joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x519785
cmp di, 0x801
ja 0x519785
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x519785
cmp bx, 0xc
ja 0x519785
mov al, byte [esp + 0x30]
test al, al
je 0x519684
push edi
call fcn.00519bc0
add esp, 4
cmp ax, bx
je 0x519684
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.00519790
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.005195b0
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x519785
test ebx, ebx
jne 0x519719
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x51977b
test al, al
je 0x51970c
push 0xffffffffffffffe1
jmp 0x51970e
push 0x1f
push ebp
push edi
push esi
call fcn.00519560
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.00519560
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.00519790
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.005195b0
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x5196e6
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x51ae50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x562898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x151d810
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c30
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c2c
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c28
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c24
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c20
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c1c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c18
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c14
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c10
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c0c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c08
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call sub.MFC42.DLL_CString::CString_3
push 0x14b4c04
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x51af80
cmp eax, 0xc
jle 0x51af80
mov ecx, dword [esp + 0x48]
push 0x151d810
call sub.MFC42.DLL_CString::operator_3
jmp 0x51af8e
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.00558e36
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x51b660
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x562ad3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x13c34e0
lea ecx, [esi + 0x5fc]
mov dword [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0xc8]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x4ec]
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CComboBox::CComboBox
lea ecx, [edi + 0x4ac]
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CComboBox::CComboBox
lea ecx, [edi + 0x494]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x490]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 4
call fcn.00518580
mov ecx, edi
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CButton::CButton
lea edi, [esi + 0x50]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x20]
mov byte [esp + 0x18], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CWnd::CWnd
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x51c2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x562c85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x13c36f8
mov dword [esp + 0x18], 0
lea esi, [edi + 0x8c]
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x4ec]
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CComboBox::CComboBox
lea ecx, [esi + 0x4ac]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CComboBox::CComboBox
lea ecx, [esi + 0x494]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x490]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 3
call fcn.00518580
mov ecx, esi
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [edi + 0x88]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea esi, [edi + 0x50]
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CWnd::CWnd
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x530660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x140]
push edi
test eax, eax
jle 0x5306ac
mov eax, dword [ebx + 0x144]
test eax, eax
jle 0x5306ac
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x154]
mov eax, dword [edi]
test eax, eax
je 0x530696
push eax
call ebp
test ax, ax
jl 0x5306a4
inc esi
add edi, 4
cmp esi, 6
jb 0x530688
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00530360
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x534360
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xd0], 1
je 0x5343c0
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x5343c0
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x5343c0
push esi
mov edx, 5
mov esi, dword [ecx + 0xc0]
cmp esi, edx
pop esi
je 0x5343c0
mov dword [ecx + 0xb8], eax
mov dword [ecx + 0x98], 0
mov dword [ecx + 0xc0], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x5343d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x5393a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x539406
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x539406
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x5393e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x5397f0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x539828
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x53a3e0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x53a429
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x53a670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x564ab1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.0053a450
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 2
call fcn.0053a450
mov ecx, dword [esp + 0xc]
mov eax, 0x13c53dc
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], 0x13c53c8
mov dword [esi + 0x5c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi], 0x13c53c4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x53a920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x564b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0053a450
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0053a500
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0053a500
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x10]
call sub.MFC42.DLL_CString::Empty
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0053bb20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0053bb20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0053bb20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x53f370
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x13c5500
push 0x55a10a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00559da0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53f520
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x53f561
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x53f5ce
cmp dword [esp + 0x1c], 2
jne 0x53f5ce
cmp dword [esp + 0x10], 5
jne 0x53f5ce
cmp dword [esp + 0x14], 1
jne 0x53f5ce
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x53f5b8
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x53f5a9
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x53f5b1
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x53f5ce
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x53f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x53f9bd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x53f912
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x53f93e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.0053f8a0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x53f97f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x53f901
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x542410
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x14c5134]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x542423
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x542464
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x14c51dc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x542496
mov bl, byte [esp + ecx + 0x4c]
jmp 0x54249a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x54248b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5424b8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5424bc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5424ad
xor ecx, ecx
mov eax, 0x14c5144
xor ebx, ebx
mov bl, byte [ecx + 0x14c51ec]
cmp byte [esp + ebx + 0x14], 0
je 0x5424e7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x14c5204]
cmp byte [esp + ebx + 0x14], 0
je 0x5424fe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5424ce
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x542457
lea edx, [esp + 0x84]
push edx
call fcn.00542540
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x496590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.text
lea edi, [esi - 0x83000]
push edi
or ebp, 0xffffffff
jmp 0x4965b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4965b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4965a8
mov eax, 1
add ebx, ebx
jne 0x4965cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4965dc
jne 0x4965ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4965ec
dec eax
add ebx, ebx
jne 0x4965e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4965c0
xor ecx, ecx
sub eax, 3
jb 0x496604
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x496676
sar eax, 1
mov ebp, eax
jmp 0x49660f
add ebx, ebx
jne 0x49660f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x49661c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x496640
inc ecx
add ebx, ebx
jne 0x49662c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x496621
jne 0x49663d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x496621
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x496660
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x496651
jmp 0x4965ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x496660
add edi, ecx
jmp 0x4965ae
pop esi
mov edi, esi
mov ecx, 0x107
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49667e
cmp byte [edi], 5
jne 0x49667e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x496683
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x4966f2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x96794]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9680c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4966b0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x96810]
or eax, eax
je 0x4966ec
mov dword [ebx], eax
add ebx, 4
jmp 0x4966cd
call dword [esi + 0x96814]
popal
jmp 0x401b92
Function at 0x1000a4a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [0x102832a4], 0xba2
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [0x102832a4], 0x16ab
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x1000a558
mov dword [0x102832a8], 0x2ac5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000a510
xor eax, eax
mov dword [0x102832a4], 0xa07
mov dword [ebp - 0x1c], eax
jmp 0x1000a539
mov dword [0x102832a4], 0x3ab
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff7
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x64
je 0x1000a5d7
jmp 0x1000a4ff
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebp
ret
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jge 0x1000a56e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
jne 0x1000a541
mov eax, dword [ebp - 0x28]
mov dword [0x102832a4], 0x193d
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1000a4ff
mov dword [0x102832a4], 0x918
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2], 0x6f
jne 0x1000a4ff
mov dword [0x102832a4], 0x17c4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000a4e6
jmp 0x1000a4ff
mov dword [0x102832a4], 0x191e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000a4ff
mov dword [0x102832a8], 0x783
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1000a539
jmp 0x1000a4ff