joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006b37
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100097d5
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 0x34]
push ebx
push eax
mov byte [ebp - 0xd], bl
call fcn.10006c52
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x10006b67
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 2
push ebx
mov edi, 0x40000000
push 1
push edi
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x10006bbd
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.10006c52
mov eax, dword [ebp - 0x20]
pop ecx
cmp eax, ebx
pop ecx
jne 0x10006b9e
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push ebx
push ebx
push 2
push ebx
push 1
push edi
push eax
call esi
push 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
cmp dword [ebp - 0x14], 0xffffffff
je 0x10006be7
lea eax, [ebp + 8]
push ebx
push eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10006bde
cmp dword [ebp + 8], 0x10
jne 0x10006bde
mov byte [ebp - 0xd], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1000736d
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x10008de2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a20
call fcn.10002ae0
and word [ebp - 0x220], 0
push esi
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, str.iphlpapi.dll
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x10008e53
xor al, al
jmp 0x10008f55
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
test eax, eax
je 0x10008f31
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x2800
push ecx
lea ecx, [ebp - 0x2a20]
push ecx
call eax
test eax, eax
jne 0x10008f31
lea eax, [ebp - 0x2a20]
lea esi, [ebp - 0x2a20]
test eax, eax
mov dword [ebp - 0xc], 3
je 0x10008f31
push ebx
lea eax, [esi + 8]
push eax
call fcn.10008f59
mov dword [ebp + 8], eax
push 6
lea eax, [ebp - 8]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ecx, edi
lea eax, [ebp - 8]
add esp, 0x10
xor edx, edx
sub ecx, eax
lea eax, [ebp + edx - 8]
mov bl, byte [ecx + eax]
cmp bl, byte [eax]
jne 0x10008eda
inc edx
cmp edx, 6
jb 0x10008ec7
jmp 0x10008eeb
cmp dword [esi + 0x1a0], 6
jne 0x10008f26
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jle 0x10008f26
mov al, byte [esi + 0x194]
mov byte [edi], al
mov al, byte [esi + 0x195]
mov byte [edi + 1], al
mov al, byte [esi + 0x196]
mov byte [edi + 2], al
mov al, byte [esi + 0x197]
mov byte [edi + 3], al
mov al, byte [esi + 0x198]
mov byte [edi + 4], al
mov al, byte [esi + 0x199]
mov byte [edi + 5], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov esi, dword [esi]
test esi, esi
jne 0x10008ea2
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 6
lea eax, [ebp - 8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.100090fb
pop edi
pop esi
leave
ret
Function at 0x10008f59
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x18]
mov edi, 0x20019
xor ebx, ebx
push eax
push edi
push ebx
push str.SystemC
push 0x80000002
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0x104
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x100090c7
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push str._sConnection
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x11c]
push ebx
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x100090be
push 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.MediaSubType
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100090b5
push 1
lea eax, [ebp - 0x11c]
pop edi
mov dword [ebp - 8], 0x103
push 0x104
push ebx
push eax
mov dword [ebp - 0x14], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.PnpInstanceID
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100090b5
cmp dword [ebp - 0x10], edi
jne 0x100090a3
mov esi, 0x1000ffc4
push esi
call sub.MSVCRT.dll_strlen
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call edi
add esp, 0x10
test eax, eax
jne 0x1000907c
mov dword [ebp - 0xc], ebx
jmp 0x100090b5
cmp dword [ebp - 0x10], 1
jne 0x100090a3
push esi
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call edi
add esp, 0x10
test eax, eax
je 0x100090a3
mov dword [ebp - 0xc], 2
jmp 0x100090b5
xor eax, eax
cmp dword [ebp - 0x10], 2
setne al
dec eax
and al, 0xfe
add eax, 3
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009341
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
push 0
lea ebx, [esi + 0x30]
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x10009391
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push 0
push eax
mov dword [esi + 8], eax
call sub.MSVCRT.dll_memset
add esp, 0x10
push dword [esi + 8]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10009391
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.1000921e
test eax, eax
jne 0x10009398
xor eax, eax
jmp 0x1000943a
mov eax, dword [ebp - 0x2c]
mov edi, 0x104
mov ecx, eax
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
push edi
shr ecx, 0x10
mov word [esi + 0xc], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x16], ax
mov eax, dword [ebp - 0x20]
mov word [esi + 0x14], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x238]
shr ecx, 0x10
mov word [esi + 0x18], cx
push eax
push 0x10010338
mov ecx, esi
call fcn.1000928d
lea eax, [esi + 0x648]
push edi
push eax
push 0x10010318
mov ecx, esi
call fcn.1000928d
lea eax, [esi + 0x440]
push edi
push eax
push 0x10010300
mov ecx, esi
call fcn.1000928d
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100094f3
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10009509
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
pop eax
pop esi
ret
Function at 0x4f2c00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x4f2c3a
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55a0c8]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x4f2c18
pop esi
ret

Function at 0x4fc773
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jne 0x4fc7a2
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
inc eax
imul eax, eax, 3
jmp 0x4fc825
push ebx
xor eax, eax
cmp ecx, edi
push esi
mov dword [ebp + 8], edi
jle 0x4fc823
xor esi, esi
xor edx, edx
mov ecx, dword [ebp - 4]
cmp dword [ebp + 8], ecx
jge 0x4fc810
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
movsx ecx, byte [ebx + ecx]
inc dword [ebp + 8]
cmp ecx, 0xd
je 0x4fc80b
cmp ecx, 0xa
je 0x4fc80b
shl edx, 6
cmp ecx, 0x60
jle 0x4fc7dd
add ecx, 0xffffffb9
jmp 0x4fc7f7
cmp ecx, 0x40
jle 0x4fc7e7
add ecx, 0xffffffbf
jmp 0x4fc7f7
cmp ecx, 0x3d
jne 0x4fc7ef
inc edi
jmp 0x4fc80a
cmp ecx, 0x2f
jle 0x4fc7fb
add ecx, 4
or edx, ecx
jmp 0x4fc80a
jne 0x4fc802
or edx, 0x3f
jmp 0x4fc80a
cmp ecx, 0x2b
jne 0x4fc80a
or edx, 0x3e
inc esi
cmp esi, 4
jne 0x4fc7b1
cmp esi, 4
jne 0x4fc84c
lea ecx, [eax + 3]
mov esi, ecx
sub esi, edi
cmp esi, dword [ebp + 0x10]
jle 0x4fc841
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret
dec ecx
test edi, edi
je 0x4fc838
mov esi, eax
sub esi, edi
add esi, 3
cmp ecx, esi
jge 0x4fc83e
mov esi, dword [ebp + 0xc]
mov byte [ecx + esi], dl
shr edx, 8
