joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4825
Capabilities:
Encode data using xor

Disassembly:
add byte [0x3d826155], bh
push esp
popal
cmp byte [ebx + edx*2], 0x60
add byte [ebx], bh
push ebx
pushal
cmp dword [ebx], 0x3f825f52
pop ecx
add dword [di], edi
push edi
cmp word [ebx - 0x7f], dx
cmp byte [edx + 0x62], dl
xor dword [edi], 0x37816252
push edx
popal
xor byte [edi], 0x51
popal
xor dword [edi], 0x51
pushal
sub dword [ecx], 0x2a006c57
push edi
push 0xffffffffffffff81
sub ebx, dword [eax + 0x69]
add byte [eax], 0
add byte [ecx + edi + 0x39015951], al
push eax
pop ecx
cmp byte [eax + 0x59], dl
test byte [eax], bh
push eax
pop eax
xor dword [edi], 0x37005c4f
dec esi
pop esp
xor dword [esi], 0x40825c4e
push esp
pop ebx
add dword [eax + 0x53], 0x5b
add byte [ecx - 0x7da7b2c9], al
aaa
dec esi
pop ecx
or byte [eax], bh
dec edi
pop ecx
cmp dword [eax + 0x5a], edx
cmp dl, byte [eax + 0x5b]
cmp dl, byte [ecx + 0x5b]
cmp edx, dword [ecx + 0x5b]
cmp edx, dword [ecx + 0x5c]
cmp edx, dword [edx + 0x5c]
cmp al, 0x52
pop esp
cmp edx, dword [edx + 0x5c]
cmp dword [0x6959], 0x37820000
dec ebp
pop eax
xor byte [edi], 0x4e
pop ecx
or byte [eax], bh
dec edi
pop ecx
cmp dword [eax + 0x5a], edx
cmp dl, byte [eax + 0x5b]
cmp dl, byte [ecx + 0x5b]
cmp edx, dword [ecx + 0x5b]
cmp edx, dword [ecx + 0x5c]
cmp edx, dword [edx + 0x5c]
cmp al, 0x52
pop esp
cmp edx, dword [edx + 0x5c]
cmp dword [0x6959], 0x3c810000
push edx
pop ebp
or dword [ecx + 0x5d], eax
outsd dx, dword [esi]
dec esi
jge 0x4e4896
pop esp
popfd
fisub dword [ecx - 0x59]
Function at 0x4e848f
Capabilities:
Encode data using xor

Disassembly:
sbb dword [edi], 0x27
sub al, byte [ecx]
pop ds
sub byte [edx], ch
pop ds
sub byte [ebx], ch
and dword [eax], 0x28
sub eax, dword [eax + 0x20002c29]
sub dword [0x2d2a2081], ebp
and dword [ecx], 0x21812d2a
sub ch, byte [esi]
and dword [ecx], 0x21822e2b
sub ebp, dword [edi]
and dword [ecx], 0x21812f2c
sub al, 0x30
and dword [edx], 0x2284302c
sub eax, 0x2e228331
xor al, byte [eax]
and ch, byte [esi]
xor eax, dword [edx - 0x7eccd0dd]
and ebp, dword [edi]
xor al, 0x81
and esi, dword [eax]
xor al, 0x82
and esi, dword [eax]
xor eax, 0x35312300
and dword [ebx], 0x24823631
xor dword [esi], esi
xor dword [0x36312381], esi
and byte [ecx + esi], 0x36
test byte [ecx], bl
pop ds
and dword [ecx + 0x66b5e41], eax
inc edx
pop edi
imul eax, dword [edx + 0x5f], 0x6c
inc edx
pushal
insb byte es:[edi], dx
inc ebx
pushal
insd dword es:[edi], dx
inc ebx
popal
insd dword es:[edi], dx
inc ebx
popal
outsb dx, byte [esi]
inc ebx
bound ebp, qword [esi - 0x7f]
inc esp
bound ebp, qword [esi - 0x7f]
xor eax, 0x35814d43
inc ebx
dec esp
cmp dword [ecx - 0x4e], 0xb17901d5
aam 0x78
mov cl, 0xd4
xor dword [edi - 0x50], 0xaf7602d3
sal dword [esi - 0x52], cl
sal byte [ebp - 0x52], cl
rol byte [ecx + 0x15d1ad74], cl
jae 0x4e84e4
sal byte [edx - 0x55], 1
sal byte [edx - 0x55], 1
iretd
Function at 0x4e9ead
Capabilities:
Parse pe header

Disassembly:
mov edi, 0xb96711cf
leave
pop edi
lodsb al, byte [esi]
mov ebp, 0x4faf9e56
xchg ebx, eax
movsd dword es:[edi], dword [esi]
dec ecx
mov bl, byte [ebx + 0x3f938244]
jp 0x4e9e51
cmp dh, byte [ebx - 0x7b]
Function at 0x5002e9
Capabilities:
Authenticate hmac

Disassembly:
mul byte [ecx - 0x55]
pushal
test eax, 0xf0a85ff1
sbb dword [edi - 0x59], 0xffffffef
cmp dword [eax + ebx*2], 0x7b4e0169
mov byte [0x81db9f5f], al
stosb byte es:[edi], al
out dx, al
add byte [ebp - 0x55], ah
out dx, al
mov dword [ebp - 0x55], esp
out dx, eax
sub dword [0x2e8a453d], 0x3d
inc ebp
sub dword [esi], 0x5281453e
mov byte [edx - 0x1a5da200], bh
and dword [ecx - 0x58], 0xa86100ee
out dx, eax
and dword [edx - 0x57], 0xffffffef
add byte [ebx - 0x56], ah
out dx, eax
and dword [ebx - 0x56], 0xfffffff0
and dword [ebx + ebp*4 - 0x10], 0x4a423000
xor dword [ecx], 0x30004b42
inc edx
dec edx
sub dword [0x2e8a453d], 0x3d
inc ebp
sub dword [esi], 0x2d83453e
cmp eax, 0x3d2e8945
inc ebp
sub byte [esi], 0x3e
inc ebp
xor dword [0x36075449], 0x4e37564c
pop eax
cmp byte [edi + 0x59], cl
cmp dword [ecx + 0x5b], edx
cmp dl, byte [edx + 0x5c]
cmp al, 0x54
pop esi
cmp al, 0x55
pop edi
cmp eax, 0x3d815f55
push esi
pushal
add bh, byte [0x553d5f56]
pop edi
cmp al, 0x54
pop esi
cmp dword [ebx + edx*2], 0x3e2e865d
inc esi
test byte [esi], ch
aas
inc esi
test byte [esi], ch
aas
inc edi
xchg ebp, eax
add byte [eax], al
add byte [ebx - 0x7ebcc2d3], al
aas
pushal
outsb dx, byte [esi]
add byte [esi], bh
pop edi
insd dword es:[edi], dx
cmp dword [esi + ebx*2], 0x6c
add byte [esi], cl
add byte [ecx + ebp*2 + 0x67], cl
push 0x696e4174
insd dword es:[edi], dx
pop edi
inc edx
inc ecx
push ebx
Function at 0x2b73fd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x2b74004
mov edx, dword [eax + 8]
test edx, edx
jne 0x2b73ff3
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x2b74000
add edx, esi
cmp ebx, edx
jb 0x2b74011
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x2b73fe9
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x2b7404c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x2b74066
xor eax, eax
jmp 0x2b741e6
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x2b7407a
xor eax, eax
jmp 0x2b741e6
cmp word [ebx + 0x14], 0xe0
jne 0x2b7408a
cmp word [ebx + 0x18], 0x10b
je 0x2b74091
xor eax, eax
jmp 0x2b741e6
mov dword [0x454500], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.02b73fd0
add esp, 8
test eax, eax
jne 0x2b740bc
xor eax, eax
jmp 0x2b741e6
mov edx, dword [0x454500]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.02b74018
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x2b740ee
push 0x10
push 0
push 0x4509a5
push 0
call 0x2b7fa16
xor eax, eax
jmp 0x2b741e6
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x2b741b8
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x2b741aa
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x2b741a5
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x2b7419c
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x2b74191
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x2b74191
test cl, cl
je 0x2b74186
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x2b74191
add eax, 2
add edx, 2
test cl, cl
jne 0x2b7416a
jne 0x2b74191
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x2b741e6
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x2b74150
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x2b74128
jmp 0x2b741e4
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x2b741dc
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x2b741d8
cmp dword [eax], 0
je 0x2b741d8
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x2b741e6
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x2b741bf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2b743b4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x2b743cd
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2b746fc
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b747af
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b747af
mov eax, 0x403f68
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b747af
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x2b747af
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x2b74777
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2b747cc
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b74882
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b74882
mov eax, 0x403dcc
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x2b74882
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x2b74882
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x2b7484a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2b74aac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x2b74ac4
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x2b74abb
pop ebp
ret

Function at 0x2b7dfb4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x2b7e023
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x2b7dfeb
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1444298
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0x34]
jne 0x146875a
btr cx, 8
cmp dl, 0xfa
xchg ecx, esi
mov ecx, edi
stc
sub ecx, ebx
shld si, bx, cl
mov esi, esp
clc
pushfd
push dword [esp]
sub edi, 4
bt cx, sp
cmc
clc
clc
push dword [edi]
pop dword [esp + 4]
clc
pushal
stc
cmp edi, ebx
pushal
mov byte [esp + 0xc], bl
lea esp, [esp + 0x44]
ja 0xed1e70
not al
sub ebx, edi
dec di
add ebx, esp
rol di, 2
bt bx, sp
shl al, cl
mov edi, ebx
push edx
bt si, di
mov al, 0x2e
bt bp, 0xc
bt bp, 8
repne scasb al, byte es:[edi]
or dl, dh
scasb al, byte es:[edi]
call fcn.00f48543
dec edx
xor ch, byte [esp + edx + 0x28]
adc al, 0x28
push esi
dec esi
ja 0xed1ebe
mov dl, 0xa9
mov bh, 0x8f
salc
push edi
dec edx
cdq
idiv ah
and eax, 0x41520fe4
test eax, 0xeaa1f41c
daa
mov ebx, 0x2311fd00
mov eax, dword [0xff94993a]
mov word [ebx - 0x67], es
mov esp, 0x60d9ccc1
mov ebp, edi
adc dword [ebx], esp
or dh, byte [ecx + edi*2 - 0x5f007d13]
mov ah, 0x63
aas
cmp dh, byte [ebp + 0x19]
popfd
jne 0xed1ec9
push esp
pop ebp
xor dword [ebx], edi
aad 0xa2
cmp eax, 0xffc4fe02
test bl, bl
and bh, byte [edi + 0x60]
sbb dword [ebp + 0x217b149e], eax
out dx, eax
invalid
stc
pushal
repne scasb al, byte es:[edi]
push dword [esp + 4]
push dword [esp + 0xc]
jmp 0xed1e50
stc
xor al, al
jmp 0x14c6857
jmp 0xed5381

Function at 0x1469302
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], cl
test eax, eax
pushal
push 0xed7fbfe7
lea esp, [esp + 0x2c]
je 0x146875a
bts dx, cx
mov esi, dword [eax + 0x3c]
stc
btc dx, 0xd
add esi, eax
add dl, 0x5a
btr dx, 4
mov edx, dword [esi + 0x78]
pushal
test edx, edx
pushal
push 0x262e582f
push dword [esp + 0x14]
jmp 0xedb2dc
Function at 0x41c850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x41c903
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x42b8e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x42b92d
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x42b933
add eax, 4
pop esi
dec esi
push esi
jne 0x42b915
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x42f057
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x42f078
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x42f06f
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x42f067
mov eax, ebx
leave
ret

Function at 0x42f09e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x42f0fd
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x42f12a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x42f119
xor ecx, eax
xor edx, ebx
dec edi
jne 0x42f10a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x42f150
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x42f0f1
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x46ec90
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x52a65b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0051e3e2
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x46ed12
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0051b321
mov eax, dword [eax]
push 0x75cd7c
push eax
call fcn.005012c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0051e66d
test bl, bl
je 0x46ed12
push 0x75cd7c
lea ecx, [esp + 0xc]
call fcn.0051e9fd
push 0x75cd88
lea ecx, [esp + 0xc]
call fcn.0051e9fd
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x46ed4e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0051e66d
jmp 0x46ee19
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x46edd2
lea edx, [esp + 0x7c]
push 0x75cd84
push edx
call fcn.005012c4
add esp, 8
test eax, eax
je 0x46edd2
lea eax, [esp + 0x7c]
push 0x75cd80
push eax
call fcn.005012c4
add esp, 8
test eax, eax
je 0x46edd2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x46ed62
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0051e66d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x470080
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4700e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4700f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x52a7bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x776d64]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x470228
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x470156
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0051e66d
xor eax, eax
jmp 0x47029f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0051e7aa
push esi
lea ecx, [esp + 0xc]
call fcn.0051ea39
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x75cdcc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x47027d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00470080
test eax, eax
jne 0x47027d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00470080
test eax, eax
jne 0x47027d
lea eax, [esp + 0x14]
push 0x75cda8
push eax
call fcn.00502430
mov esi, eax
add esp, 8
test esi, esi
jne 0x47025c
lea ecx, [esp + 0x14]
push 0x75cda4
push ecx
call fcn.005023b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x47025c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x47025f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0051e75a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x47016e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0051e66d
xor eax, eax
jmp 0x47029f
mov byte [esi], 0
push 0x75cda0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0051e66d
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4