joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525910
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, eax
shr edi, 3
and eax, 7
mov ebp, eax
test edi, edi
jbe 0x52594f
mov edi, edi
mov eax, dword [ebx]
xor dword [esi], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor dword [esi + 4], ecx
push esi
push edx
call fcn.00525770
mov ebx, esi
dec edi
add esi, 8
test edi, edi
ja 0x525930
test ebp, ebp
je 0x52597b
mov eax, ebx
jbe 0x525970
sub esi, ebx
mov edi, ebp
jmp 0x525960
mov dl, byte [eax]
mov cl, byte [esi + eax]
mov byte [esi + eax], dl
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x525960
mov eax, dword [esp + 0x14]
push ebx
push eax
call fcn.00525770
mov ecx, dword [ebx]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], ecx
mov edx, dword [ebx + 4]
pop ebp
mov dword [eax + 4], edx
pop ebx
ret 0x10

Function at 0x525990
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
push ebp
mov ebx, eax
push esi
mov esi, dword [esp + 0x2c]
shr ebx, 3
and eax, 7
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
je 0x5259d4
sub ebx, 1
jne 0x5259d4
mov ecx, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x18], ecx
jmp 0x525a18
test ebx, ebx
jbe 0x525a14
jmp 0x5259e0
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ebp, dword [esi + 4]
push esi
push eax
mov dword [esp + 0x20], edx
call fcn.00525810
mov ecx, dword [edi]
xor dword [esi], ecx
mov edx, dword [edi + 4]
xor dword [esi + 4], edx
mov eax, dword [esp + 0x18]
add esi, 4
add esi, 4
sub ebx, 1
mov dword [edi], eax
mov dword [edi + 4], ebp
jne 0x5259e0
jmp 0x525a18
mov ebp, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x525a69
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [esi + 4]
push esi
push eax
mov dword [edi + 4], edx
call fcn.00525810
mov edx, dword [esp + 0x14]
lea eax, [esi + 8]
test edx, edx
jbe 0x525a55
mov edi, esi
sub edi, eax
mov cl, byte [eax]
mov bl, byte [edi + eax]
xor bl, cl
mov byte [eax], bl
mov byte [edi + eax], cl
inc eax
sub edx, 1
jne 0x525a43
mov ecx, dword [esp + 0x10]
push esi
push ecx
call fcn.00525810
mov edx, dword [esp + 0x18]
xor dword [esi], edx
xor dword [esi + 4], ebp
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x14
ret 0x10

Function at 0x526a8a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463df0]
jne 0x526a94
repz ret
jmp fcn.0052df7c
Function at 0x538122
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00527a82
and dword [ebp - 4], 0
cmp dword [0x59f2c8], 0
mov ebx, eax
jne 0x5381d3
push 0x4714d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x538284
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4714c8
push edi
call esi
test eax, eax
je 0x538284
push eax
call fcn.00527a10
mov dword [esp], 0x4714b8
push edi
mov dword [0x59f2c8], eax
call esi
push eax
call fcn.00527a10
mov dword [esp], 0x4714a4
push edi
mov dword [0x59f2cc], eax
call esi
push eax
call fcn.00527a10
mov dword [esp], 0x46d688
push edi
mov dword [0x59f2d0], eax
call esi
push eax
call fcn.00527a10
pop ecx
mov dword [0x59f2d8], eax
test eax, eax
je 0x5381d3
push 0x46d6a4
push edi
call esi
push eax
call fcn.00527a10
pop ecx
mov dword [0x59f2d4], eax
mov eax, dword [0x59f2d4]
cmp eax, ebx
je 0x53822b
cmp dword [0x59f2d8], ebx
je 0x53822b
push eax
call fcn.00527a8b
push dword [0x59f2d8]
mov esi, eax
call fcn.00527a8b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53822b
test edi, edi
je 0x53822b
call esi
test eax, eax
je 0x538222
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x538222
test byte [ebp - 0xc], 1
jne 0x53822b
or dword [ebp + 0x10], 0x200000
jmp 0x538264
mov eax, dword [0x59f2cc]
cmp eax, ebx
je 0x538264
push eax
call fcn.00527a8b
pop ecx
test eax, eax
je 0x538264
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x538264
mov eax, dword [0x59f2d0]
cmp eax, ebx
je 0x538264
push eax
call fcn.00527a8b
pop ecx
test eax, eax
je 0x538264
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x59f2c8]
call fcn.00527a8b
pop ecx
test eax, eax
je 0x538284
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x538286
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53d990
Capabilities:
Encrypt data using speck

Disassembly:
sub esp, 0x2c
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x28], eax
cmp byte [0x59f4ac], 0
jne 0x53dbdb
xor eax, eax
lea ecx, [ecx]
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 0x1b
jl 0x53d9b0
push ebx
push ebp
push esi
mov ebp, 0x1b
lea eax, [esp + 0x32]
push edi
mov edi, dword [esp + 0x40]
mov esi, 0x1a
sub ebp, eax
lea ecx, [esp + esi + 0x1c]
mov eax, edi
imul edi, edi, 0x6255
xor edx, edx
lea ebx, [ecx + ebp]
div ebx
mov bl, byte [ecx]
add edi, 0x3619
dec esi
and edi, 0xffff
cmp esi, 1
lea eax, [esp + edx + 0x1c]
mov dl, byte [eax]
mov byte [ecx], dl
mov byte [eax], bl
jge 0x53d9d2
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x18], ebp
jmp 0x53da10
movzx esi, byte [esp + ebp + 0x1c]
cmp esi, 0x10
jb 0x53da21
mov edi, 6
jmp 0x53da4d
cmp esi, 8
jb 0x53da2d
mov edi, 5
jmp 0x53da4d
cmp esi, 4
jb 0x53da39
mov edi, 4
jmp 0x53da4d
cmp esi, 2
jb 0x53da45
mov edi, 3
jmp 0x53da4d
cmp esi, 1
sbb edi, edi
add edi, 2
mov dl, bl
and dl, 7
movzx ebp, dl
lea ecx, [edi + ebp]
mov eax, 1
shl eax, cl
mov ecx, 1
mov dword [esp + 0x14], ecx
mov ecx, ebp
mov ebp, dword [esp + 0x14]
shl ebp, cl
dec eax
mov byte [esi*4 + 0x59f443], dl
mov ecx, ebx
dec ebp
xor eax, ebp
mov ebp, dword [esp + 0x18]
movzx edx, byte [esp + ebp + 0x1d]
shr ecx, 3
mov byte [esi*4 + 0x59f441], al
shr eax, 8
add ebx, edi
mov byte [esi*4 + 0x59f440], cl
mov byte [esi*4 + 0x59f442], al
cmp edx, 0x10
jb 0x53daaf
mov esi, 6
jmp 0x53dadb
cmp edx, 8
jb 0x53dabb
mov esi, 5
jmp 0x53dadb
cmp edx, 4
jb 0x53dac7
mov esi, 4
jmp 0x53dadb
cmp edx, 2
jb 0x53dad3
mov esi, 3
jmp 0x53dadb
cmp edx, 1
sbb esi, esi
add esi, 2
mov al, bl
and al, 7
movzx edi, al
mov byte [esp + 0x13], al
lea ecx, [edi + esi]
mov eax, 1
shl eax, cl
mov ecx, 1
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edi, dword [esp + 0x14]
shl edi, cl
mov ecx, ebx
shr ecx, 3
mov byte [edx*4 + 0x59f440], cl
mov cl, byte [esp + 0x13]
dec eax
dec edi
xor eax, edi
mov byte [edx*4 + 0x59f443], cl
mov byte [edx*4 + 0x59f441], al
shr eax, 8
mov byte [edx*4 + 0x59f442], al
movzx edx, byte [esp + ebp + 0x1e]
add ebx, esi
cmp edx, 0x10
jb 0x53db40
mov esi, 6
jmp 0x53db6c
cmp edx, 8
jb 0x53db4c
mov esi, 5
jmp 0x53db6c
cmp edx, 4
jb 0x53db58
mov esi, 4
jmp 0x53db6c
cmp edx, 2
jb 0x53db64
mov esi, 3
jmp 0x53db6c
cmp edx, 1
sbb esi, esi
add esi, 2
mov al, bl
and al, 7
movzx edi, al
mov byte [esp + 0x13], al
lea ecx, [edi + esi]
mov eax, 1
shl eax, cl
mov ecx, 1
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edi, dword [esp + 0x14]
shl edi, cl
mov ecx, ebx
shr ecx, 3
mov byte [edx*4 + 0x59f440], cl
mov cl, byte [esp + 0x13]
dec eax
dec edi
xor eax, edi
mov byte [edx*4 + 0x59f443], cl
mov byte [edx*4 + 0x59f441], al
add ebp, 3
shr eax, 8
add ebx, esi
cmp ebp, 0x1b
mov byte [edx*4 + 0x59f442], al
mov dword [esp + 0x18], ebp
jl 0x53da10
pop edi
pop esi
pop ebp
mov byte [0x59f4ac], 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00526a8a
add esp, 0x2c
ret 4
Function at 0x53dbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea edi, [ebx*4 + 0x59f43c]
mov dword [esp + 0x10], ecx
dec ebx
lea esp, [esp]
movzx eax, byte [edi]
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx + eax]
add ecx, eax
movzx eax, byte [edi + 1]
and eax, edx
mov dl, byte [edi + 2]
test dl, dl
je 0x53dc38
movzx ecx, byte [ecx + 1]
movzx edx, dl
and ecx, edx
shl ecx, 8
or eax, ecx
mov cl, byte [edi + 3]
shr eax, cl
test ebx, ebx
je 0x53dc97
mov ecx, ebx
mov esi, 1
shl esi, cl
test ebp, esi
setne cl
mov byte [esp + 0x1c], cl
test al, 1
je 0x53dc60
test cl, cl
sete cl
mov byte [esp + 0x1c], cl
shr eax, 1
xor edx, edx
div ebx
mov eax, 1
mov ecx, edx
shl eax, cl
test ebp, eax
je 0x53dc77
or ebp, esi
jmp 0x53dc7b
not esi
and ebp, esi
cmp byte [esp + 0x1c], 0
je 0x53dc8a
or ebp, eax
dec ebx
sub edi, 4
jmp 0x53dc10
not eax
and ebp, eax
dec ebx
sub edi, 4
jmp 0x53dc10
test al, 1
je 0x53dc9e
xor ebp, 1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x7c912440
Capabilities:
Parse pe header

Disassembly:
add byte ss:[eax], al
outsb dx, byte [esi]
add byte ss:[eax], al
ja 0x7c91247f
add byte [eax], al
xor byte [esi], 0
add byte [ecx - 0x6dffffca], cl
add byte ss:[eax], al
wait
add byte ss:[eax], al
movsb byte es:[edi], byte [esi]
add byte ss:[eax], al
lodsd eax, dword [esi]
add byte ss:[eax], al
mov dh, 0x36
add byte [eax], al
sal byte [esi], 0
add cl, cl
add byte ss:[eax], al
into
add byte ss:[eax], al
aam 0x36
add byte [eax], al
fnstenv [esi]
add byte [eax], al
in al, 0x36
add byte [eax], al
out dx, al
add byte ss:[eax], al
add byte ss:[eax], al
clc
add byte ss:[eax], al
add byte [edi], dh
add byte [eax], al
pop es
aaa
add byte [eax], al
or eax, 0x14000037
aaa
add byte [eax], al
sbb al, 0x37
add byte [eax], al
daa
aaa
add byte [eax], al
xor dword [edi], esi
add byte [eax], al
cmp eax, 0x46000037
aaa
add byte [eax], al
push ecx
aaa
add byte [eax], al
pop eax
aaa
add byte [eax], al
pop edi
aaa
add byte [eax], al
aaa
add byte [eax], al
insd dword es:[edi], dx
aaa
add byte [eax], al
jbe 0x7c9124fc
add byte [eax], al
jle sym.NTDLL.dll__________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVW
add byte [eax], al
mov byte [edi], dh
add byte [eax], al
invalid
aaa
add byte [eax], al
invalid

Function at 0x7c912520
Capabilities:
Parse pe header

Disassembly:
cmp byte [eax], al
add byte [edx], bl
cmp byte [eax], al
add byte [edx], ah
cmp byte [eax], al
add byte [ecx], ch
cmp byte [eax], al
add byte [ebx], dh

Function at 0x7c912530
Capabilities:
Parse pe header

Disassembly:
cmp byte [eax], al
add byte [ebx], bh
cmp byte [eax], al
add byte [edx + 0x38], al
add byte [eax], al
inc esi
cmp byte [eax], al
add byte [ebx + 0x38], cl
cmp byte [eax], al
add byte [ebx + 0x38], dl
add byte [eax], al
pop ebp
cmp byte [eax], al
add byte [edx + 0x38], ah
add byte [eax], al
push 0x6f000038
cmp byte [eax], al
add byte [edi + 0x38], ch
add byte [eax], al
js 0x7c912591
add byte [eax], al
jg 0x7c912595
add byte [eax], al
mov byte [eax], bh
cmp byte [eax], al
invalid
invalid
add byte [eax], al
cld
cmp byte [eax], al
add byte [esi], al
cmp dword [eax], eax
add byte [esi], cl
cmp dword [eax], eax
add byte [esi], dl
cmp dword [eax], eax
add byte [esi], bl
cmp dword [eax], eax
add byte [0x2c000039], ah
cmp dword [eax], eax
add byte [ebx], dh
cmp dword [eax], eax
add byte [edx], bh
cmp dword [eax], eax
add byte [ebx + 0x39], al
add byte [eax], al
dec edx
cmp dword [eax], eax
add byte [edx + 0x39], dl
add byte [eax], al
pop edx
cmp dword [eax], eax
add byte [ebx + 0x39], ah
add byte [eax], al
outsb dx, byte [esi]
cmp dword [eax], eax
add byte [esi + 0x39], dh
add byte [eax], al
cmp byte [ecx], 0
add byte [edi - 0x74ffffc7], al
cmp dword [eax], eax
add byte [eax - 0x6affffc7], dl
cmp dword [eax], eax
add byte [ebp - 0x58ffffc7], bl
cmp dword [eax], eax
add byte [esi - 0x48ffffc7], ch
cmp dword [eax], eax
add byte [edi - 0x38ffffc7], bh
cmp dword [eax], eax
add al, dl
cmp dword [eax], eax
add cl, bl
cmp dword [eax], eax
add al, ah
cmp dword [eax], eax
add al, ch
Function at 0x7c912540
Capabilities:
Parse pe header