cmp ecx, eax
jne 0x4fc828
push 3
pop ecx
sub ecx, edi
add eax, ecx
mov ecx, dword [ebp - 4]
cmp dword [ebp + 8], ecx
jl 0x4fc7ad
jmp 0x4fc823
Function at 0x500afc
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x52f169
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
xor edx, edx
xor eax, eax
cmp edi, edx
mov dword [ebp - 0xc], ecx
je 0x52f22e
cmp dword [ebp + 0xc], edx
mov dword [ebp - 4], edx
jbe 0x52f22e
push ebx
push esi
jmp 0x52f195
mov edi, dword [ebp + 8]
movzx esi, byte [edx + edi]
inc edx
shl esi, 8
cmp edx, dword [ebp + 0xc]
jae 0x52f1ab
movzx ebx, byte [edx + edi]
or esi, ebx
inc edx
jmp 0x52f1ae
inc dword [ebp - 4]
shl esi, 8
cmp edx, dword [ebp + 0xc]
jae 0x52f1bf
movzx edi, byte [edx + edi]
or esi, edi
inc edx
jmp 0x52f1c2
inc dword [ebp - 4]
push 3
pop edi
cmp dword [ebp - 4], 0
je 0x52f1d5
dec dword [ebp - 4]
mov byte [ebp + edi - 8], 0x3d
jmp 0x52f1ea
mov ebx, dword [0x55c7e4]
mov ecx, esi
and ecx, 0x3f
mov cl, byte [ecx + ebx]
mov byte [ebp + edi - 8], cl
mov ecx, dword [ebp - 0xc]
shr esi, 6
dec edi
jns 0x52f1c5
xor esi, esi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x52f20f
cmp dword [ecx + 4], edi
jb 0x52f20f
mov edi, dword [ebp + 0x10]
mov byte [eax + edi], 0xd
inc eax
mov byte [eax + edi], 0xa
inc eax
and dword [ecx + 4], 0
mov bl, byte [ebp + esi - 8]
mov edi, dword [ebp + 0x10]
mov byte [eax + edi], bl
inc eax
inc esi
inc dword [ecx + 4]
cmp esi, 4
jl 0x52f1f2
cmp edx, dword [ebp + 0xc]
jb 0x52f192
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x52f233
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
xor eax, eax
cmp ecx, eax
push esi
push edi
je 0x52f2e7
cmp dword [ebp + 0x10], eax
je 0x52f2e7
mov edx, dword [ebp + 0xc]
lea edi, [ecx + edx]
cmp ecx, edi
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
jae 0x52f2e9
xor esi, esi
xor edx, edx
cmp dword [ebp + 8], edi
jae 0x52f2d3
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
inc dword [ebp + 8]
cmp cl, 9
jl 0x52f288
cmp cl, 0xa
jle 0x52f2ce
cmp cl, 0xd
je 0x52f2ce
cmp cl, 0x20
je 0x52f2ce
shl edx, 6
cmp cl, 0x60
jle 0x52f298
movsx ecx, cl
sub ecx, 0x47
jmp 0x52f2ba
cmp cl, 0x40
jle 0x52f2a5
movsx ecx, cl
sub ecx, 0x41
jmp 0x52f2ba
cmp cl, 0x3d
jne 0x52f2af
inc dword [ebp + 0xc]
jmp 0x52f2cd
cmp cl, 0x2f
jle 0x52f2be
movsx ecx, cl
add ecx, 4
or edx, ecx
jmp 0x52f2cd
jne 0x52f2c5
or edx, 0x3f
jmp 0x52f2cd
cmp cl, 0x2b
jne 0x52f2cd
or edx, 0x3e
inc esi
cmp esi, 4
jb 0x52f267
cmp esi, 4
jne 0x52f2e7
mov esi, dword [ebp + 0xc]
lea ecx, [eax + 3]
mov ebx, ecx
sub ebx, esi
cmp ebx, dword [ebp + 0x14]
jbe 0x52f309
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
dec ecx
test esi, esi
je 0x52f300
mov ebx, eax
sub ebx, esi
add ebx, 3
cmp ecx, ebx
jae 0x52f306
mov ebx, dword [ebp + 0x10]
mov byte [ecx + ebx], dl
shr edx, 8
cmp ecx, eax
jne 0x52f2f0
push 3
pop ecx
sub ecx, esi
add eax, ecx
cmp dword [ebp + 8], edi
jb 0x52f263
jmp 0x52f2e9
Function at 0x52f34a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x52f35c
xor eax, eax
jmp 0x52f424
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push ebx
push esi
mov esi, dword [edx - 0xc]
add esi, edx
mov dword [ebp + 8], edi
jmp 0x52f417
xor eax, eax
xor ebx, ebx
cmp edx, esi
jae 0x52f3d8
mov cl, byte [edx]
inc edx
cmp cl, 9
jl 0x52f38f
cmp cl, 0xa
jle 0x52f3d3
cmp cl, 0xd
je 0x52f3d3
cmp cl, 0x20
je 0x52f3d3
shl ebx, 6
cmp cl, 0x60
jle 0x52f39f
movsx ecx, cl
sub ecx, 0x47
jmp 0x52f3bf
cmp cl, 0x40
jle 0x52f3ac
movsx ecx, cl
sub ecx, 0x41
jmp 0x52f3bf
cmp cl, 0x3d
jne 0x52f3b4
inc edi
jmp 0x52f3d2
cmp cl, 0x2f
jle 0x52f3c3
movsx ecx, cl
add ecx, 4
or ebx, ecx
jmp 0x52f3d2
jne 0x52f3ca
or ebx, 0x3f
jmp 0x52f3d2
cmp cl, 0x2b
jne 0x52f3d2
or ebx, 0x3e
inc eax
cmp eax, 4
jb 0x52f374
cmp eax, 4
jne 0x52f3ec
mov ecx, dword [ebp + 8]
add ecx, 3
mov eax, ecx
sub eax, edi
cmp eax, dword [ebp + 0x10]
jbe 0x52f40a
xor eax, eax
jmp 0x52f422
dec ecx
test edi, edi
je 0x52f401
mov eax, dword [ebp + 8]
sub eax, edi
add eax, 3
cmp ecx, eax
jae 0x52f407
mov eax, dword [ebp + 0xc]
mov byte [ecx + eax], bl
shr ebx, 8
cmp ecx, dword [ebp + 8]
jne 0x52f3f0
push 3
pop eax
sub eax, edi
add dword [ebp + 8], eax
cmp edx, esi
jb 0x52f370
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
pop ebp
ret 0xc
Function at 0x52f429
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x506aa0
call 0x5ce602
mov edi, ecx
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x20], 0
test ebx, ebx
jne 0x52f454
mov ecx, dword [ebp + 8]
push 0x516e10
call fcn.004f3b3f
jmp 0x52f554
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0052f100
mov esi, eax
call 0x5b1c25
push eax
lea ecx, [ebp - 0x18]
call fcn.004f3814
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x18]
call fcn.004f38f9
xor ecx, ecx
xor edx, edx
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], ecx
jbe 0x52f534
jmp 0x52f494
mov ebx, dword [ebp + 0xc]
movzx esi, byte [ecx + ebx]
inc ecx
shl esi, 8
cmp ecx, dword [ebp + 0x10]
jae 0x52f4aa
movzx ebx, byte [ecx + ebx]
or esi, ebx
inc ecx
jmp 0x52f4ad
inc dword [ebp - 0x10]
shl esi, 8
cmp ecx, dword [ebp + 0x10]
jae 0x52f4c1
mov ebx, dword [ebp + 0xc]
movzx ebx, byte [ecx + ebx]
or esi, ebx
inc ecx
jmp 0x52f4c4
inc dword [ebp - 0x10]
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x10], 0
je 0x52f4de
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov byte [ebp + ebx - 0x1c], 0x3d
jmp 0x52f4f6
mov ebx, dword [0x55c7e4]
mov eax, esi
and eax, 0x3f
mov al, byte [eax + ebx]
mov ebx, dword [ebp - 0x14]
mov byte [ebp + ebx - 0x1c], al
mov eax, dword [ebp - 0x20]
shr esi, 6
dec dword [ebp - 0x14]
jns 0x52f4cb
xor esi, esi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x52f51a
cmp dword [edi + 4], ebx
jb 0x52f51a
mov byte [edx + eax], 0xd
inc edx
mov byte [edx + eax], 0xa
inc edx
and dword [edi + 4], 0
mov bl, byte [ebp + esi - 0x1c]
mov byte [edx + eax], bl
inc edx
inc esi
inc dword [edi + 4]
cmp esi, 4
jl 0x52f500
cmp ecx, dword [ebp + 0x10]
jb 0x52f491
push edx
lea ecx, [ebp - 0x18]
call fcn.004f64b6
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.004f38db
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004f3357
mov eax, dword [ebp + 8]
call 0x5ce6da
ret 0x10
Function at 0x567a23
Capabilities:
Encode data using xor

Disassembly:
push 8
mov eax, 0x50dd2f
call 0x5ce602
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.004f43ae
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [edi - 0xc]
cmp esi, ebx
jle 0x567a6e
push ebx
lea ecx, [ebp + 0xc]
call fcn.004fc85a
xor al, byte [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
call fcn.0050cc48
inc ebx
cmp ebx, esi
jl 0x567a4f
lea ecx, [edi - 0x10]
call fcn.004f3357
mov eax, dword [ebp + 8]
call 0x5ce6da
ret 0xc
Function at 0x401466
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [section..data], ebx
je 0x4014ea
push ebx
push ebx
push 0x12
push dword [0x405088]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x7530
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
push ebx
push 0x1e
mov dword [section..data], ebx
call fcn.004037d0
cmp byte [0x405049], bl
mov al, byte [eax]
jne 0x4014c6
cmp byte [0x4050bc], bl
je 0x4014ea
test al, 4
je 0x4014ea
lea eax, [ebp - 4]
push eax
push ebx
push 0x28
call fcn.004037d0
mov ecx, dword [0x405074]
mov cl, byte [ecx]
dec cl
mov byte [eax + 2], cl
xor eax, eax
jmp 0x40159e
cmp byte [0x405078], bl
push esi
jne 0x401549
push dword [0x405074]
mov esi, 0x40508c
push esi
call fcn.004037b7
cmp byte [0x4050c4], bl
jne 0x401531
lea eax, [ebp - 4]
push eax
push ebx
push 0x28
call fcn.004037d0
mov ecx, dword [0x405074]
mov cl, byte [ecx]
sub cl, byte [eax + 2]
neg cl
sbb ecx, ecx
inc ecx
inc ecx
je 0x401531
mov byte [0x4050bc], bl
cmp byte [0x4050bc], bl
jne 0x40157e
inc dword [0x405084]
mov eax, dword [0x405084]
cmp eax, dword [ebp + 8]
jb 0x40154d
xor eax, eax
jmp 0x40159d
lea eax, [ebp - 4]
push eax
push ebx
push 0x28
call fcn.004037d0
mov al, byte [eax + 2]
mov ecx, dword [0x405074]
mov byte [ecx], al
push dword [0x405074]
push esi
call fcn.004037b7
mov byte [0x4050c4], 1
mov byte [0x4050bc], 1
push 0x405088
push ebx
push ebx
push 0x4036f3
push ebx
push ebx
mov dword [0x405080], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [section..data], eax
pop esi
pop ebx
leave
ret 4

Function at 0x401abc
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x401b1b
cmp dword [esp + 0xc], 0
je 0x401ad7
push 0x7fffffff
push esi
call fcn.00401e27
push esi
call fcn.00401dd4
mov eax, dword [esi + 0x3ba4]
test eax, eax
je 0x401b14
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401b08
push 0
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
ret 8

Function at 0x401baa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x402165
mov edi, eax
call fcn.00401722
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 8]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x401bfe
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x401e99
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi + 0x1b44]
test al, 1
jne 0x401f3e
or al, 1
mov byte [esi + 0x1b44], al
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
push ebx
mov dword [esi + 0x1b48], eax
push edi
lea eax, [esi + 0x1b18]
push eax
mov dword [esi + 0x1b14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1b40], eax
call ebx
cmp dword [esi + 0x1b40], edi
mov dword [esi + 0x1b10], eax
je 0x401f36
cmp eax, edi
je 0x401f36
cmp dword [ebp + 0x10], edi
je 0x401f25
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push dword [ebp + 0x10]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x1b0c], eax
je 0x401f36
push dword [ebp + 0x14]
push dword [esi + 0x1b0c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x401f3c
push esi
call fcn.004019f3
pop edi
pop ebx
xor eax, eax
mov al, byte [esi + 0x1b44]
pop esi
and eax, 1
pop ebp
ret 0x10

Function at 0x4024c6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004016ea
mov ebx, eax
mov dh, byte [ebx]
mov dl, 1
mov ecx, dword [edi]
or dh, dh
jne 0x4024f9
inc ebx
push ecx
mov eax, esp
push eax
push 0
push dword [ebx]
call fcn.004037d0
pop ecx
jecxz 0x402507
push eax
mov al, byte [eax]
xor al, 0xb5
mov byte [esi], al
pop eax
inc esi
inc eax
loop 0x4024fb
or dh, dh
jne 0x402513
inc dl
mov cl, dl
cmp ecx, dword [edi]
jl 0x4024e6
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [edi], esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10