joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411390
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x43f2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45060c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x2e
lea ecx, [esp + 0x20]
call fcn.0040e940
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x34]
push 1
push 0x2e
push eax
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.00413af0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
movzx edx, word [eax + 4]
mov word [esi + 8], dx
movzx ecx, word [eax + 6]
mov word [esi + 0xa], cx
movzx edx, word [eax + 8]
mov word [esi + 0xc], dx
movzx ecx, word [eax + 0xa]
mov word [esi + 0xe], cx
movzx edx, word [eax + 0xc]
mov word [esi + 0x10], dx
movzx ecx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
movzx ecx, word [eax + 0x20]
movzx edx, word [eax + 0x22]
movzx ebx, word [eax + 0x1c]
movzx ebp, word [eax + 0x1e]
mov word [esi + 0x20], dx
mov dword [esp + 0x34], ecx
movzx ecx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x18]
mov dword [esi + 0x28], eax
call fcn.0040e820
mov ecx, dword [esi + 4]
cmp ecx, dword [0x44e698]
jne 0x4114f9
mov edx, dword [edi + 0x50]
movzx ebx, bx
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x1c], edx
call fcn.0040e850
mov eax, dword [esi + 0x3c]
push 1
push ebx
push eax
mov ecx, edi
call fcn.00413af0
test bp, bp
je 0x4114b5
movzx ebx, bp
push 0
push ebx
lea ecx, [esi + 0x2c]
call fcn.0040e850
mov eax, dword [esi + 0x30]
push 1
push ebx
push eax
mov ecx, edi
call fcn.00413af0
mov eax, dword [esp + 0x34]
test ax, ax
je 0x4114da
movzx ebx, ax
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.0040e850
mov esi, dword [esi + 0x48]
push 1
push ebx
push esi
mov ecx, edi
call fcn.00413af0
mov eax, dword [esp + 0x14]
cmp dword [edi + 0x50], eax
lea ecx, [esp + 0x18]
sete bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040e970
mov al, bl
jmp 0x41150c
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040e970
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x4115a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f308
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45060c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x4c]
mov ebp, dword [esi + 0x40]
mov edi, dword [esi + 0x34]
mov dword [esp + 0x18], eax
movzx eax, ax
movzx ecx, di
movzx ebx, bp
mov dword [esp + 0x1c], eax
add eax, ebx
lea eax, [eax + ecx + 0x2e]
push 0
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.0040e940
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0x28]
mov word [ecx + 4], ax
movzx edx, word [esi + 0xa]
mov eax, dword [esp + 0x28]
mov word [eax + 6], dx
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 0x28]
mov word [edx + 8], cx
movzx eax, word [esi + 0xe]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0xa], ax
movzx edx, word [esi + 0x10]
mov eax, dword [esp + 0x28]
mov word [eax + 0xc], dx
movzx ecx, word [esi + 0x12]
mov edx, dword [esp + 0x28]
mov word [edx + 0xe], cx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x28]
mov dword [eax + 0x14], edx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x18], ecx
mov eax, dword [esp + 0x28]
mov word [eax + 0x1c], bp
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov word [ecx + 0x1e], di
mov edx, dword [esp + 0x28]
mov word [edx + 0x20], bp
movzx eax, word [esi + 0x20]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0x22], ax
movzx edx, word [esi + 0x22]
mov eax, dword [esp + 0x28]
mov word [eax + 0x24], dx
mov ecx, dword [esi + 0x24]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x26], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x2a], eax
mov eax, dword [esi + 0x3c]
mov edx, dword [esp + 0x28]
push ebx
push eax
add edx, 0x2e
push edx
mov dword [esp + 0x44], 0
call fcn.0042aa20
add esp, 0xc
test di, di
je 0x4116f0
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x30]
mov edx, dword [esp + 0x28]
push ecx
push eax
lea eax, [ebx + edx + 0x2e]
push eax
call fcn.0042aa20
add esp, 0xc
test bp, bp
je 0x411715
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov esi, dword [esi + 0x48]
mov eax, dword [esp + 0x28]
push ecx
add ebx, edx
lea ecx, [ebx + eax + 0x2e]
push esi
push ecx
call fcn.0042aa20
add esp, 0xc
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
push 1
push esi
push edx
call fcn.004136c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040e970
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x412040
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret
Function at 0x4122e0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x43f460
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45060c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x30]
call fcn.0040cd80
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebx
call fcn.00412210
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
mov byte [esp + 0x60], 1
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x41240f
push 0x4423a4
lea ecx, [esp + 0x18]
call fcn.00401f20
mov esi, dword [esp + 0x14]
mov ebp, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
lea edi, [ebp + 1]
sub eax, edi
or eax, ecx
jge 0x41238c
push edi
lea ecx, [esp + 0x18]
call fcn.00401640
mov esi, dword [esp + 0x14]
cmp edi, ebx
mov byte [esi + ebp], 0x5c
jl 0x412405
cmp edi, dword [esi - 8]
jg 0x412405
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esi - 0xc], edi
push esi
mov byte [edi + esi], bl
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x41240f
lea eax, [esi - 0x10]
mov byte [esp + 0x4c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4123de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00411b00
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x80070057
call fcn.00401090
mov edi, dword [esp + 0x1c]
imul edi, dword [esp + 0x20]
imul edi, dword [esp + 0x24]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x4c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412441
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00411b00
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x412470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x412489
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push esi
call fcn.00419316
add esp, 4
mov edi, eax
push edi
push esi
mov bl, 1
call ebp
test eax, eax
jne 0x4124b2
push edi
xor bl, bl
call fcn.0041930b
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.00402e20
push edi
call fcn.0041930b
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
Function at 0x4126d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f4e1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x45060c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor esi, esi
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], esi
call fcn.00403c30
movzx ecx, byte [0x4429c1]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], esi
call fcn.00401bc0
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0x1c]
call fcn.0040cd80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 1
call fcn.0040d800
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp ecx, esi
setne dl
mov byte [esp + 0x38], 2
mov dword [esp + 0x10], 1
cmp edx, esi
jne 0x412765
push 0x80004005
call fcn.00401090
mov eax, dword [eax]
push ecx
push eax
call fcn.0042885c
add esp, 8
cmp eax, esi
sete al
or esi, 0xffffffff
test al, al
jne 0x412792
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00412080
add esp, 4
cmp eax, esi
je 0x412792
xor bl, bl
jmp 0x412794
mov bl, 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x38], 1
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4127bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x4128a4
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040d800
mov eax, dword [eax]
push eax
mov byte [esp + 0x3c], 3
call fcn.004126d0
add esp, 4
test al, al
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
mov byte [esp + 0x38], 1
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41280a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412851
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.00411b00
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x38], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41283d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004120c0
add esp, 4
test al, al
jne 0x4128a4
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], al
call fcn.00411b00
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x38], esi
lea edx, [eax + 0xc]
lock xadd dword [edx], esi
dec esi
test esi, esi
jg 0x41283d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.00411b00
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [esp + 0x38], esi
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x4128d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x41d2e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x41d308
cmp dword [edi + 0x54], 0
jne 0x41d308
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00419fe8
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041d2a5
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x423e33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x423e7a
call fcn.00419fe8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x423e7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x423e96
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004239ad
mov esi, eax
test edi, edi
je 0x423e94
test ebx, ebx
je 0x423e94
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x429433
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45060c]
jne 0x42943d
repz ret
jmp fcn.00431adc

Function at 0x4299ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x429a20
call fcn.0042b6ef
mov dword [eax], esi
call fcn.0042b6dc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0042feff
add esp, 0x14
push 0x16
pop eax
jmp 0x429a75
test dword [ebp + 0xc], 0xfffffff9
jne 0x4299fc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x429a4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042b702
pop ecx
call fcn.0042b6dc
mov eax, dword [eax]
jmp 0x429a75
test al, 0x10
jne 0x429a73
test al, 1
je 0x429a73
test byte [ebp + 0xc], 2
je 0x429a73
call fcn.0042b6ef
mov dword [eax], 5
call fcn.0042b6dc
mov dword [eax], 0xd
jmp 0x429a44
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10115f77
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.10115ff6
jae 0x10115f83
xor ecx, ecx
call fcn.10115ff6
jae 0x10115fad
xor eax, eax
call fcn.10115ff6
jae 0x10115fbe
mov al, 0x10
call fcn.10115ff6
adc al, al
jae 0x10115f9f
jne 0x10115feb
stosb byte es:[edi], al
jmp 0x10115f84
call fcn.10116002
dec ecx
loop 0x10115fca
mov eax, ebp
call fcn.10116000
jmp 0x10115fec
lodsb al, byte [esi]
shr eax, 1
je 0x10116012
adc ecx, 2
mov ebp, eax
jmp 0x10115fec
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10116000
cmp eax, 0x7d00
jae 0x10115fea
cmp eax, 0x500
jae 0x10115feb
cmp eax, 0x7f
ja 0x10115fec
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10115f84
pop ebp
ret 8
Function at 0x61d08f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x3671d190
btr edx, esp
cmc
jmp 0x61d09c
xchg byte [esp + 1], al
mov ebx, dword [edx + esi]
bsr dx, bp
jmp 0x61d0e2
mov dword [ebp], ebx
mov al, ah
lea ebx, [esi + 0x666dc995]
mov bl, bh
rdtsc
jmp fcn.0061d0be
cmc
jmp 0x61d09c
jge 0x61d072
mov edx, 0x3671d190
btr edx, esp
jmp 0x61d0bb

Function at 0x63ae34
Capabilities:
Encrypt data using aes

Disassembly:
shr eax, 0x10
mov bp, bx
push edx
jmp 0x63ad7b
mov eax, edx
pushal
mov byte [esp + 9], ch
pop ebx
not di
jmp 0x63ad53
lea esp, [esp + 0x2c]
mov esi, 0xff
mov bx, word [esp]
bswap edi
xchg ebp, edi
jmp 0x63adc6
add al, bh
mov dword [ecx + 0xc], edx
rcr edi, 0x11
mov edi, esp
mov bl, 0xf8
jmp 0x63ad6e
bsf bp, ax
neg ebx
bswap edi
xor eax, 0x1000000
mov bl, 0xb2
jmp 0x63addc
mov di, word [esp]
and eax, esi
mov eax, dword [eax*4 + 0x618f68]
lea ebp, [edi*4]
jmp 0x63ada8
mov edi, edx
neg bl
jmp 0x63ae08
lea edi, [eax*4]
sub esp, 4
btr esi, esp
xor edx, eax
mov edi, dword [esp]
jmp 0x63ad9a
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x618f68]
jmp 0x63ae1a
btc ebx, edi
and edi, 0xff0000
call 0x63aeb1
cmp ebp, dword [esi + 0x73b65b3c]
aas
push es
mov cl, 0xb0
mov bl, 0xaa
setle bl
not esi
shl edx, 8
or edi, eax
jmp 0x63adf4

Function at 0x63b013
Capabilities:
Encrypt data using aes

Disassembly:
mov ebp, 0xff00
clc
and edi, ebp
clc
sub esp, 2
jmp 0x63aedc
and edi, esi
mov edi, dword [edi*4 + 0x618f68]
lea esp, [esp + 8]
jmp 0x63af05
xchg bx, cx
sub esp, 6
pop word [esp + 1]
mov dword [esp + 4], edx
lea esp, [esp + 4]
popal
jmp 0x63af26
push dword [esp + 2]
pushal
jmp 0x63af86

Function at 0x640899
Capabilities:
Hash data with md5

Disassembly:
mov dword [esp], ecx
mov dword [esp], eax
lea esp, [esp + 4]
jmp 0x6408a9
mov dword [eax + 4], 0
push esp
jmp 0x64097c
mov dword [eax + 0xc], 0xefcdab89
jmp 0x64091f
mov word [esp], di
mov dword [esp], esi
lea esp, [esp + 4]
mov dword [eax + 8], 0x67452301
jmp 0x6408d3
mov dword [eax + 0x14], 0x10325476
ret
mov dword [eax + 0x10], 0x98badcfe
push esp
mov word [esp], sp
lea esp, [esp + 4]
jmp 0x640900
lea esp, [esp + 4]
mov dword [eax], 0
push edx
mov byte [esp + 2], bh
jmp 0x6408ec

Function at 0x6e5ec3
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp + 2], bh
call 0x6e5e78
jmp 0x6e5ea0
Function at 0x416420
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48642b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00478819
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4164a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00475d8d
mov eax, dword [eax]
push 0x4b71e0
push eax
call fcn.004680a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00478aa4
test bl, bl
je 0x4164a2
push 0x4b71e0
lea ecx, [esp + 0xc]
call fcn.00478e80
push 0x4bad5c
lea ecx, [esp + 0xc]
call fcn.00478e80
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4164de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00478aa4
jmp 0x4165a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x416562
lea edx, [esp + 0x7c]
push 0x4bad58
push edx
call fcn.004680a4
add esp, 8
test eax, eax
je 0x416562
lea eax, [esp + 0x7c]
push 0x4bad54
push eax
call fcn.004680a4
add esp, 8
test eax, eax
je 0x416562
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4164f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00478aa4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x416da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x416e02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x416e10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4864ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c1f1c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x416f48
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x416e76
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00478aa4
xor eax, eax
jmp 0x416fbf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00478c2d
push esi
lea ecx, [esp + 0xc]
call fcn.00478ebc
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x416f9d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.00416da0
test eax, eax
jne 0x416f9d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.00416da0
test eax, eax
jne 0x416f9d
lea eax, [esp + 0x14]
push 0x4bad70
push eax
call fcn.00469180
mov esi, eax
add esp, 8
test esi, esi
jne 0x416f7c
lea ecx, [esp + 0x14]
push 0x4bad6c
push ecx
call fcn.00469100
mov esi, eax
add esp, 8
test esi, esi
jne 0x416f7c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x416f7f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00478bdd
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x416e8e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00478aa4
xor eax, eax
jmp 0x416fbf
mov byte [esi], 0
push 0x4bad68
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00478aa4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4