Disassembly:
cmp byte [eax], al
add byte [ebx], bh
cmp byte [eax], al
add byte [edx + 0x38], al
add byte [eax], al
inc esi
cmp byte [eax], al
add byte [ebx + 0x38], cl
cmp byte [eax], al
add byte [ebx + 0x38], dl
add byte [eax], al
pop ebp
cmp byte [eax], al
add byte [edx + 0x38], ah
add byte [eax], al
push 0x6f000038
cmp byte [eax], al
add byte [edi + 0x38], ch
add byte [eax], al
js 0x7c912591
add byte [eax], al
jg 0x7c912595
add byte [eax], al
mov byte [eax], bh
cmp byte [eax], al
invalid
invalid
add byte [eax], al
cld
cmp byte [eax], al
add byte [esi], al
cmp dword [eax], eax
add byte [esi], cl
cmp dword [eax], eax
add byte [esi], dl
cmp dword [eax], eax
add byte [esi], bl
cmp dword [eax], eax
add byte [0x2c000039], ah
cmp dword [eax], eax
add byte [ebx], dh
cmp dword [eax], eax
add byte [edx], bh
cmp dword [eax], eax
add byte [ebx + 0x39], al
add byte [eax], al
dec edx
cmp dword [eax], eax
add byte [edx + 0x39], dl
add byte [eax], al
pop edx
cmp dword [eax], eax
add byte [ebx + 0x39], ah
add byte [eax], al
outsb dx, byte [esi]
cmp dword [eax], eax
add byte [esi + 0x39], dh
add byte [eax], al
cmp byte [ecx], 0
add byte [edi - 0x74ffffc7], al
cmp dword [eax], eax
add byte [eax - 0x6affffc7], dl
cmp dword [eax], eax
add byte [ebp - 0x58ffffc7], bl
cmp dword [eax], eax
add byte [esi - 0x48ffffc7], ch
cmp dword [eax], eax
add byte [edi - 0x38ffffc7], bh
cmp dword [eax], eax
add al, dl
cmp dword [eax], eax
add cl, bl
cmp dword [eax], eax
add al, ah
cmp dword [eax], eax
add al, ch

Function at 0x7c912550
Capabilities:
Parse pe header

Disassembly:
cmp byte [eax], al
add byte [ebx], bh
cmp byte [eax], al
add byte [edx + 0x38], al
add byte [eax], al
inc esi
cmp byte [eax], al
add byte [ebx + 0x38], cl
cmp byte [eax], al
add byte [ebx + 0x38], dl
add byte [eax], al
pop ebp
cmp byte [eax], al
add byte [edx + 0x38], ah
add byte [eax], al
push 0x6f000038
cmp byte [eax], al
add byte [edi + 0x38], ch
add byte [eax], al
js 0x7c912591
add byte [eax], al
jg 0x7c912595
add byte [eax], al
mov byte [eax], bh
cmp byte [eax], al
invalid
invalid
add byte [eax], al
cld
cmp byte [eax], al
add byte [esi], al
cmp dword [eax], eax
add byte [esi], cl
cmp dword [eax], eax
add byte [esi], dl
cmp dword [eax], eax
add byte [esi], bl
cmp dword [eax], eax
add byte [0x2c000039], ah
cmp dword [eax], eax
add byte [ebx], dh
cmp dword [eax], eax
add byte [edx], bh
cmp dword [eax], eax
add byte [ebx + 0x39], al
add byte [eax], al
dec edx
cmp dword [eax], eax
add byte [edx + 0x39], dl
add byte [eax], al
pop edx
cmp dword [eax], eax
add byte [ebx + 0x39], ah
add byte [eax], al
outsb dx, byte [esi]
cmp dword [eax], eax
add byte [esi + 0x39], dh
add byte [eax], al
cmp byte [ecx], 0
add byte [edi - 0x74ffffc7], al
cmp dword [eax], eax
add byte [eax - 0x6affffc7], dl
cmp dword [eax], eax
add byte [ebp - 0x58ffffc7], bl
cmp dword [eax], eax
add byte [esi - 0x48ffffc7], ch
cmp dword [eax], eax
add byte [edi - 0x38ffffc7], bh
cmp dword [eax], eax
add al, dl
cmp dword [eax], eax
add cl, bl
cmp dword [eax], eax
add al, ah
cmp dword [eax], eax
add al, ch
Function at 0x7c912830
Capabilities:
Parse pe header

Disassembly:
add byte [eax - 0x55ff5700], ch
add byte [ebx - 0x52ff5400], ch
add byte [esi - 0x4fff5100], ch
add byte [ecx - 0x4cff4e00], dh
add byte [eax + eax + 0xb600b5], dh
mov bh, 0
mov eax, 0xba00b900
add byte [ebx - 0x42ff4400], bh
add byte [esi - 0x3fff4100], bh
add cl, al
add dl, al
add bl, al
add ah, al
add ch, al
add dh, al
add bh, al

Function at 0x7c912870
Capabilities:
Parse pe header

Disassembly:
add al, cl
add cl, cl
add dl, cl
add bl, cl
add ah, cl
add ch, cl
add dh, cl
add bh, cl

Function at 0x7c912880
Capabilities:
Parse pe header

Disassembly:
add al, dl
add cl, dl
add dl, dl
add bl, dl
add ah, dl
add ch, dl
add dh, dl
add bh, dl
add al, bl
add cl, bl
add dl, bl
add bl, bl
add byte [esi], dh
add ah, bl
add ch, bl
add dh, bl

Function at 0x7c9128a0
Capabilities:
Parse pe header

Disassembly:
add bh, bl
add al, ah
add cl, ah
add dl, ah
add bl, ah
add ah, ah
add ch, ah
add dh, ah

Function at 0x7c9128b0
Capabilities:
Parse pe header

Disassembly:
add bh, ah
add al, ch
add cl, ch
add dl, ch
add bl, ch
add ah, ch
add ch, ch
add dh, ch

Function at 0x7c9128c0
Capabilities:
Parse pe header

Disassembly:
add bh, ch
add al, dh
add cl, dh
add dl, dh
add bl, dh
add ah, dh
add ch, dh
add dh, dh
add bh, dh
add al, bh
add cl, bh
add dl, bh
add bl, bh
add ah, bh
add ch, bh
add dh, bh
add bh, bh
add byte [eax], al
add dword [ecx], eax
add dword [edx], eax
add dword [ebx], eax
add dword [ecx + eax], eax
add eax, 0x7010601
add dword [eax], ecx
add dword [ecx], ecx
add dword [edx], ecx
add dword [ebx], ecx
add dword [ecx + eax], ecx
or eax, 0xf010e01
add dword [eax], edx
add dword [ecx], edx
add dword [edx], edx
add dword [ebx], edx
add dword [ecx + eax], edx
adc eax, 0x17011601
add dword [eax], ebx
add dword [ecx], ebx
add dword [edx], ebx
add dword [ebx], ebx
add dword [ecx + eax], ebx
sbb eax, 0x1f011e01
add dword [eax], esp
add dword [ecx], esp
add dword [edx], esp
add dword [ebx], esp
add dword [ecx + eax], esp
and eax, 0x27012601
add dword [eax], ebp
add dword [ecx], ebp
add dword [edx], ebp
add dword [ebx], ebp
add dword [ecx + eax], ebp
sub eax, 0x2f012e01
add dword [eax], esi
add dword [ecx], esi
add dword [edx], esi
add dword [ebx], esi
add dword [ecx + eax], esi
xor eax, 0x37013601
add dword [eax], edi
add dword [ecx], edi
add dword [edx], edi
add dword [ebx], edi
add dword [ecx + eax], edi
cmp eax, 0x3f013e01
add dword [edi], edi

Function at 0x7c912970
Capabilities:
Parse pe header

Disassembly:
add dword [edi + 1], eax
dec eax
add dword [ecx + 1], ecx
dec edx
add dword [ebx + 1], ecx
dec esp
add dword [ebp + 1], ecx
dec esi
add dword [edi + 1], ecx
push eax
add dword [ecx + 1], edx
push edx
add dword [ebx + 1], edx
push esp
add dword [ebp + 1], edx
push esi
add dword [edi + 1], edx
pop eax
add dword [ecx + 1], ebx
pop edx
add dword [ebx + 1], ebx
pop esp
add dword [ebp + 1], ebx
pop esi

Function at 0x7c9129a0
Capabilities:
Parse pe header

Disassembly:
add dword [edi + 1], ebx
pushal
add dword [ecx + 1], esp
bound eax, qword [ecx]
arpl word [ecx], ax
add dword fs:[ebp + 1], esp
add word [edi + 1], sp
add dword [edi + 1], esp
Function at 0x7c9129b0
Capabilities:
Parse pe header

