joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532330
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov esi, eax
add esp, 4
test esi, esi
jne 0x53235b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x5323aa
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x5323b2
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x532423
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x5323e0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x532455
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x54e475
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x54e476
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x532430
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x532460
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.004e05a0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov esi, eax
add esp, 8
test esi, esi
je 0x5325e2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x5324e2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x532553
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x532510
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x532585
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x54e475
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x54e476
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x532560
push dword [esp + 0x30]
call fcn.004e05a0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x5325b0
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x580004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x5326b0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x5326d6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x53270e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.004e05a0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x532765
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x532774
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x532785
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x5333c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x53340c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x5333d1
pop ebx
pop edi
pop esi
ret

Function at 0x5345de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x53461d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x53461d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x53461d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x53461d
cmp dword [ecx + 0x74], 0xe
jbe 0x53461d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x62beb4
Capabilities:
Encrypt data using aes

Disassembly:
pop dx
lea esp, [esp + 2]
jmp 0x62bf0e
xchg di, cx
bsr cx, bx
jmp 0x62bf2f
pushal
mov dword [esp + 0x1c], edi
popal
mov edx, dword [eax + 0xc]
jmp 0x62bef8
popal
jmp 0x62c00b
pushal
and esi, edx
mov dword [esp + 0x18], edx
push ecx
lea esp, [esp + 4]
jmp 0x62bf19
pushfd
add esp, 1
lea esp, [esp + 3]
jmp 0x62bf88
lea esi, [esi*4]
lea esi, reloc.MSVCRT.dll___dllonexit
mov ecx, dword [esi]
pop esi
shr edi, 0x10
jmp 0x62bf5d
and edi, esi
pushal
call fcn.0062bfdc
add byte [eax], al
mov eax, 0x3bc8a939
rcr dword [edx + reloc.MSVCRT.dll___dllonexit], 1
clc
jg 0x62bf8e
mov bh, byte [ecx + 0x65]
ror byte [ebp - 0x24], cl
and ecx, esi
push esi
mov esi, ecx
jmp 0x62bf73
shr ecx, 8
lea edi, reloc.MSVCRT.dll___dllonexit
mov edi, edx
jmp 0x62bfa5

Function at 0x62bfa7
Capabilities:
Encrypt data using aes

Disassembly:
pop dx
lea esp, [esp + 2]
jmp 0x62bf0e
xchg di, cx
bsr cx, bx
jmp 0x62bf2f
pushal
mov dword [esp + 0x1c], edi
popal
mov edx, dword [eax + 0xc]
jmp 0x62bef8
popal
jmp 0x62c00b
pushal
and esi, edx
mov dword [esp + 0x18], edx
push ecx
lea esp, [esp + 4]
jmp 0x62bf19
pushfd
add esp, 1
lea esp, [esp + 3]
jmp 0x62bf88
lea esi, [esi*4]
lea esi, reloc.MSVCRT.dll___dllonexit
mov ecx, dword [esi]
pop esi
shr edi, 0x10
jmp 0x62bf5d
and edi, esi
pushal
call fcn.0062bfdc
add byte [eax], al
mov eax, 0x3bc8a939
rcr dword [edx + reloc.MSVCRT.dll___dllonexit], 1
clc
jg 0x62bf8e
mov bh, byte [ecx + 0x65]
ror byte [ebp - 0x24], cl
and ecx, esi
push esi
mov esi, ecx
jmp 0x62bf73
shr ecx, 8
lea edi, reloc.MSVCRT.dll___dllonexit
mov edi, edx
jmp 0x62bfa5

Function at 0x62c366
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
mov dword [edx], edi
jmp 0x62c371
bswap edi
push ax
lea esp, [esp + 2]
jmp 0x62c3ae
pushal
mov dword [esp + 4], ecx
popal
jmp 0x62c5c8
mov edi, dword [ecx + 4]
push esi
jmp 0x62c398
cmp dword [ebp - 4], ebx
lea esp, [esp + 2]
add ecx, 0x10
sub edx, 0x10
jmp 0x62c3cd
sub esp, 0xe
lea esp, [esp + 2]
lea esp, [esp + 0x34]
sub ebx, 4
push cx
jmp 0x62c3e3
add esi, 4
mov dword [esi], eax
pop esi
mov dword [edx + 4], edi
jmp 0x62c498

Function at 0x62c4f3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
clc
jmp 0x62c4f5
jmp 0x62c4dd
and edi, ecx
sub esp, 0xe
mov dword [esp + 4], esp
sub esp, 0x1a
pop word [esp + 0x1a]
jmp 0x62c54f
lea esp, [esp + 1]
jmp 0x62c530
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 0xd
pop dword [esp + 2]
push dword [esp + 1]
jmp 0x62c508
Function at 0x62c6f1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, edi
lea edx, [edx*4]
lea edx, reloc.MSVCRT.dll___dllonexit
mov edi, dword [edx]
pop edx
jmp 0x62c6c1
sub esp, 0xc
stc
lea esp, [esp + 1]
push edx
jmp 0x62c67a
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62c6ce
and edi, ecx
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
jmp 0x62c6ab
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
jmp 0x62c709
jmp 0x62c6a0
movzx ebx, byte [esi + 9]
jmp 0x62c71e
push ax
lea esp, [esp + 1]
lea esp, [esp + 1]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
rcl bh, cl
jmp 0x62c6f3
and edx, ecx
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62c765
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
bsf dx, bx
jmp 0x62d40b
and edx, ecx
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x62c74f
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 6
lea esp, [esp + 2]
jmp 0x62c8db
shr edi, 0x18
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and edi, ecx
jmp 0x62c78d
and ebx, ecx
call fcn.0062c7b2
movzx ebx, byte [esi + 0xd]
jmp 0x62c852
out dx, eax
add eax, 0x8f7c1585
pop edx
mov ch, 0x36
movsb byte es:[edi], byte [esi]
ret
lea esp, [esp + 3]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
clc
cmc
jmp 0x62c7c8
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
push eax
and edx, ecx
call fcn.0062c7f7
mov dword [esi + 8], edi
call fcn.0062c876
div dword [eax - 0x1a]
xor dword [eax - 9], 0x84fd6ded
ja 0x62c7da
cld
iretd
and edx, ecx
sub esp, 9
pop dword [esp]
lea esp, [esp + 1]
jmp 0x62c815
lea ebx, [esp + 0x77]
movzx ebx, byte [esi + 0xa]
sub esp, 0x18
sub esp, 9
push word [esp]
jmp 0x62c7e8
and ebx, ecx
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
setge bl
jmp 0x62c890
btc edi, ebx
mov edi, edx
stc
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x62c7a4
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62ca59

Function at 0x62c7b2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
dec bx
jmp 0x62c7cf

Function at 0x62c7f7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
jmp 0x62c83a
mov edx, dword [esi + 0xc]
jmp 0x62c824
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62c7fd
Function at 0x62c876
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
bswap edi
dec di
jmp 0x62c8bd
lea edi, [esi - 0x76]
bt di, ax
jmp 0x62c860
pop dword [esp + 0xe]
jmp 0x62c94b
mov edi, 0x31ed5811
mov edi, edx
pushal
stc
push dword [esp + 0xb]
jmp 0x62c8a7
and edi, ecx
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
sub esp, 0xf
call fcn.0062c8ed
lea esp, [esp + 3]
jmp 0x62c92e
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov bx, 0xdaa9
jmp 0x62c9df
shr edi, 0x18
clc
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62c903
and edx, ecx
pushal
mov dword [esp + 0x1b], edx
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 7
call fcn.0062c958
lea esp, [esp + 3]
and ebx, ecx
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x62c9b8
lea eax, [eax*4]
lea eax, reloc.MSVCRT.dll___dllonexit
mov ebx, dword [eax]
pop eax
jmp 0x62c96e
clc
and edx, ecx
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
push ebx
jmp 0x62c9c9
lea esp, [esp + 4]
dec dword [ebp - 4]
push di
lea esp, [esp + 2]
jmp 0x62c9fe
movzx ebx, byte [esi + 0xe]
push eax
mov eax, ebx
jmp 0x62c9a6
mov dword [esi + 0xc], edi
jne 0x5db671
je 0x5db622
Function at 0x62d0ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
mov ebp, 0x5b87e42e
jmp 0x62d06a
cmp dword [ebp - 4], ebx
call 0x62d440
add al, 0x85
adc eax, 0xb6658f7c
movsb byte es:[edi], byte ss:[esi]
ret
push esi
jmp 0x62d176
rdtsc
mov ebp, esp
not dx
xchg dx, ax
add ebx, 0x3c
mov eax, dword [ebx]
pop ebx
dec edx
sub esp, 0x19
jmp 0x62d0ef
mov byte [esp], ch
lea esp, [esp + 4]
popal
jmp 0x62d095
add eax, ecx
setae dh
jmp 0x62d154
dec dx
lea esp, [esp + 1]
lea esp, [esp + 0x18]
and dword [ebp - 0xc], 0
jmp 0x62d0d9
xor eax, eax
jmp 0x62cfdc
je 0x62d03e
mov ax, word [esp]
bsf ax, dx
cmc
jmp 0x62d127
mov edx, 0x10b
clc
cmp word [eax + 0x18], dx
jmp 0x62d13d
mov esi, dword [eax + 0x78]
call fcn.0062d160
sti
adc dword [ebx], 0x76
test dword [esi - 0x3d], esi
inc esp
fidivr dword [ebp + 0x7071cb4c]
jae 0x62d1f8
jmp 0x5fe349
mov edi, dword [esi + 0x24]
jmp 0x62d225
outsb dx, byte [esi]
or eax, edi
or eax, 0x2c45d550
fistp word [edx - 0x3c]
ja 0x62d263
test eax, 0x8bc1b7c8
pop esi
sbb byte [edi - 0x15], dl
loop 0x62d209
mov ebx, dword [esi + 0x18]
push edi
jmp 0x62d1f1
stc
push edx
mov word [esp + 1], sp
jmp 0x62d26d
mov dword [ebp - 0x10], eax
bswap eax
mov ax, 0x4dfb
mov eax, dword [esi + 0x1c]
jmp 0x62d20f
lea esp, [esp + 0xc]
dec ebx
call fcn.0062d28b
invalid
sahf
stc
or byte [edi + 0x6ec75425], cl
jns 0x62d2c5
add edi, ecx
push ebx
pushfd
add eax, ecx
jmp 0x62d257
jmp 0x62d309
lea eax, [ebp*4]
jmp 0x62d314
sub eax, edx
xchg di, dx
bswap edi
mov edi, eax
jmp 0x62d2f3
mov eax, dword [ebp - 0x10]
lea edx, [esp + ebp]
mov dh, byte [esp]
jmp 0x62d35a
add edx, dword [ebp + 8]
mov ah, cl
mov ah, ch
jmp 0x62d369
sar edi, 1
mov dx, 0x6145
mov edx, dword [eax + edi*4]
btr ax, dx
jmp 0x62d344
mov eax, dword [ebp + 0xc]
call fcn.005fe2d6
test eax, eax
jmp 0x62d3be
push edx
jmp 0x62d3a4
lea edx, [eax + edx]
movzx eax, word [edx]
pop edx
mov ecx, 0xdec5f92e
bsr cx, bx
jmp 0x62d3e7
mov edx, edi
lea edx, [edx + edx]
jmp 0x62d38e
jne 0x62cf2f
btr cx, di
shl ax, 0xe
mov eax, dword [ebp - 8]
jmp 0x62d375
pushal
mov esi, dword [esp]
lea ebp, [esp + ebx]
mov cl, al
mov dword [esp + 0x10], eax
jmp 0x62d3f5
lea ecx, reloc.MSVCRT.dll___dllonexit
rol cl, cl
mov ecx, dword [ebp - 0x14]
push ebx
jmp 0x62d3d1
sub esp, 0x15
mov byte [esp + 0x10], ch
lea esp, [esp + 1]
lea esp, [esp + 0x14]
popal
jmp 0x62d8ab
lea ebx, [ebx*4]
lea ebx, [ecx + ebx]
mov eax, dword [ebx]
pop ebx
call fcn.0062d43e
Function at 0x6b5588
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 3]
call fcn.006b4b51
push ecx
mov ebx, dword [esp]
mov dx, bx
mov dx, word [esp]
bt bx, dx
jmp 0x6b556a
jg 0x6b5580
bswap edx
jmp 0x6b5582
bswap edx
call 0x6b5588
sbb al, 0x8d
add al, 0x95
add byte [eax], al
add byte [eax], al
bsf ecx, ebp
jmp 0x6b572b
bsr dx, bp
bswap edx
cpuid
add esp, 3
bts bx, si
mov ch, bh
cpuid
bsr edx, ebx
jmp 0x6b5638
lea esp, [esp]
mov dx, 0x2299
mov di, word [esp]
inc cx
mov byte [esp], dh
jmp 0x6b5676
jle 0x6b560c
lea esp, [esp]
mov dx, 0x2299
jmp 0x6b56a6
neg di
bsr ebx, ecx
ja 0x6b56f3
xchg byte [esp], dh
call fcn.006b5752
cdq
clc
invalid
mov di, word [esp]
inc cx
mov byte [esp], dh
call fcn.006b565a
adc eax, 0x18247c87
xchg byte [esp], dh
neg edx
mov dx, 0xad5b
sbb ecx, 0x9ba4bd9
jmp 0x6b58f1
ja 0x6b5598
bsr dx, bp
bswap edx
call fcn.006b55cf
shr edx, 0xd
jo 0x6b5888
mov ax, word [esp]
jmp 0x6b5805
mov ecx, esi
mov eax, dword [esp]
lea ecx, reloc.MSVCRT.dll___dllonexit
mov ecx, 0xccb4bde8
mov ecx, dword [esp]
setne bl
jmp 0x6b5794
lea esi, reloc.MSVCRT.dll___dllonexit
jmp 0x6b57e0
mov eax, dword [esp]
jmp 0x6b5899
rdtsc
push ecx
lea edx, [edi*4]
jmp 0x6b5827
clc
jp 0x6b5811
xchg dh, al
mov eax, dword [esp]
rol di, 6
mov ch, al
mov edi, dword [esp]
jmp 0x6b5902
mov ax, 0x7b1f
lea ebx, [esp + 0x1b]
push dx
jmp 0x6b57d8
xchg dh, al
mov eax, dword [esp]
call fcn.006b5839
into
dec edi
fistp qword [edx - 0x629d2fb7]
mov edx, 0x9d62d049
in al, dx
inc esi
jno 0x6b588e
xchg word [esp], ax
xchg dword [esp], eax
lea esp, [esp + 2]
mov dh, 0xce
mov ebx, dword [esp]
mov di, dx
jmp 0x6b57ec
mov ax, word [esp]
mov ax, 0x7b1f
lea ebx, [esp + 0x1b]
pop ds
jnp 0x6b581e
pop esp
and al, 0x1b
push dx
mov eax, dword [esp]
mov ax, dx
or cx, bp
jl 0x6b57c2
lea esi, reloc.MSVCRT.dll___dllonexit
rdtsc
push ecx
lea edx, [edi*4]
xchg word [esp], ax
jmp 0x6b582b
lea esp, [esp + 1]
push esi
mov di, word [esp]
lea edx, [eax + edi]
jmp 0x6b57aa
shr dh, cl
mov bx, 0x9bfe
inc esi
jb 0x6b591f
mov ecx, esi
mov ax, word [esp]
jmp 0x6b5923
mov ecx, esi
jmp 0x6b5961
mov ah, 0x47
lea eax, [eax + edx]
sub esp, 0x14
jmp 0x6b596d
mov esi, dword [esp + 0xd]
pop bx
bswap ebx
inc ecx
jp 0x6b5a32
jnp 0x6b59dd
and eax, 0x24048b66
mov ax, word [esp]
mov ah, 0x47
lea eax, [eax + edx]
sub esp, 0x14
pop dword [esp + 3]
jmp 0x6b594b
pop edi
btc bx, si
jae 0x6b59bf
mov al, 0xd1
mov esi, 0x704d1baf
jmp 0x6b59c1
add esp, 0x10
jbe 0x6b59a2
ja 0x6b59a2
jmp 0x6b5a01
sub esp, 0x16
push dword [esp + 4]
xchg word [esp + 0x12], cx
jmp 0x6b5a14
xchg dword [esp + 5], ebx
btr bx, dx
lea esp, [esp + 2]
jmp 0x6b5a3e
dec dh
jp 0x6b5a18
jnp 0x6b5a18
div dword [ebp - 0x1b]
invalid
mov al, 0xd1
mov esi, 0x704d1baf
sub esp, 0x16
push dword [esp + 4]
xchg word [esp + 0x12], cx
mov bl, ch
jmp 0x6b59eb
call fcn.006b5b21
jg 0x62f4d442
cmpsd dword [esi], dword es:[edi]
and byte [esi - 0x2458df2f], dh
pop ebp
int 0x94
loop 0x6b5a5c
aas
push es
xchg dword [esp + 5], ebx
btr bx, dx
lea esp, [esp + 2]
jmp 0x6b59b8
bsf ecx, edx
Function at 0x93da8d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
jmp 0x93dadb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x93dac5
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x93da8f
Function at 0x418850
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a6fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049964c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4188d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00496ae0
mov eax, dword [eax]
push 0x5c1ce4
push eax
call fcn.00488cd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004998d7
test bl, bl
je 0x4188d2
push 0x5c1ce4
lea ecx, [esp + 0xc]
call fcn.00499cb3
push 0x5c1cf0
lea ecx, [esp + 0xc]
call fcn.00499cb3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41890e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004998d7
jmp 0x4189d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x418992
lea edx, [esp + 0x7c]
push 0x5c1cec
push edx
call fcn.00488cd4
add esp, 8
test eax, eax
je 0x418992
lea eax, [esp + 0x7c]
push 0x5c1ce8
push eax
call fcn.00488cd4
add esp, 8
test eax, eax
je 0x418992
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418922
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004998d7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4191e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x419242
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x419250
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a704b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5cc770]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x419388
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4192b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004998d7
xor eax, eax
jmp 0x4193ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00499a60
push esi
lea ecx, [esp + 0xc]
call fcn.00499cef
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4193dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.004191e0
test eax, eax
jne 0x4193dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.004191e0
test eax, eax
jne 0x4193dd
lea eax, [esp + 0x14]
push 0x5c1d00
push eax
call fcn.00489ec0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4193bc
lea ecx, [esp + 0x14]
push 0x5c1cfc
push ecx
call fcn.00489e40
mov esi, eax
add esp, 8
test esi, esi
jne 0x4193bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4193bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00499a10
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4192ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004998d7
xor eax, eax
jmp 0x4193ff
mov byte [esi], 0
push 0x5c1cf8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004998d7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4