d
pushfd
push edi
bswap esi
jmp 0x101db638
sti

Function at 0x101db67e
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [esp + 0xc]
xchg edi, esi
call fcn.101db5f6
call 0x101db660
or byte [edx + 0x5e8a7f18], cl
stosb byte es:[edi], al
das
mov edi, 0xc2d129da
jge 0x101db6a3
fbld tbyte [esi]
push si
call 0x101db643
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp fcn.1001bc19
mov si, 0x390d
pushfd
push edi
bswap esi
jmp 0x101db638
sti

Function at 0x101dc0ce
Capabilities:
Packed with generic packer

Disassembly:
pushal
pop dword [esp + 0xa]
pop word [esp + 0x13]
call fcn.101dc0de
popal

Function at 0x101dd1db
Capabilities:
Packed with generic packer

Disassembly:
inc edx
std
int3
pushal
mov si, 0x81e3
jmp 0x101dd1fa
mov ebp, 0x172e5433
xchg si, dx
popal
call fcn.101dd24b
xor eax, 0xb44522ac
xor esp, dword [0xbb4829b9]
sbb byte ds:[edx + 0x4e9a6f08], bl
jnp 0x101dd1a5
push esp
and al, 0xb

Function at 0x101dd2ca
Capabilities:
Packed with generic packer

Disassembly:
popal
push dx
call fcn.101dd2aa
invalid
call fcn.101dd2e5
js 0x101dd2c2
popal
add bl, dh
push esi
jp 0x101dd2c9
pushal
pop es
bnd jae 0x101dd347
test dword [edi], esi
and al, 0xeb
dec ebp
dec edi
salc
inc ecx
ret

Function at 0x101dd901
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ebx - 0xf6c9]
mov ecx, dword [esp + 0x34]
lea esp, [esp + 0x38]
pushal
push dword [esp + 4]
jmp 0x101dd8d0
pushfd
pushfd
mov cl, dl
jmp 0x101dd8e6

Function at 0x101e0c14
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push word [esp + 1]
lea esp, [esp + 4]
lea esp, [esp + 2]
pushal
jmp 0x101e0c62
mov dword [esp], edx
lea esp, [esp + 3]
lea esp, [esp + 0xc]
jmp fcn.10009d05
mov al, 0x52
lea edx, [edx*4]
lea edx, [edx + esi]
popal
pushal
lea esp, [esp + 0x11]
jmp 0x101e0c3a

Function at 0x101e0c4a
Capabilities:
Packed with generic packer

Disassembly:
push esi
cmp dword [eax], ebx
jnp 0x101e0c42
int 0xeb
mov esp, 0x224648d
jmp fcn.10009d05
and al, 0xc
call fcn.101e0c8c
fistp word [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
mov ecx, 0x3552bc37
les esp, [ebx + 3]
mov dword [ecx], ebx
js 0x101e0beb
pop ebp
test al, 0xb0
push edx

Function at 0x101e19a2
Capabilities:
Packed with generic packer

Disassembly:
pop word [esp + 0x15]
push dword [esp + 0xe]
push dword [esp + 0xd]
jmp 0x101e19aa
lea esp, [esp + 4]
popal
pushal
jmp 0x101e198c
lea esp, [esp + 2]
lea esp, [esp + 0x24]
jmp fcn.1003808f
Function at 0x101e3c4c
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101e3c85
or eax, 0x9e630496
aaa
popfd
or ebx, dword [ebx + 0x35bc0dfe]
lodsb al, byte [esi]
and al, byte [ebp - 0x4c]
xor edi, dword [ecx]

Function at 0x101e4c46
Capabilities:
Packed with generic packer

Disassembly:
push ebp
lea esp, [esp + 4]
jmp fcn.1005e29c

Function at 0x101e5152
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
mov al, dh
jmp 0x101e51a0
setbe al
mov ah, byte [esp]
push ecx
not edx
mov ax, word [esp]
rdtsc
jmp 0x101e51b3
mov eax, dword [esp]
setl al
mov eax, ebx
push edx
mov dx, 0xc40
mov dx, 0xffb7
jmp 0x101e5189
mov dx, bx
rdtsc
lea ecx, [edx + ebx]
bswap ecx
bswap ecx
pop ecx
jmp 0x101e5268
lea eax, [edi + edi]
mov eax, dword [esp + 0x20]
lea esp, [esp + 0x28]
push edx
setg dh
jmp 0x101e522f
not al
pop edx
setnp al
pushal
mov dword [esp + 9], ebp
lea eax, [edx*4]
jmp 0x101e51ef
mov edx, dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.1005de12
lea edx, [ebx*4]
bswap edx
mov edx, dword [esp]
lea edx, [ecx + edi]
mov edx, dword [esp]
push eax
jmp 0x101e5219
mov dl, ah
xchg edx, eax
not dh
lea eax, [esi*4]
mov ax, 0xca54
mov edx, dword [esp]
jmp 0x101e5205

Function at 0x101e69c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esp + 4]
and al, 4
call 0x101e69c2
cmp dword [edx + 0x41f21f8], edx
add dword [eax], edx
in al, 0xc6
jno 0x101e6a2f
jae 0x101e69ac
jmp 0x101e69aa
call 0x9ae7791f
retf
in eax, dx
invalid

Function at 0x102ddade
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x102ddbc4
call fcn.1004e0de
push eax
mov dword [ebp - 4], 0x2e5600
call fcn.101db013
mov esi, dword [esp]
add dword [ebp - 4], eax
jmp 0x102ddda2
jmp 0x102dd6b8
lea esp, [esp + 4]
cmp dword [0x10184274], 1
jmp 0x102ddaf7
jne 0x102dd5dc
cmp dword [0x1018427c], 1
jmp 0x102ddd20
leave
ret 4
jne 0x102dd6de
call fcn.102ddc0a
xor dword [ebp + 0x18af5c35], esp
push esp
invalid
cmp dword [0x1018426c], 1
jmp 0x102ddbae
popal
bswap eax
xchg al, ah
mov eax, 0xffffffff
jmp 0x102ddbaa
jne 0x102dd60c
pushal
xchg dword [esp + 0x1a], esi
lea esp, [esp + 0x20]
jmp 0x102ddc72
xchg edx, ebx
jmp fcn.102dddde

Function at 0x102e8ba5
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp], edi
lea edi, [esi + 0xd7]
jmp 0x102e8c10
mov si, word [esp]
mov si, ax
lea esi, [edx + 0x7ce8]
mov si, word [esp]
lea esi, [eax + ecx]
mov esi, dword [esp + 0x12]
jmp 0x102e8c3f
mov di, 0x5108
mov si, word [esp + 2]
mov dword [esp], ecx
mov edi, dword [esp + 0xc]
mov esi, dword [esp]
mov si, 0x78eb
jmp 0x102e8bef
lea esp, [esp + 0x18]
jmp 0x102e8d1e
push 0x101e83d3
call fcn.101d855e
push 0x102e8c48
call fcn.101d855e
loope 0x102e8d54
cmp al, 0xb2
jl 0x102e8d50
jbe 0xa9f0ae5e
adc ah, ah
xchg esp, eax
pop es
scasb al, byte es:[edi]
pop ecx
daa
and bl, cl
invalid
ljmp 0xe810:0x2e8d9768
adc al, ch
add edi, eax
out dx, al
jmp ecx
Function at 0x102e8f41
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x101840b8], 1
jmp 0x102e907e
lea esp, [esp + 4]
push 0x1005052a
call fcn.101db9ca
sub esp, 0x16
jmp 0x102e9268
push esi
jmp 0x102e8e82
cmp dword [ebp - 4], eax
jmp 0x102e8f7e
ror eax, cl
lea esp, [esp + 4]
mov eax, dword [0x1018423c]
jmp 0x102e8f2b
jne fcn.102e8e2f
pushal
lea esp, [esp + 0x20]
pushal
call fcn.102e8f68
lea esp, [esp + 4]
mov dword [ebp - 0xc], eax
jmp 0x102e8ffd
lea esp, [esp + 4]
jne 0x102e8e4f
je 0x102e9937
sbb dh, byte [ebp + 0x64]
xchg edi, eax
dec cl
cmp dword [ebp - 0xc], 1
push ecx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x102e8fe7
popal
leave
ret 0x14
jne 0x102e8ea3
call fcn.102e90ac
pop ecx
and dword [eax + 0x18102ec3], esi
cmp al, 0x7d
sbb byte [ecx], ah
mov bl, al
adc ah, ah
mov esp, 0x8981168f
inc ebp
add al, 0x8d
xor al, 0x29
mov dh, byte [esp]
mov bx, 0x2abf
jmp 0x102e9079
lea esp, [esp + 2]
jmp 0x102e9283
lea esp, [esp + 0x14]
mov dword [ebp - 8], eax
push 3
jmp 0x102e931c
push dword [ebp - 8]
call fcn.102e9291
push dword [ebp - 8]
call fcn.102e90d2
stc
sub esp, 0x12
lea esp, [esp + 2]
lea esp, [esp + 0x10]
push 3
jmp 0x102e9362
push 0x10050509
call 0x101db8a9
mov dword [ebp - 8], eax
jmp 0x102e93c9

Function at 0x102fc8a4
Capabilities:
Packed with generic packer

Disassembly:
push eax
lea esp, [esp + 4]
mov ebx, dword [ebp - 0x20]
call 0x102fc8a4
mov eax, 0x24048f66
lea esp, [esp + 2]
jmp 0x102fc8de
lea esp, [esp + 4]
push eax
push ecx
jmp 0x102fc897
push dword [ebx]
call 0x101de099
call 0x102fc8c5
add esp, 8
sub esp, 0x12
push word [esp + 5]
lea esp, [esp + 0x14]
cmp eax, 0
jmp 0x102fc967
lea esp, [esp + 0x10]
mov ebx, dword [0x1018425c]
mov ecx, dword [ebx]
mov ax, di
jmp 0x102fc917
jne 0x1005469b
lea ecx, [ecx*4]
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x102fc92d

Function at 0x102fc8bd
Capabilities:
Packed with generic packer

Disassembly:
push eax
lea esp, [esp + 4]
mov ebx, dword [ebp - 0x20]
call 0x102fc8a4
mov eax, 0x24048f66
lea esp, [esp + 2]
jmp 0x102fc8de
lea esp, [esp + 4]
push eax
push ecx
jmp 0x102fc897
push dword [ebx]
call 0x101de099
call 0x102fc8c5
add esp, 8
sub esp, 0x12
push word [esp + 5]
lea esp, [esp + 0x14]
cmp eax, 0
jmp 0x102fc967
lea esp, [esp + 0x10]
mov ebx, dword [0x1018425c]
mov ecx, dword [ebx]
mov ax, di
jmp 0x102fc917
jne 0x1005469b
lea ecx, [ecx*4]
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x102fc92d

Function at 0x102fca83
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 3]
jmp 0x102fca5f
lea esp, [esp + 0x20]
add ebx, eax
sub esp, 6
mov al, byte [esp + 2]
lea esp, [esp + 3]
jmp 0x102fca1e
lea esp, [esp + 4]
pop ebx
shl eax, 2
pushal
jmp 0x102fca34
mov ebx, dword [ebx]
lea eax, [esi*4]
add ebx, 8
jmp 0x102fcac1
mov eax, dword [ebx]
sub esp, 0x1b
mov byte [esp + 0x13], ah
add esp, 9
lea esp, [esp + 2]
jmp 0x102fcaa2
lea ebx, [ebp*4]
jmp 0x102fca54
mov eax, 1
jmp fcn.10054640
lea esp, [esp + 0x10]
cmp dword [ebp - 0x14], eax
jg 0x1005466d
setp ah
jmp 0x102fca8c
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x28]
mov ah, 0x8a
bsf ax, dx
not ah
jmp 0x102fca6d
Function at 0x102fcd94
Capabilities:
Packed with generic packer

Disassembly:
mov ch, 0x80
lea ecx, [eax + edx]
jmp 0x102fcd7d
lea esp, [esp + 3]
lea esp, [esp + 4]
call fcn.101de28b
mov ch, byte [esp]
mov ecx, 0xe4878cd0
jmp 0x102fcd4d
mov dword [ebp - 0xc], eax
jmp 0x102fcdba
jmp 0x102fcd66
lea esp, [esp + 4]
pop ecx
jmp fcn.100546c7
pop eax
mov cx, bx
setg ch
push esi
jmp 0x102fcd96
Function at 0x417ac3
Capabilities:
Access peb ldr_data
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
clc
jae 0x417ac7
mov edi, 0x558c01eb
jmp fcn.00417aca

Function at 0x41b6fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x41b7d1
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41b7d1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x41b7d1
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x41b757
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41b7d1
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b79c
test dl, dl
je 0x41b798
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b79c
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b77c
xor eax, eax
jmp 0x41b7a1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41b7b3
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x41b7be
inc esi
cmp esi, ebp
jae 0x41b7d1
mov edx, dword [esp + 0x10]
jmp 0x41b772
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x41ba35
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x41ba40
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x41ba54
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x41ba58
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x41ba91
cmp dword [edi + ecx], 0x4550
jne 0x41ba91
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x41ba91
test byte [edi + ecx + 0x16], 2
je 0x41ba91
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x41ba96
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x41bad2
xor eax, eax
jmp 0x41bab5
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x41badb
inc edx
movzx eax, dx
cmp eax, edi
jl 0x41bab5
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x41bae1
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x41bb19
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x41bb27
add edx, 0x20
cmp eax, edx
jne 0x41bb38
test bx, bx
je 0x41bb6d
add esi, 2
add edi, 2
jmp 0x41bb09
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x41bb46
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x41bb54
add edx, 0x20
sub ecx, edx
je 0x41bb6d
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x41bb02
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x576630
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x60622b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005fabbd
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x5766b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005f84ad
mov eax, dword [eax]
push 0x7e3cd4
push eax
call fcn.005ea654
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005fae48
test bl, bl
je 0x5766b2
push 0x7e3cd4
lea ecx, [esp + 0xc]
call fcn.005fb1d8
push 0x7e3ce0
lea ecx, [esp + 0xc]
call fcn.005fb1d8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x5766ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005fae48
jmp 0x5767b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x576772
lea edx, [esp + 0x7c]
push 0x7e3cdc
push edx
call fcn.005ea654
add esp, 8
test eax, eax
je 0x576772
lea eax, [esp + 0x7c]
push 0x7e3cd8
push eax
call fcn.005ea654
add esp, 8
test eax, eax
je 0x576772
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x576702
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005fae48
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x576fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x577012
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x577020
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x6062ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x7f30c8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x577158
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x577086
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005fae48
xor eax, eax
jmp 0x5771cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005faf85
push esi
lea ecx, [esp + 0xc]
call fcn.005fb214
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x7e3d14
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x5771ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00576fb0
test eax, eax
jne 0x5771ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00576fb0
test eax, eax
jne 0x5771ad
lea eax, [esp + 0x14]
push 0x7e3cf0
push eax
call fcn.005eb7a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x57718c
lea ecx, [esp + 0x14]
push 0x7e3cec
push ecx
call fcn.005eb720
mov esi, eax
add esp, 8
test esi, esi
jne 0x57718c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x57718f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005faf35
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x57709e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005fae48
xor eax, eax
jmp 0x5771cf
mov byte [esi], 0
push 0x7e3ce8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005fae48
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4