Disassembly:
add dword [edi + 1], esp
push 0x6a016901
add dword [ebx + 1], ebp
insb byte es:[edi], dx
add dword [ebp + 1], ebp
outsb dx, byte [esi]
Function at 0x7c912c50
Capabilities:
Parse pe header

Disassembly:
add dh, byte [edi - 0x46fd47fe]
add bh, byte [edx - 0x43fd44fe]
add bh, byte [ebp - 0x40fd41fe]
add al, al

Function at 0x7c912ce0
Capabilities:
Parse pe header

Disassembly:
add bh, bh
add al, byte [eax]
add eax, dword [ecx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx + eax]
add eax, 0x7030603
add ecx, dword [eax]
add ecx, dword [ecx]
add ecx, dword [edx]
add ecx, dword [ebx]
add ecx, dword [ebx + eax]
or eax, 0xf030e03
add edx, dword [eax]
add edx, dword [ecx]
add edx, dword [edx]
add edx, dword [ebx]
add edx, dword [ebx + eax]
adc eax, 0x17031603
add ebx, dword [eax]
add ebx, dword [ecx]
add ebx, dword [edx]
add ebx, dword [ebx]
add ebx, dword [0x1e031c03]
add ebx, dword [edi]
add esp, dword [eax]
add esp, dword [ecx]
add esp, dword [edx]
add esp, dword [ebx]
add esp, dword [ebx + eax]
and eax, 0x27032603
add ebp, dword [eax]
add ebp, dword [ecx]
add ebp, dword [edx]
add ebp, dword [ebx]
add ebp, dword [ebx + eax]
sub eax, 0x2f032e03
add esi, dword [eax]
add esi, dword [ecx]
add esi, dword [edx]
add esi, dword [ebx]
add esi, dword [ebx + eax]
xor eax, 0x37033603
add edi, dword [eax]
add edi, dword [ecx]
add edi, dword [edx]
add edi, dword [ebx]
add edi, dword [ebx + eax]
cmp eax, 0x3f033e03
add eax, dword [eax + 3]
inc ecx
add eax, dword [edx + 3]
inc ebx
add eax, dword [ebx + eax + 0x45]
add eax, dword [esi + 3]
inc edi
add ecx, dword [eax + 3]
dec ecx
add ecx, dword [edx + 3]
dec ebx
add ecx, dword [ebx + eax + 0x4d]
add ecx, dword [esi + 3]
dec edi
add edx, dword [eax + 3]
push ecx
add edx, dword [edx + 3]
push ebx
add edx, dword [ebx + eax + 0x55]
add edx, dword [esi + 3]
push edi
add ebx, dword [eax + 3]
pop ecx
add ebx, dword [edx + 3]
pop ebx
add ebx, dword [ebx + eax + 0x5d]
add ebx, dword [esi + 3]
pop edi
add esp, dword [eax + 3]
popal
add esp, dword [edx + 3]
arpl word [ebx], ax
add esp, dword fs:[ebp + 3]
add sp, word [edi + 3]
push 0x6a036903
add ebp, dword [ebx + 3]
insb byte es:[edi], dx
add ebp, dword [ebp + 3]
outsb dx, byte [esi]
Function at 0x40c080
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47578b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00468248
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40c102
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00465a5d
mov eax, dword [eax]
push 0x6531d0
push eax
call fcn.00458714
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004684d3
test bl, bl
je 0x40c102
push 0x6531d0
lea ecx, [esp + 0xc]
call fcn.004688af
push 0x656d6c
lea ecx, [esp + 0xc]
call fcn.004688af
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40c13e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004684d3
jmp 0x40c209
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40c1c2
lea edx, [esp + 0x7c]
push 0x656d68
push edx
call fcn.00458714
add esp, 8
test eax, eax
je 0x40c1c2
lea eax, [esp + 0x7c]
push 0x656d64
push eax
call fcn.00458714
add esp, 8
test eax, eax
je 0x40c1c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c152
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004684d3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ca00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ca62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc