joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518160
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x1ff
lea eax, [ebp - 0x303]
push 0
push eax
mov byte [ebp - 0x304], 0
call fcn.00564860
add esp, 0xc
test esi, esi
je 0x5181b8
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
lea edx, [ebp - 0x304]
push str._s_line:_d__msg:_s_
push edx
call fcn.0056469f
add esp, 0x14
jmp 0x5181d1
mov eax, dword [ebp + 0xc]
push eax
push edi
lea ecx, [ebp - 0x304]
push str._s_line:_d_
push ecx
call fcn.0056469f
add esp, 0x10
push 0xff
lea edx, [ebp - 0x103]
push 0
push edx
mov byte [ebp - 0x104], 0
call fcn.00564860
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x30e]
movzx edx, word [ebp - 0x312]
movzx eax, word [ebp - 0x314]
push ecx
push edx
push eax
lea ecx, [ebp - 0x104]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.0056469f
add esp, 0x14
cmp dword [0x6c26b8], 0
jne 0x5182d5
push 0
lea edx, [ebp - 0x39c]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5182a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x104]
push 0x592864
push ecx
call fcn.005644f0
mov esi, eax
add esp, 8
test esi, esi
je 0x5182d5
call fcn.00517950
push eax
lea edx, [ebp - 0x304]
push edx
push str._stime:_s_n
push esi
call fcn.0056412d
push esi
call fcn.005642a6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x3a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x518258
mov dword [0x6c26b8], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x5186c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6c2480], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
je 0x518727
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push 0x592800
push 0x6c2380
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6c2380
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x518865
int3
mov edx, dword [ebp + 0xc]
test eax, eax
je 0x518747
push eax
push edx
push ecx
lea eax, [ebp - 0x204]
push str._s_line:_d__msg:_s_
push eax
call fcn.0056469f
add esp, 0x14
jmp 0x51875d
push edx
push ecx
lea eax, [ebp - 0x204]
push str._s_line:_d_
push eax
call fcn.0056469f
add esp, 0x10
push 0xff
lea ecx, [ebp - 0x103]
push 0
push ecx
mov byte [ebp - 0x104], 0
call fcn.00564860
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x20e]
movzx ecx, word [ebp - 0x212]
movzx edx, word [ebp - 0x214]
push eax
push ecx
push edx
lea eax, [ebp - 0x104]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.0056469f
add esp, 0x14
cmp dword [0x6c26e0], 0
jne 0x518865
push esi
push edi
push 0
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x518831
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x104]
push 0x592864
push eax
call fcn.005644f0
mov esi, eax
add esp, 8
test esi, esi
je 0x518863
call fcn.00517950
push eax
lea ecx, [ebp - 0x204]
push ecx
push str._stime:_s_n
push esi
call fcn.0056412d
push esi
call fcn.005642a6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2a0]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x2a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x5187e6
mov dword [0x6c26e0], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x536290
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x5362bd
mov ecx, esi
call fcn.00536250
push 0x5950b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x539080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax], 0x10
je 0x5391ff
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
push 0x94
mov dword [ebp + 8], esi
add esi, 0x364
push 0
push esi
call fcn.00564860
add esp, 0xc
mov ecx, edi
call fcn.00537540
push 0
mov ecx, edi
call fcn.00537550
test eax, eax
je 0x5391e7
push ebx
jmp 0x5390d0
mov edi, dword [eax]
mov ecx, eax
call fcn.00537240
mov ecx, dword [ebp + 8]
mov bl, al
add bl, byte [ecx + 0x536]
mov ecx, 0x6dea80
mov byte [ebp - 4], bl
mov edx, dword [ebp - 4]
push edx
call fcn.00538930
test eax, eax
je case.0x539114.10
movzx ecx, word [edi + 0x2c]
add ecx, 0xfffffffd
cmp ecx, 0x75
ja case.0x539114.10
movzx ecx, byte [ecx + 0x53924c]
jmp dword [ecx*4 + 0x539208]
movzx edx, word [edi + 0x30]
mov eax, dword [eax]
mov dword [esi + edx*4 - 4], eax
jmp case.0x539114.10
movzx ecx, word [edi + 0x30]
fld dword [eax + 8]
fstp dword [ebp - 8]
test cx, cx
je case.0x539114.10
fld dword [eax + 4]
fstp dword [esi + ecx*4 + 0x24]
fld dword [ebp - 8]
fstp dword [esi + ecx*4 + 0x3c]
jmp case.0x539114.10
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x5c], ecx
jmp case.0x539114.10
mov edx, dword [eax + 0x10]
mov dword [esi + 0x58], edx
jmp case.0x539114.10
mov eax, dword [eax + 0x14]
mov dword [esi + 0x60], eax
jmp case.0x539114.10
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
jmp case.0x539114.10
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x68], edx
jmp case.0x539114.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x6c], eax
jmp case.0x539114.10
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x70], ecx
jmp case.0x539114.10
mov edx, dword [eax + 0x20]
mov dword [esi + 0x74], edx
jmp case.0x539114.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x78], eax
jmp case.0x539114.10
fld dword [eax + 0x24]
movzx ecx, bl
fstp dword [esi + 0x7c]
mov word [esi + 0x80], cx
jmp case.0x539114.10
fld dword [eax + 0x28]
fstp dword [esi + 0x84]
jmp case.0x539114.10
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x88], edx
jmp case.0x539114.10
mov eax, dword [eax + 0x30]
mov dword [esi + 0x8c], eax
jmp case.0x539114.10
mov ecx, dword [eax + 0x34]
mov dword [esi + 0x90], ecx
mov ecx, dword [ebp + 0x10]
push 0
call fcn.00537550
test eax, eax
jne 0x5390d0
pop ebx
mov ecx, dword [0x6a2a8c]
call fcn.0043d080
mov ecx, dword [0x6a2a8c]
call fcn.0043cd40
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x53c200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov esi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x53c23e
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea ecx, [ebp - 4]
push ecx
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test al, al
jne 0x53c263
push 0
push 0x45
push str.TileManager.cpp
call fcn.005186c0
add esp, 0xc
push edi
push 0
lea edx, [ebp - 4]
push edx
push 4
lea edi, [esi + 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test al, al
jne 0x53c28c
push 0
push 0x47
push str.TileManager.cpp
call fcn.005186c0
add esp, 0xc
mov eax, dword [edi]
imul eax, dword [esi]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00563a68
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
imul eax, dword [esi]
add esp, 4
xor edi, edi
test eax, eax
je 0x53c312
lea esp, [esp]
mov ecx, dword [esi + 8]
push 0
lea eax, [ebp - 4]
push eax
lea edx, [ecx + edi*2]
push 2
lea ecx, [ebp + 8]
push ecx
push ebx
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test al, al
jne 0x53c2e6
push 0
push 0x53
jmp 0x53c2f0
cmp dword [ebp - 4], 0
jne 0x53c2fd
push 0
push 0x55
push str.TileManager.cpp
call fcn.005186c0
add esp, 0xc
mov dx, word [ebp + 8]
mov eax, dword [ebp - 8]
mov word [eax], dx
mov ecx, dword [esi + 4]
imul ecx, dword [esi]
inc edi
cmp edi, ecx
jb 0x53c2c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x54b250
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x54b270
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.005186c0
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x54b288
cmp esi, 0x11
je 0x54b288
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x55c7f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov eax, 1
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [ebp + ecx*4 - 0x804], eax
mov dword [ebp + eax*4 - 0x404], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x55c810
mov eax, 1
mov ecx, 0x6e0308
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x6e0330
jl 0x55c850
mov byte [0x6dfa08], 0x63
mov byte [0x6e1b93], 0
mov ebx, 1
jmp 0x55c890
mov ecx, dword [ebp + ebx*4 - 0x404]
add ecx, ecx
add ecx, ecx
lea edx, [ebp - 0x408]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x6dfa08], al
mov byte [eax + 0x6e1b30], bl
inc ebx
cmp ebx, 0x100
jl 0x55c890
xor ecx, ecx
movzx esi, byte [ecx + 0x6dfa08]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x6e1730], eax
rol eax, 8
mov dword [ecx*4 + 0x6e1330], eax
rol eax, 8
mov dword [ecx*4 + 0x6e0f30], eax
rol eax, 8
mov dword [ecx*4 + 0x6e0b30], eax
movzx eax, byte [ecx + 0x6e1b30]
test eax, eax
je 0x55c9d2
mov esi, dword [ebp + eax*4 - 0x404]
mov edx, dword [ebp - 0x3cc]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x808], eax
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [ebp - 0x3d0]
add eax, esi
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv edi
mov edi, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3d8]
lea eax, [esi + edx]
cdq
mov esi, 0xff
idiv esi
mov eax, dword [ebp - 0x808]
mov edx, dword [ebp + edx*4 - 0x804]
jmp 0x55c9da
xor eax, eax
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, eax
mov dword [ecx*4 + 0x6e0730], edx
rol edx, 8
mov dword [ecx*4 + 0x6e0330], edx
rol edx, 8
mov dword [ecx*4 + 0x6dff08], edx
rol edx, 8
mov dword [ecx*4 + 0x6dfb08], edx
inc ecx
cmp ecx, 0x100
jl 0x55c904
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x55cf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, edx
sub eax, 0x80
push edi
mov edi, dword [ebp + 8]
je 0x55cfd4
sub eax, 0x40
je 0x55cfcc
sub eax, 0x40
jne 0x55d194
mov dword [edi], 0xe
jmp 0x55cfda
mov dword [edi], 0xc
jmp 0x55cfda
mov dword [edi], 0xa
push esi
push edx
push ecx
lea eax, [ebp - 0x11c]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.0055ca30
mov eax, dword [ebp - 0x11c]
shl eax, 4
add eax, dword [ebp - 0x118]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov ecx, dword [edi]
dec ecx
add esi, 0x10
sub eax, 0x10
test ecx, ecx
jle 0x55d17d
jmp 0x55d030
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x6dfa08]
mov edx, dword [edx*4 + 0x6dfb08]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6dff08]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6e0330]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6e0730]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x6dfa08]
and edx, 0xff
movzx edx, byte [edx + 0x6dfa08]
mov edx, dword [edx*4 + 0x6e0730]
xor edx, dword [edi*4 + 0x6dfb08]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6dff08]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6e0330]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x6dfa08]
and edx, 0xff
movzx edx, byte [edx + 0x6dfa08]
mov edx, dword [edx*4 + 0x6e0730]
xor edx, dword [edi*4 + 0x6dfb08]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6dff08]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6e0330]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x6dfa08]
and edx, 0xff
movzx edx, byte [edx + 0x6dfa08]
mov edx, dword [edx*4 + 0x6e0730]
xor edx, dword [edi*4 + 0x6dfb08]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6dff08]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x6dfa08]
xor edx, dword [edi*4 + 0x6e0330]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x55d030
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x55df90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x730
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x730], ecx
test eax, eax
jne 0x55dfcf
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret 0x10
test ecx, ecx
je 0x55dfbc
push ebx
push edi
push eax
push 1
lea eax, [ebp - 0x720]
push 1
push eax
call fcn.00566d6f
push 0x200
xor ebx, ebx
lea ecx, [ebp - 0x604]
push ebx
push ecx
add esi, 0x10
call fcn.00564860
lea edx, [ebp - 0x728]
push edx
push str._02X
push esi
call fcn.005650a9
add esp, 0x28
test eax, eax
jle 0x55e048
cmp ebx, 0x200
jge 0x55e048
mov al, byte [ebp - 0x728]
lea ecx, [ebp - 0x728]
push ecx
add esi, 2
push str._02X
mov byte [ebp + ebx - 0x604], al
push esi
inc ebx
call fcn.005650a9
add esp, 0xc
test eax, eax
jg 0x55e016
push 0x100
lea edx, [ebp - 0x604]
push edx
lea eax, [ebp - 0x71c]
push eax
call fcn.0055cf90
mov cl, byte [ebp + 0x14]
xor edi, edi
add esp, 0xc
mov byte [ebp - 0x71d], cl
cmp dword [ebp + 0x10], edi
jle 0x55e135
mov edx, dword [ebp - 0x72c]
push edx
push 0x10
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.00566d6f
add esp, 0x10
cmp eax, 0x10
jne 0x55e17d
lea ecx, [ebp - 0x404]
push ecx
mov edx, ecx
push edx
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.0055d1b0
mov ecx, dword [ebp - 0x730]
xor eax, eax
add esp, 0x10
xor dl, dl
mov byte [ebp - 0x71f], al
mov byte [ebp - 0x71e], al
lea esi, [ecx + edi + 1]
nop
mov cl, byte [ebp + eax - 0x404]
add byte [ebp - 0x71d], cl
mov byte [esi + eax - 1], cl
mov cl, byte [ebp + eax - 0x403]
add byte [ebp - 0x71e], cl
mov byte [esi + eax], cl
mov cl, byte [ebp + eax - 0x402]
add byte [ebp - 0x71f], cl
mov byte [esi + eax + 1], cl
mov cl, byte [ebp + eax - 0x401]
mov byte [esi + eax + 2], cl
add eax, 4
add dl, cl
cmp eax, 0x10
jl 0x55e0d0
add dl, byte [ebp - 0x71f]
add edi, 0x10
add dl, byte [ebp - 0x71e]
add byte [ebp - 0x71d], dl
cmp edi, dword [ebp + 0x10]
jl 0x55e077
mov edx, dword [ebp - 0x72c]
push edx
push 1
lea eax, [ebp - 0x721]
push 1
push eax
call fcn.00566d6f
mov al, byte [ebp - 0x720]
add esp, 0x10
cmp al, byte [ebp - 0x721]
jne 0x55e17d
cmp al, byte [ebp - 0x71d]
jne 0x55e17d
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret 0x10
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x56411e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x69ff0c]
jne 0x564128
repz ret
jmp fcn.0056a001
Function at 0x574ccc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0056d9e9
and dword [ebp - 0x14], 0
cmp dword [0x6e2a50], 0
mov dword [ebp - 0x18], eax
jne 0x574d7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x574e27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x574e27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x59ce5c
push ebx
mov dword [0x6e2a50], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6e2a54], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6e2a58], eax
call edi
push eax
call esi
mov dword [0x6e2a60], eax
test eax, eax
je 0x574d7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6e2a5c], eax
mov eax, dword [0x6e2a5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x574dd8
cmp dword [0x6e2a60], ecx
je 0x574dd8
push eax
call esi
push dword [0x6e2a60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x574dd8
test ebx, ebx
je 0x574dd8
call edi
test eax, eax
je 0x574dcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x574dcf
test byte [ebp - 8], 1
jne 0x574dd8
or dword [ebp + 0x10], 0x200000
jmp 0x574e0b
mov eax, dword [0x6e2a54]
cmp eax, dword [ebp - 0x18]
je 0x574e0b
push eax
call esi
test eax, eax
je 0x574e0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x574e0b
mov eax, dword [0x6e2a58]
cmp eax, dword [ebp - 0x18]
je 0x574e0b
push eax
call esi
test eax, eax
je 0x574e0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6e2a50]
call esi
test eax, eax
je 0x574e27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x574e29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056411e
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
mov ecx, 0x7fbe4193
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6de57b33
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x44a690
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c480b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b68c5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x44a712
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004b3b9d
mov eax, dword [eax]
push 0x56c220
push eax
call fcn.004a6854
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b6b50
test bl, bl
je 0x44a712
push 0x56c220
lea ecx, [esp + 0xc]
call fcn.004b6f2c
push 0x56fdfc
lea ecx, [esp + 0xc]
call fcn.004b6f2c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44a74e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b6b50
jmp 0x44a819
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x44a7d2
lea edx, [esp + 0x7c]
push 0x56fdf8
push edx
call fcn.004a6854
add esp, 8
test eax, eax
je 0x44a7d2
lea eax, [esp + 0x7c]
push 0x56fdf4
push eax
call fcn.004a6854
add esp, 8
test eax, eax
je 0x44a7d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44a762
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b6b50
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x44b030
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x44b092
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc