joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100411a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
xor esi, esi
push esi
push 0x20006
push esi
push esi
push esi
push 0x1008180
push 0x80000002
call ebp
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x1004225
cmp dword [esp + 0x10], 1
jne 0x10041a1
push 0x1008400
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x1008400
push 1
push esi
push 0x100152c
push dword [esp + 0x28]
call edi
push 0x1008620
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x1008620
push 1
push esi
push 0x1001520
push dword [esp + 0x28]
call edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x10014e8
push 0x80000001
call ebp
test eax, eax
jne 0x100421b
cmp dword [esp + 0x10], 1
jne 0x100421b
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1001498
push 0x80000001
call ebp
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1001458
push 0x80000001
call ebp
push dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebp
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
push eax
push 0x20007
push esi
push 0x100142c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10042b7
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push esi
push 0x100141c
push dword [esp + 0x2c]
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10042ad
cmp dword [esp + 0x1c], esi
jne 0x10042ad
mov ebp, 0x1008760
push ebp
call ebx
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push esi
push 0x100141c
push dword [esp + 0x2c]
call edi
mov ebp, 0x1007880
push ebp
call ebx
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push esi
push 0x100140c
push dword [esp + 0x2c]
call edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10058b6
Capabilities:
Parse pe header

Disassembly:
sbb dword [ecx + 0x62], esp
and dword [ebx + 0x2019a422], ecx
stosb byte es:[edi], al
sbb ax, 0x9580
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmc
or al, 0x20
and byte [ecx + 9], dh
fistp word [eax - 0x17a3dedf]
jp 0x10058be
movsd dword es:[edi], dword [esi]
ljmp 0xf5a6
mov dword [ecx + 0x71212121], esp
and byte [esi], dh
and dword [edx + 0x62], esp
and dword [esi + 0x20207da6], ebp
jge 0x10058d8
and byte [eax], ah
mov dword [edx], esp
xor dword [ecx], esp
and dword [ecx - 0x52], esi
jge 0x10058d8
and byte [eax], ah
mov dword [edx], esp
xor dword [ecx], esp
and dword [ecx - 0x52], esi
cmpsb byte [esi], byte es:[edi]
cmc
or al, 0x20
and byte [ecx + 0x20], dh
sbb dword ss:[ecx + 0x62], esp
and dword [ecx + ebx + 0x1d66aa20], esp
xchg esi, eax
scasb al, byte es:[edi]
and byte [edx + 0x36961d66], ch
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmc
or al, 0x20
and byte [edi + 0x71], dh
and byte [esi], dh
and dword [edx + 0x62], esp
and dword [ecx + 0xa], edx
xchg ebp, eax
and esp, dword [ecx]
and dword [esi + 0x7274296e], ebp
and byte [esi - 0x5b], dl
bound esp, qword gs:[ecx]
and byte [esi + 0x75], dl
bound esp, qword gs:[ecx]
jno 0x100591d
sub dword ss:[edx + 0x62], esp
and dword [eax], esp
xchg esi, eax
sbb eax, 0x61bd3620
bound esp, qword [ecx]
pop edx
jle 0x1005943
mov esp, dword [ebx]
jg 0x10058a8
and al, 0xaa
xchg esi, eax
xor eax, 0xae359620
add ax, 0x7eaa
sbb dword [ecx - 0x52], esi
stosb byte es:[edi], al
jle 0x1005938
jno 0x10058cf
sbb word [ecx + 0x74], si
or dword [0x20212124], esi
xchg esi, eax
xor eax, 0xcf5a6ae
and byte [eax], ah
and byte [esi + 0x19962005], dl
jno 0x1005944
sbb dword [ecx + 9], esi
pop edx
and dword es:[ecx], esp
movsb byte es:[edi], byte [esi]
in eax, 0x41
pop edx
jle 0x100595e
sbb dword [ebp + 0x19962032], edx
js 0x100596c
xchg ebp, eax
xor ah, byte [eax]
xchg esi, eax
sbb dword [eax + 0x20], edi
jne 0x10059b1
bound esp, qword [ecx]
jno 0x1005973
test dword ss:[edx + 0x62], esp
and dword [esi + 0x200cf5a6], ebp
and byte [ecx + 9], dh
jno 0x1005969
mov ds, word [edx - 0x5185dedf]
cmpsb byte [esi], byte es:[edi]
jge 0x1005989
and byte [eax], ah
js 0x10059de
jno 0x100591c
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmc
or al, 0x20
and byte [ecx + 0x20], dh
jno 0x1005995
sbb dword ss:[ecx + 0x62], esp
and dword [esi + 0x66aa296e], ebp
sbb eax, 0x36207172
int1
popal
bound eax, qword [eax]
add edi, edi
xor eax, 0x10070c8
push dword [0x10070c8]
call sub.USER32.dll_DdeFreeStringHandle
push dword [0x10070c8]
xor eax, 0x10070c8
call sub.USER32.dll_DdeUninitialize
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 0x10
or eax, dword [edx]
add byte [eax], al
Function at 0x10059a7
Capabilities:
Parse pe header
Terminate process

Disassembly:
and dword [edx], esp
sub word [esi + 0x1dd7729], bp
add byte [eax], al
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10059e4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10059e4
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10059fc
cmp eax, 0x20b
je 0x10059e9
mov dword [ebp - 0x1c], ebx
jmp 0x1005a10
cmp dword [ecx + 0x84], 0xe
jbe 0x10059e4
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1005a0a
cmp dword [ecx + 0x74], 0xe
jbe 0x10059e4
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1008908], 0xffffffff
or dword [0x100890c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100718c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007188]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1008910], eax
call fcn.01005b8c
cmp dword [0x10070a8], ebx
jne 0x1005a6b
push fcn.01005b8c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01005b7a
push 0x10012c0
push 0x10012bc
call sub.msvcrt.dll__initterm
mov eax, dword [0x1007184]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1007180]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10012b8
push 0x10012b4
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1005b01
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1005ad5
cmp al, 0x22
jne 0x1005ac7
cmp byte [esi], 0x22
jne 0x1005ade
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1005ae8
cmp al, 0x20
jbe 0x1005ada
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x1005b0c
movzx eax, word [ebp - 0x48]
jmp 0x1005b0f
cmp byte [esi], 0x20
jbe 0x1005ade
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1005b01
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1005b2c
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005b61
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005bc9
ret
Function at 0x1005ceb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1001988
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005d43
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x10019c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005d36
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1005d45
xor eax, eax
pop esi
leave
ret 4
Function at 0x10002f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003dda2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esi], vtable.T4Cm_k.0
call dword [0x10044060]
xor ebx, ebx
lea eax, [esi + 0x30]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x50], 8
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
lea ecx, [esi + 0x68]
mov byte [esp + 0x14], 1
call fcn.1000aa70
lea ecx, [esi + 0x6c]
mov byte [esp + 0x14], 2
call dword [0x10044060]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10003290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003ddfc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esi], vtable.LWsRvlk_.0
call dword [0x10044060]
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], ebx
call dword [0x10044060]
lea eax, [esi + 0x58]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], bl
mov eax, 8
mov dword [esi + 0x68], eax
lea ecx, [esi + 0x7c]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x90], ebx
mov byte [esi + 0x94], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10005780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1003dfe9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], sym.XtRTP.dll_const_input_plugin::vftable
lea ecx, [esi + 0x90]
mov dword [esp + 0x18], 5
call dword [0x10044064]
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 4
call fcn.1000aa80
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 3
call dword [0x10044064]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call dword [0x10044064]
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call dword [0x10044064]
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x20]
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 0x18], bl
je 0x1000581f
mov edx, dword [esp + 0xc]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.10003f90
mov eax, dword [edi + 4]
push eax
call fcn.1003ad60
add esp, 0x14
lea ecx, [esi + 4]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x18], 0xffffffff
call dword [0x10044064]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10005990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1003dfe9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
mov dword [esi], sym.XtRTP.dll_const_input_plugin::vftable
call dword [0x10044068]
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], 0
call fcn.10005050
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call dword [0x10044068]
lea eax, [edi + 0x4c]
push eax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call dword [0x10044068]
lea ecx, [edi + 0x68]
push ecx
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 3
call dword [0x10044068]
mov dl, byte [edi + 0x84]
mov byte [esi + 0x84], dl
mov eax, dword [edi + 0x88]
mov dword [esi + 0x88], eax
mov ecx, dword [edi + 0x8c]
mov dword [esi + 0x8c], ecx
add edi, 0x90
push edi
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 5
call dword [0x10044068]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10007510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003e191
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov esi, dword [esp + 0x40]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], ebx
mov dword [esp + 8], 1
call dword [0x10044060]
mov byte [esp + 0x2c], 1
push str.index::none
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 1
call dword [0x1004405c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], 1
call fcn.100073a0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call dword [0x10044064]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4

Function at 0x1001c1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100403ec
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10075dd0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call dword [0x10044064]
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call dword [0x10044064]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1001c570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1004047c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10075dd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov cx, word [edi + 4]
mov word [esi + 4], cx
mov dx, word [edi + 6]
mov word [esi + 6], dx
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x10]
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], edx
call dword [0x10044068]
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
call dword [0x10044068]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10026490
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push esi
mov esi, edx
lea eax, [ecx + 0x58]
mov ecx, edx
and esi, 3
shr edx, 2
je 0x100264d6
push ebx
push edi
jmp 0x100264b0
movzx edi, word [eax]
add ecx, edi
movzx edi, word [eax + 2]
mov ebx, ecx
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor ecx, edi
mov edi, ecx
shr edi, 0xb
add eax, 4
add ecx, edi
sub edx, 1
jne 0x100264b0
pop edi
pop ebx
sub esi, 1
je 0x10026515
sub esi, 1
je 0x10026500
sub esi, 1
jne 0x10026527
movzx edx, word [eax]
movsx eax, byte [eax + 2]
add eax, eax
add ecx, edx
add eax, eax
xor eax, ecx
shl eax, 0x10
xor ecx, eax
mov edx, ecx
shr edx, 0xb
jmp 0x10026525
movzx eax, word [eax]
add ecx, eax
mov edx, ecx
shl edx, 0xb
xor ecx, edx
mov eax, ecx
shr eax, 0x11
add ecx, eax
jmp 0x10026527
movsx edx, byte [eax]
add ecx, edx
mov eax, ecx
shl eax, 0xa
xor ecx, eax
mov edx, ecx
shr edx, 1
add ecx, edx
lea eax, [ecx*8]
xor ecx, eax
mov edx, ecx
shr edx, 5
add ecx, edx
mov eax, ecx
shl eax, 4
xor ecx, eax
mov edx, ecx
shr edx, 0x11
add ecx, edx
mov eax, ecx
shl eax, 0x19
xor ecx, eax
mov eax, ecx
shr eax, 6
add eax, ecx
pop esi
ret 4
Function at 0x1003d150
Capabilities:
Authenticate hmac
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfc
mov eax, dword [0x10075dd0]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x104]
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
push 0x40
mov edi, edx
lea edx, [esp + 0xcc]
push 0x36
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.1003af0a
push 0x40
lea eax, [esp + 0x98]
push 0x5c
push eax
call fcn.1003af0a
add esp, 0x18
xor edx, edx
test ebp, ebp
jbe 0x1003d1d7
lea esi, [esp + 0xc8]
lea ebx, [esp + 0x88]
sub esi, edi
mov eax, edi
sub ebx, edi
nop
cmp edx, 0x40
jae 0x1003d1d7
mov cl, byte [eax]
xor byte [esi + eax], cl
xor byte [ebx + eax], cl
add edx, 1
add eax, 1
cmp edx, ebp
jb 0x1003d1c0
lea ecx, [esp + 0x18]
mov ebp, 0x98badcfe
mov ebx, 0x10325476
mov edi, 0xc3d2e1f0
push ecx
lea eax, [esp + 0xcc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], 0x40
call fcn.1003b9e0
mov eax, dword [esp + 0x11c]
add esp, 4
test eax, eax
je 0x1003d242
mov edx, dword [esp + 0x14]
push edx
lea esi, [esp + 0x1c]
call fcn.1003cee0
add esp, 4
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.1003cf70
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x90]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x20], 0x40
call fcn.1003b9e0
mov eax, dword [esp + 0x20]
mov esi, eax
mov ebx, 0x14
and esi, 0x3f
mov edi, 0x40
add eax, ebx
add esp, 8
sub edi, esi
cmp eax, ebx
lea ebp, [esp + 0x74]
mov dword [esp + 0x18], eax
jae 0x1003d2b8
add dword [esp + 0x1c], 1
test esi, esi
je 0x1003d311
cmp edi, ebx
ja 0x1003d311
push edi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + esi + 0x3c]
push eax
call fcn.1003ae3a
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x44]
call fcn.1003b9e0
sub ebx, edi
add esp, 0x10
xor esi, esi
cmp ebx, 0x40
lea ebp, [esp + edi + 0x74]
jb 0x1003d30d
mov edi, ebx
shr edi, 6
lea edx, [esp + 0x18]
push edx
mov eax, ebp
call fcn.1003b9e0
add esp, 4
sub ebx, 0x40
add ebp, 0x40
sub edi, 1
jne 0x1003d2f3
test ebx, ebx
je 0x1003d320
push ebx
lea eax, [esp + esi + 0x38]
push ebp
push eax
call fcn.1003ae3a
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.1003cf70
mov ecx, dword [esp + 0x10c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b297
add esp, 0xfc
ret
Function at 0x1003d730
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10075dd0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push edi
mov edi, edx
push edi
push eax
lea eax, [esp + 0x38]
push eax
mov ebx, ecx
mov dword [esp + 0x24], ebp
call fcn.1003ae3a
mov ecx, ebx
sar ecx, 0x18
mov edx, ebx
sar edx, 0x10
mov eax, ebx
mov byte [esp + edi + 0x3c], cl
mov byte [esp + edi + 0x3d], dl
mov edx, dword [esp + 0x6c]
sar eax, 8
mov byte [esp + edi + 0x3e], al
mov byte [esp + edi + 0x3f], bl
add edi, 4
push edi
lea ecx, [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x34]
mov edx, ebp
call fcn.1003d150
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esi], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x4b]
sub eax, esi
mov dword [esp + 0x28], eax
lea edi, [esp + 0x48]
lea ebx, [esp + 0x49]
lea ebp, [esp + 0x4a]
lea eax, [esp + 0x4c]
add esp, 0x18
sub edi, esi
sub ebx, esi
sub ebp, esi
sub eax, esi
mov dword [esi + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xfff
jmp 0x1003d7f0
mov eax, dword [esp + 0x60]
push 0x14
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call fcn.1003d150
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0xc
mov dword [esp + 0x2c], edx
mov eax, esi
mov ecx, 4
jmp 0x1003d840
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ebx + eax]
xor byte [eax + 1], dl
movzx edx, byte [eax + ebp]
xor byte [eax + 2], dl
mov edx, dword [esp + 0x10]
movzx edx, byte [edx + eax]
xor byte [eax + 3], dl
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
xor byte [eax + 4], dl
add eax, 5
sub ecx, 1
jne 0x1003d840
sub dword [esp + 0xc], 1
jne 0x1003d7f0
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1003b297
add esp, 0x4c
ret
Function at 0x408170
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b32b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045fcc8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4081f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045d8dd
mov eax, dword [eax]
push 0x49e1d0
push eax
call fcn.0044fd74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045ff53
test bl, bl
je 0x4081f2
push 0x49e1d0
lea ecx, [esp + 0xc]
call fcn.004602e3
push 0x4a1d44
lea ecx, [esp + 0xc]
call fcn.004602e3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40822e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045ff53
jmp 0x4082f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4082b2
lea edx, [esp + 0x7c]
push 0x4a1d40
push edx
call fcn.0044fd74
add esp, 8
test eax, eax
je 0x4082b2
lea eax, [esp + 0x7c]
push 0x4a1d3c
push eax
call fcn.0044fd74
add esp, 8
test eax, eax
je 0x4082b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408242
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045ff53
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x408af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x408b52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc