joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x58d419
add byte [eax], al
add byte [ecx - 0x93db84], cl
aad 0x8b
xchg esi, eax
cld
add dword [eax], eax
add byte [ebp + 0x5154244c], cl
insb byte es:[edi], dx

Function at 0x5913ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x30]
mov byte [esp + 0x130], 0
call 0x60570c
cmp esi, 6
jne 0x59256c
mov eax, dword [ebx]
push 0
add byte [eax - 1], dl
adc eax, 0x597410
test eax, eax
jne 0x59147e
push ebx
lea eax, [esp + 0x34]
push 0x5f3018
push eax
call 0x605a15
push 0x5f3010
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x13c], 2
call 0x6059a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
call 0x60570c
mov byte [esp + 0x130], 0
lea ecx, [esp + 0x30]
jmp 0x592567
mov eax, dword [ebp + 0x5c]
dec esp
and al, 0x10
aad 0x7c
loopne 0x59255b
add al, 0x3b
aad 0x7c
pop es

Function at 0x591420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x30]
mov byte [esp + 0x130], 0
call 0x60570c
cmp esi, 6
jne 0x59256c
mov eax, dword [ebx]
push 0
add byte [eax - 1], dl
adc eax, 0x597410
test eax, eax
jne 0x59147e
push ebx
lea eax, [esp + 0x34]
push 0x5f3018
push eax
call 0x605a15
push 0x5f3010
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x13c], 2
call 0x6059a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
call 0x60570c
mov byte [esp + 0x130], 0
lea ecx, [esp + 0x30]
jmp 0x592567
mov eax, dword [ebp + 0x5c]
dec esp
and al, 0x10
aad 0x7c
loopne 0x59255b
add al, 0x3b
aad 0x7c
pop es
Function at 0x59177a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sbb al, 0x6a
and al, 0x68
nop
jne 0x5917e0
add byte [eax + 0x52], dl
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call 0x60570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call 0x60570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call 0x60570c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x591999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
add byte [eax], al
push eax
push ecx
call dword [0x597360]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x5918d1
add edx, 0x4d58
mov ecx, esi
push edx
call 0x605895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call 0x60577a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call 0x605a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call 0x6059a1
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call 0x60577a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call 0x605a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call 0x6059a1
add byte [ebx + 0x1c558b00], cl
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call 0x60570c
pop es
add byte [ebp - 0x77dfdbb4], cl
pushfd
and al, 0x30
add dword [eax], eax
add al, ch
mov edi, 0x8300073d
inc byte [esi]
mov edx, dword [esp + 0x20]
push 0x8000080
or byte [edx + 2], ch
push 0
push 0
push 0x40000000
inc eax
push edx
call dword [0x597414]
cmp eax, 0xffffffff
jne 0x591a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call 0x605895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call 0x605a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call 0x6059a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call 0x60570c
mov byte [esp + 0x130], bl

Function at 0x591845
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0x14
call 0x60593b
push 0x5f2f7c
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x15
push eax
Function at 0x591910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sbb al, 0x6a
and al, 0x68
nop
jne 0x5917e0
add byte [eax + 0x52], dl
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call 0x60570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call 0x60570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call 0x60570c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x591999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
add byte [eax], al
push eax
push ecx
call dword [0x597360]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x5918d1
add edx, 0x4d58
mov ecx, esi
push edx
call 0x605895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call 0x60577a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call 0x605a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call 0x6059a1
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call 0x60577a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call 0x605a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call 0x6059a1
add byte [ebx + 0x1c558b00], cl
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call 0x60570c
pop es
add byte [ebp - 0x77dfdbb4], cl
pushfd
and al, 0x30
add dword [eax], eax
add al, ch
mov edi, 0x8300073d
inc byte [esi]
mov edx, dword [esp + 0x20]
push 0x8000080
or byte [edx + 2], ch
push 0
push 0
push 0x40000000
inc eax
push edx
call dword [0x597414]
cmp eax, 0xffffffff
jne 0x591a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call 0x605895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call 0x605a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call 0x6059a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call 0x60570c
mov byte [esp + 0x130], bl
Function at 0x59193b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sbb al, 0x6a
and al, 0x68
nop
jne 0x5917e0
add byte [eax + 0x52], dl
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call 0x60570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call 0x60570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call 0x60570c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x591999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
add byte [eax], al
push eax
push ecx
call dword [0x597360]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x5918d1
add edx, 0x4d58
mov ecx, esi
push edx
call 0x605895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call 0x60577a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call 0x605a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call 0x6059a1
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call 0x60577a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call 0x605a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call 0x6059a1
add byte [ebx + 0x1c558b00], cl
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call 0x60570c
pop es
add byte [ebp - 0x77dfdbb4], cl
pushfd
and al, 0x30
add dword [eax], eax
add al, ch
mov edi, 0x8300073d
inc byte [esi]
mov edx, dword [esp + 0x20]
push 0x8000080
or byte [edx + 2], ch
push 0
push 0
push 0x40000000
inc eax
push edx
call dword [0x597414]
cmp eax, 0xffffffff
jne 0x591a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call 0x605895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call 0x605a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call 0x6059a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call 0x60570c
mov byte [esp + 0x130], bl
Function at 0x5919a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sbb al, 0x6a
and al, 0x68
nop
jne 0x5917e0
add byte [eax + 0x52], dl
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call 0x60570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call 0x60570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call 0x60570c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x591999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
add byte [eax], al
push eax
push ecx
call dword [0x597360]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x5918d1
add edx, 0x4d58
mov ecx, esi
push edx
call 0x605895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call 0x60577a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call 0x605a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call 0x6059a1
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call 0x60577a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call 0x605a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call 0x6059a1
add byte [ebx + 0x1c558b00], cl
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call 0x60570c
pop es
add byte [ebp - 0x77dfdbb4], cl
pushfd
and al, 0x30
add dword [eax], eax
add al, ch
mov edi, 0x8300073d
inc byte [esi]
mov edx, dword [esp + 0x20]
push 0x8000080
or byte [edx + 2], ch
push 0
push 0
push 0x40000000
inc eax
push edx
call dword [0x597414]
cmp eax, 0xffffffff
jne 0x591a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call 0x605895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call 0x605a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call 0x6059a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call 0x60570c
mov byte [esp + 0x130], bl
Function at 0x5919ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sbb al, 0x6a
and al, 0x68
nop
jne 0x5917e0
add byte [eax + 0x52], dl
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call 0x60570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call 0x60570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call 0x60570c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x591999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
add byte [eax], al
push eax
push ecx
call dword [0x597360]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x5918d1
add edx, 0x4d58
mov ecx, esi
push edx
call 0x605895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call 0x60577a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call 0x605a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call 0x6059a1
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call 0x60577a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call 0x605a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call 0x6059a1
add byte [ebx + 0x1c558b00], cl
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call 0x60570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call 0x60570c
pop es
add byte [ebp - 0x77dfdbb4], cl
pushfd
and al, 0x30
add dword [eax], eax
add al, ch
mov edi, 0x8300073d
inc byte [esi]
mov edx, dword [esp + 0x20]
push 0x8000080
or byte [edx + 2], ch
push 0
push 0
push 0x40000000
inc eax
push edx
call dword [0x597414]
cmp eax, 0xffffffff
jne 0x591a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call 0x605895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call 0x605a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call 0x6059a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call 0x60570c
mov byte [esp + 0x130], bl
Function at 0x592406
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x8b
push cs
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x74], ecx
jne 0x592429
inc edx
add esi, 4
cmp edx, ebp
jl 0x592407
jmp 0x59242d
cmp edx, ebp
jl 0x592434
mov dword [esp + 0x210], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0x94]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x592482
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x94], ecx
jne 0x59247e
inc edx
add esi, 4
cmp edx, ebp
jl 0x592459
jmp 0x592482
cmp edx, ebp
jl 0x592489
mov dword [esp + 0x230], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0x6c]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x5924d1
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x6c], ecx
jne 0x5924cd
inc edx
add esi, 4
cmp edx, ebp
jl 0x5924ab
jmp 0x5924d1
cmp edx, ebp
jl 0x5924d8
mov dword [esp + 0x208], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0x84]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x592526
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x84], ecx
jne 0x592522
inc edx
add esi, 4
cmp edx, ebp
jl 0x5924fd
jmp 0x592526
cmp edx, ebp
jl 0x59252d
mov dword [esp + 0x220], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0x5c]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x592575
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x5c], ecx
jne 0x592571
inc edx
add esi, 4
cmp edx, ebp
jl 0x59254f
jmp 0x592575
cmp edx, ebp
jl 0x59257c
mov dword [esp + 0x1f8], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0xa4]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x5925ca
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0xa4], ecx
jne 0x5925c6
inc edx
add esi, 4
cmp edx, ebp
jl 0x5925a1
jmp 0x5925ca
cmp edx, ebp
jl 0x5925d1
mov dword [esp + 0x240], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 6
mov ecx, dword [edx + eax + 0x9c]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x59261f
lea esi, [ebx + 4]
mov ecx, dword [esi]
lea edi, [ecx*8]
sub edi, ecx
mov ecx, dword [esp + 0x10]
shl edi, 6
cmp dword [edi + eax + 0x9c], ecx
jne 0x59261b
inc edx
add esi, 4
cmp edx, ebp
jl 0x5925f6
jmp 0x59261f
cmp edx, ebp
jl 0x592626
mov dword [esp + 0x238], ecx
mov ecx, dword [ebx]
lea edx, [ecx*8]
int 0
add byte [eax], al
add byte [ebx], ch
rol ecx, 1
loop 0x59263a
mov ecx, dword [edx + eax + 0x44]
mov edx, 1
cmp ebp, edx
mov dword [esp + 0x10], ecx
jle 0x59266e
lea esi, [ebx + 4]
Function at 0x592a18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
or al, bh
inc esp
and al, 0x18
add dword [eax], eax
add byte [eax], al

Function at 0x592bb3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi]
lea ebx, [ecx*8]
sub ebx, ecx
shl ebx, 6
cmp dword [ebx + eax + 0x1bc], edi
jne 0x592bc2
inc edx
add esi, 4
cmp edx, ebp
jl 0x592b96
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x358], edi
jmp 0x592bd7
cmp edx, ebp
jl 0x592bd3
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x358], edi
jmp 0x592bd7
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x214]
mov edx, dword [esp + 0x204]
mov dword [esp + 0x128], ecx
mov ecx, dword [esp + 0x20c]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x200]
mov dword [esp + 0x134], ecx
add byte [eax], al
mov ecx, dword [esp + 0x230]
mov dword [esp + 0x12c], edx
mov edx, dword [esp + 0x224]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x210]
mov dword [esp + 0x144], ecx
mov ecx, dword [esp + 0x1f8]
mov dword [esp + 0x138], edx
mov edx, dword [esp + 0x208]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x220]
mov dword [esp + 0x150], ecx
mov ecx, dword [esp + 0x1e0]
mov dword [esp + 0x148], edx
mov edx, dword [esp + 0x240]
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x238]
mov dword [esp + 0x15c], ecx
mov ecx, dword [esp + 0x1fc]
mov dword [esp + 0x154], edx
mov edx, dword [esp + 0x228]
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x1e8]
add dword [eax], eax
add byte [ecx + 0x168248c], cl
add byte [eax], al
mov ecx, dword [esp + 0x1e4]
mov dword [esp + 0x160], edx
mov edx, dword [esp + 0x244]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x23c]
mov dword [esp + 0x174], ecx
lea ecx, [esp + 0x248]
mov dword [esp + 0x16c], edx
mov edx, dword [esp + 0x22c]
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x1ec]
push ecx
lea ecx, [esp + 0x18c]
mov dword [esp + 0x17c], edx
mov dword [esp + 0x180], eax
call 0x65d895
mov eax, dword [esp + 0x1f4]
mov edx, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x350]
mov dword [esp + 0x190], eax
mov eax, 0x66666667
mov dword [esp + 0x18c], edx
imul ecx
sar edx, 2
mov eax, edx
mov byte [esp + 0x364], 8
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0x198], edx
mov ecx, 0xa
cdq
idiv ecx
mov eax, dword [esp + 0x358]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa4], eax
mov dword [esp + 0x194], edx
mov edx, dword [esp + 0x354]
mov dword [esp + 0xa0], edx
call 0x65d70c
mov edi, dword [esp + 0x28]
Function at 0x40f585
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40f594
pop dword [ebp - 8]
mov eax, 0x98bfdbc6
add eax, 0x678119ce
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x4fd2d
push 0
mov eax, 0xd6e4f23e
add eax, 0x295fc07e
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xae0fe4c3
add ecx, 0x51f062d9
xor edi, edi
add edi, eax
mov ebx, 0x99316c4f
sub ebx, 0x98e8ee4f
add ebx, dword [ebp - 8]
mov edx, 0xc0fdf0a3
add edx, 0xf3371714
sub dword [ebp - 4], ecx
mov esi, dword [ebx]
xor esi, edx
add dword [ebp - 4], eax
mov dword [edi], esi
add dword [ebp - 4], 0xb0a30a41
add edi, 0x821dfbf9
add edi, 0x7de2040b
add ebx, 0x3c020c1f
add ebx, 0xc3fdf3e5
loop 0x40f5f5
add eax, 0x11143
mov ebx, eax
add eax, 5
mov ecx, 0x548abc49
add ecx, 0xabb543b7
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x407fc0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46895b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045d63b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408042
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045b58a
mov eax, dword [eax]
push 0x47e1f0
push eax
call fcn.0044e214
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045d8c6
test bl, bl
je 0x408042
push 0x47e1f0
lea ecx, [esp + 0xc]
call fcn.0045dc56
push 0x481d40
lea ecx, [esp + 0xc]
call fcn.0045dc56
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40807e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045d8c6
jmp 0x408149
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408102
lea edx, [esp + 0x7c]
push 0x481d3c
push edx
call fcn.0044e214
add esp, 8
test eax, eax
je 0x408102
lea eax, [esp + 0x7c]
push 0x481d38
push eax
call fcn.0044e214
add esp, 8
test eax, eax
je 0x408102
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408092
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045d8c6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x408940
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4089a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc