joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9b5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004c0730
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::JSON::ParseHandler.0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004b433d
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.00482910
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x34], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c4b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e9bd0
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x4c4bf5
mov eax, dword [esi + 0x10]
pop esi
test eax, eax
je 0x4c4be5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x4c4c25
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.cannot_create_thread
lea ecx, [ebp - 0x24]
call fcn.0040a260
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.004c3dd0
push 0x52e868
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x3c]
call fcn.0040a260
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
call fcn.004c3dd0
push 0x52e868
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x17b722e4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x14f1593a
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4d24ef
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushal
lea esp, [esp + 0x30]
ja 0x594a2a
bswap esi
movzx si, cl
setl bh
jmp 0x5864d8
pop esi
pushal
mov edi, dword [esp + 0x20]
push esi
movzx cx, cl
mov ebx, dword [esp + 0x28]
movzx ecx, bl
bswap cx
bswap cx
mov ecx, dword [esp + 0x2c]
push ebx
call fcn.0058512d
cmp eax, 0x6cb1b264
scasd eax, dword es:[edi]
pushal
in eax, 1
push 0xffffffffffffffa2
sub byte [edi], bh
ror dword [eax + 0x39], 0x54
adc bl, cl
mov edi, 0xd777076
add al, 0x28
hlt

Function at 0x589cc5
Capabilities:
Encode data using xor

Disassembly:
call 0xb643c70a
mov bh, 0x3f
add byte [esi - 0x71], al
dec ecx
pop edi
mov bh, 0x31
leave
xchg al, ah
outsb dx, byte [esi]
salc
mov ah, dl
xor eax, 0x52969ebb
sbb byte [ebx], dh
test dword [ebp + 0x46f9136b], ecx
inc esi
inc esi
call fcn.0058d454
push cs
and eax, 0x26a4bd63
scasd eax, dword es:[edi]
insb byte es:[edi], dx
ja 0x589ca3
mov edx, 0xcdb84c6
add al, 0x9a
shl dword [esi], 1
mov byte [ebx + ebx*8 - 0x2e65fbf4], 0x26
adc dword [ebx], ecx
mov dl, 0xc0
pop es
dec esp
xor al, 5
lahf
pushal
push es
jo 0x589cd6
xchg dword [ebp + 0x468efc9a], ecx
xchg ebp, eax
ja 0x589cf3
push dword [ebp + 0x45855b3d]
mov dl, byte [ecx - 0x1f2de5c8]
mov ch, 0x3d
pop ebx
test dword [ebp - 0x76], eax
xchg ecx, eax
cmp byte [edx], bl
shl al, cl
push edx
stosb byte es:[edi], al
invalid

Function at 0x59036b
Capabilities:
Encode data using xor

Disassembly:
pushal
cmp ecx, dword [edx + 0x14]
pushfd
pushfd
mov byte [esp], ah
lea esp, [esp + 0x2c]
jae fcn.005923a7
pushfd
mov word [esp], 0x5014
lea esp, [esp + 4]
jmp fcn.00586b7a
jmp 0x589437
cmp esi, 0x554eb13a
pushfd
clc
sub ecx, dword [edx + 0x10]
jmp 0x580906
lea esp, [esp + 0x2c]
jbe 0x58340b
ror edi, 0xe
inc di
lea edi, [eax*2 - 0x15eda086]
rcl bh, 6
mov edi, dword [edx + 0x24]
mov bh, 0xb8
add edi, eax
not bl
ror bh, cl
call fcn.00594d9e
xchg esp, eax
das
dec ecx
mov dword [0xc6af270b], eax
cmc
add byte [ebp - 0x53efbae8], cl
enter 0xfffffffffffff04b, 0x35
std
mov al, byte [ebp + 0x7b]
and ch, byte [edx + 0x117b74b6]
fcom dword [edi - 0x2ab39e54]
mov al, byte [0x5aab7bbe]
les ecx, [ebp - 8]
rcr dword [esi], 0xf3
rcr ecx, 1
movsd dword es:[edi], dword [esi]
mov ebx, 0x9af8d1f9
dec dword [edx]
xor dword [edi + 0x1e900c56], ebx
fisubr word [eax]
mov dh, 0x65
arpl word [edi - 0x39], cx
and bh, byte [0x24ca7c3c]
invalid

Function at 0x5954a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
not si
pushfd
push dword [0x59660e]
pop dword [esp + 0x24]
bswap si
movsx si, dl
mov dword [esp + 0x20], 0
push dword [esp]
inc si
mov esi, dword [esp + 0x54]
movzx bp, cl
dec ebp
dec esi
clc
test bp, 0x64a2
rcl ebp, 0xa
neg esi
stc
mov bp, word [esp + 0xc]
sub esi, 0x55fd5ae5
jmp 0x59706e
lea ebp, [esp + 0x24]
pushal
lea esp, [esp + 0x44]
jmp 0x59606f

Function at 0x59778a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec bp
mov dword [esp + 0x1c], 0
pop ebp
pushal
mov esi, dword [esp + 0x68]
dec bp
dec ebp
bswap bp
pop ebp
dec esi
lea ebp, [ebp - 0x72f161ca]
push esi
neg esi
rol bp, cl
or ebp, ebx
shrd bp, bp, cl
btr ebp, 0x1c
sub esi, 0x55fd5ae5
jmp 0x596531
Function at 0x59e6b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
jbe 0x59e6e1
push 0x40e6d0
call dword [0x40e0a4]
lea eax, [edx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp + 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0059e8f0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x59e80c
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [edi]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
jb 0x59e736
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ecx + 0x10]
xor edx, edx
mov dword [ebp - 8], ecx
mov ebx, 0x811c9dc5
test ecx, ecx
je 0x59e767
mov eax, dword [ebp - 4]
mov edi, ecx
nop dword [eax]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x59e750
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x59e786
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x59e802
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0059f010
test al, al
jne 0x59e7c0
mov ebx, dword [ebx]
cmp ebx, esi
je 0x59e7b8
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x59e7ff
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x59e7e2
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0059f010
test al, al
je 0x59e815
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x59e7c7
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov esi, edi
cmp edi, eax
jne 0x59e720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x59e7ff
Function at 0x59fd60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d0ad
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x412008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.0059fbe0
cmp byte [ebp - 0x84], 0
jne 0x59feb1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x59fdf5
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x412018
call fcn.0059fbe0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.0059fbe0
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x59fe64
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call fcn.005a42c8
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.0059fc90
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x59fef3
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x59fee9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x59fee9
call dword [0x40e20c]
push ecx
push edx
call fcn.005a36e1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a34a6
mov esp, ebp
pop ebp
ret
Function at 0x5a2390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x5a23a9
mov esi, dword [edi]
mov ebx, dword [edi + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x5a23cb
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x5a23b7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov edx, dword [ebp - 4]
mov esi, dword [eax + ecx*8 + 4]
cmp esi, dword [edx + 4]
je 0x5a2415
mov ebx, dword [eax + ecx*8]
lea eax, [esi + 8]
push eax
push edi
call fcn.0059f010
test al, al
je 0x5a2405
cmp esi, ebx
je 0x5a2415
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.0059f010
test al, al
jne 0x5a23f0
test esi, esi
je 0x5a2415
pop edi
lea eax, [esi + 0x20]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x40eb68
call dword [0x40e098]
int3
Function at 0x6fdff0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.HTDG1
lea edi, [esi - 0x1ca000]
mov dword [edi + 0x294b98], 0x6d7d8c42
push edi
or ebp, 0xffffffff
jmp 0x6fe01a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6fe021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fe010
mov eax, 1
add ebx, ebx
jne 0x6fe033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6fe044
jne 0x6fe063
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fe063
dec eax
add ebx, ebx
jne 0x6fe050
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6fe028
add ebx, ebx
jne 0x6fe05f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6fe0b5
xor ecx, ecx
sub eax, 3
jb 0x6fe07b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6fe0ea
sar eax, 1
mov ebp, eax
jmp 0x6fe086
add ebx, ebx
jne 0x6fe086
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fe054
inc ecx
add ebx, ebx
jne 0x6fe094
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fe054
add ebx, ebx
jne 0x6fe0a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6fe096
jne 0x6fe0b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6fe096
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6fe0d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6fe0c6
jmp 0x6fe016
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6fe0d4
add edi, ecx
jmp 0x6fe016
pop esi
mov edi, esi
mov ecx, 0xe9e2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6fe0f2
cmp byte [edi], 0x28
jne 0x6fe0f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6fe0f7
lea edi, [esi + 0x2e4000]
mov eax, dword [edi]
or eax, eax
je 0x6fe16f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x302a6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x302bfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6fe124
mov ecx, edi
jns 0x6fe153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x302c04]
or eax, eax
je 0x6fe169
mov dword [ebx], eax
add ebx, 4
jmp 0x6fe141
call dword [esi + 0x302c00]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6fe1a0
cmp al, 0xef
ja 0x6fe193
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6fe175
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6fe182
mov ebp, dword [esi + 0x302c08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6fe1d4
sub esp, 0xffffff80
jmp 0x5559f0
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x5c8bdc
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + edx*2 - 0x54f8b847], 0xe9
invalid
Function at 0x403607
Capabilities:
Terminate process

Disassembly:
jmp 0x451f99
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451faa
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403733
Capabilities:
Query environment variable

Disassembly:
jmp 0x49a9e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49a9f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049a8c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49aa1b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062bc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4057f9
Capabilities:
Parse pe header

Disassembly:
jmp 0x440d4f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x440d8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440d8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440d8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x440d8e
cmp dword [ecx + 0x74], 0xe
jbe 0x440d8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4926ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401db6
mov eax, dword [0x692444]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405eb1
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4926f0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x49284c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406014
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x6960c8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403279
mov ecx, dword [esi*4 + 0x6960c8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x492845
cmp eax, dword [edi + ecx + 0x24]
jne 0x492845
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x492845
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403279
add esp, 0x14
test edx, edx
jl 0x492845
jg 0x4927bb
test eax, eax
jb 0x492845
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x492845
jl 0x4927d5
cmp dword [ebp - 0x1008], eax
ja 0x492845
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4927f3
test ebx, ebx
je 0x49282c
cmp ecx, edi
jae 0x49282c
mov al, byte [ecx]
cmp al, 0xd
jne 0x49280d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x492819
cmp byte [ecx + 1], 0xa
jne 0x492819
inc ecx
jmp 0x492819
movzx eax, al
movsx eax, byte [eax + 0x692fb8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4927f3
cmp edx, ebx
jne 0x4927f3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x49284a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040306c
leave
ret
Function at 0x498f81
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x692444]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x498fcc
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00499443
test al, al
jne 0x498fc6
sub edx, 2
cmp edx, edi
jne 0x498fac
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x498fee
lea eax, [edi + 2]
cmp edx, eax
je 0x498fee
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00498b7a
add esp, 0x10
jmp 0x4990e8
push esi
lea ecx, [ebp - 0x255]
call fcn.00499443
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x499031
push dword [ebp - 0x25c]
jmp 0x498fde
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49906e
cmp word [ebp - 0x226], 0
je 0x49908f
cmp word [ebp - 0x226], ax
jne 0x49906e
cmp word [ebp - 0x224], 0
je 0x49908f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00498b7a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4990db
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x499048
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4990c3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4990e8
push 0x498562
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040556a
add esp, 0x10
jmp 0x4990b8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040306c
leave
ret