joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a4c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x44]
xor edx, edx
mov eax, 0x40000000
div edi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 1
mov ebx, eax
add ebx, ebx
add ebx, ebx
cmp ebx, esi
jbe 0x41a551
mov edx, esi
imul edx, edi
push 0x1c
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x41a544
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41a544
div edi
add esi, eax
cmp dword [ebp - 0x14], 0x1000
jne 0x41a54d
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jbe 0x41a54d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 8], edx
call fcn.0041a160
add esp, 4
test al, al
je 0x41a54d
inc dword [ebp - 4]
jmp 0x41a54d
mov eax, 0x10000
div edi
add esi, eax
cmp esi, ebx
jb 0x41a4f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ab80
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 0x39c]
mov edx, dword [ebp - 0x3a0]
push ecx
push edx
lea esi, [ebp - 0x70]
call fcn.0041a0e0
mov eax, esi
push eax
push str.Error_occurred_at__s._r_n
push edi
call fcn.0041a080
push 0x208
lea ecx, [ebp - 0x378]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x20
push 0x206
lea edx, [ebp - 0x378]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41ac05
push 0x615ebc
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x378]
push ecx
push str._s__r_n
push edi
call fcn.0041a080
add esp, 0xc
lea ecx, [ebp - 0x170]
call fcn.0041a670
test eax, eax
je 0x41ac40
lea edx, [ebp - 0x170]
push edx
push str.Operating_system:___s_r_n
push edi
call fcn.0041a080
add esp, 0xc
jmp 0x41ac4e
push str.Operating_system:__Could_not_Determine_r_n
push edi
call fcn.0041a080
add esp, 8
lea eax, [ebp - 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x3ac]
mov edx, dword [ebp - 0x3b0]
push ecx
push edx
push str._d_processor_s___type__d._r_n
push edi
call fcn.0041a080
add esp, 0x10
lea eax, [ebp - 0x398]
push eax
mov dword [ebp - 0x398], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x394]
push ecx
push str._d___memory_in_use._r_n
push edi
call fcn.0041a080
mov edx, dword [ebp - 0x390]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_physical_memory._r_n
push edi
call fcn.0041a080
mov eax, dword [ebp - 0x38c]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory_free._r_n
push edi
call fcn.0041a080
mov ecx, dword [ebp - 0x388]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_paging_file._r_n
push edi
call fcn.0041a080
mov edx, dword [ebp - 0x384]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_paging_file_free._r_n
push edi
call fcn.0041a080
mov eax, dword [ebp - 0x380]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space._r_n
push edi
call fcn.0041a080
mov ecx, dword [ebp - 0x37c]
add ecx, 0xfffff
add esp, 0x48
shr ecx, 0x14
push ecx
push str._d_MBytes_user_address_space_free._r_n
push edi
call fcn.0041a080
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.00546bdc
mov esp, ebp
pop ebp
ret
Function at 0x41b9f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x6792dc], ebx
je 0x41ba28
xor eax, eax
cmp dword [0x6792d0], ebx
pop ebx
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x90
lea eax, [ebp - 0x94]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edx, edx
cmp dword [ebp - 0x88], 2
push 0x616b10
sete dl
mov dword [0x6792e0], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, ebx
je 0x41bb28
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x616b20
push esi
call edi
mov dword [0x6792c0], eax
cmp eax, ebx
je 0x41bb28
push str.MonitorFromWindow
push esi
call edi
mov dword [0x6792c4], eax
cmp eax, ebx
je 0x41bb28
push str.MonitorFromRect
push esi
call edi
mov dword [0x6792c8], eax
cmp eax, ebx
je 0x41bb28
push str.MonitorFromPoint
push esi
call edi
mov dword [0x6792cc], eax
cmp eax, ebx
je 0x41bb28
push str.EnumDisplayMonitors
push esi
call edi
mov dword [0x6792d4], eax
cmp eax, ebx
je 0x41bb28
push str.EnumDisplayDevicesW
push esi
call edi
mov dword [0x6792d8], eax
cmp eax, ebx
je 0x41bb28
cmp dword [0x6792e0], ebx
je 0x41bafc
push str.GetMonitorInfoW
jmp 0x41bb01
push str.GetMonitorInfoA
push esi
call edi
mov dword [0x6792d0], eax
cmp eax, ebx
je 0x41bb28
pop edi
mov eax, 1
pop esi
mov dword [0x6792dc], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [0x6792c0], ebx
mov dword [0x6792c4], ebx
mov dword [0x6792c8], ebx
mov dword [0x6792cc], ebx
mov dword [0x6792d0], ebx
mov dword [0x6792d4], ebx
mov dword [0x6792d8], ebx
xor ecx, ebp
mov dword [0x6792dc], 1
xor eax, eax
pop ebx
call fcn.00546bdc
mov esp, ebp
pop ebp
ret
Function at 0x41c020
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc6fb
mov eax, dword fs:[0]
push eax
mov eax, 0x1238
call fcn.00549c70
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov edi, dword [ebx]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x123c], ebx
cmp edi, eax
je 0x41c08b
mov ecx, eax
sub ecx, eax
sar ecx, 2
lea esi, [ecx*4]
push esi
push eax
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
add esi, edi
mov dword [ebx + 4], esi
lea ecx, [ebp - 0x1240]
push ecx
push 0x1000
lea edx, [ebp - 0x1218]
push edx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x41c1bf
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x1220], 7
mov dword [ebp - 0x1224], ecx
mov word [ebp - 0x1234], ax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1240]
shr eax, 2
cmp eax, ecx
jle 0x41c182
lea ebx, [ebp - 0x1218]
mov dword [ebp - 0x1238], eax
mov ecx, dword [ebx]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41c173
push 0x104
lea edx, [ebp - 0x218]
push edx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x41c16c
xor ecx, ecx
mov word [ebp + eax*2 - 0x218], cx
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c127
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x1234]
call fcn.00406180
mov edx, dword [ebp - 0x1244]
lea ecx, [ebp - 0x1234]
call fcn.0041e8f0
cmp eax, 0xffffffff
je 0x41c16c
mov esi, dword [ebp - 0x123c]
mov ecx, ebx
call fcn.0041df60
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
dec dword [ebp - 0x1238]
jne 0x41c0e7
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1220], 8
jb 0x41c1a2
mov eax, dword [ebp - 0x1234]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x1220], 7
mov dword [ebp - 0x1224], 0
mov word [ebp - 0x1234], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret
Function at 0x41deb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbb39
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov dword [ebp - 0x40], esi
mov word [esi], ax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 0x21
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x41df3b
lea eax, [ebp - 0x34]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41df20
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.00406180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret

Function at 0x421b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 2]
mov ebx, eax
mov dword [ebp - 8], 0
mov byte [ebp - 1], 1
call fcn.00421c60
test al, al
jne 0x421b9e
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 2], 0
je 0x421b95
cmp dword [ebx + 0x10], 0
mov dword [ebp - 8], 0
je 0x421b95
mov esi, 8
cmp dword [ebx + 0x14], esi
jb 0x421bbd
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
push 1
push 0
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421b95
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x421b95
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], esi
jb 0x421be6
mov eax, dword [eax]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [ebx + 0x24]
push edi
push 0
push 0
push 0
push eax
push ecx
call esi
cmp eax, 0xea
je 0x421c08
test eax, eax
jne 0x421c42
mov ecx, dword [edi]
add ecx, 5
push ecx
push 1
call dword [sym.imp.MSVCR100.dll_calloc]
add esp, 8
mov dword [ebx + 0x20], eax
test eax, eax
je 0x421c3e
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x421c2b
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
push edi
push eax
add ebx, 0x1c
push ebx
push 0
push ecx
push edx
call esi
test eax, eax
je 0x421c42
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb al, al
pop edi
not al
and al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x10], 0
mov dword [ebp - 4], 0
je 0x421ca1
cmp dword [eax + 0x14], 8
jb 0x421c79
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421c98
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x421ca7
mov byte [edi], 0
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x421cb1
mov eax, dword [esi]
jmp 0x421cb3
mov eax, esi
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp - 4]
sete dl
push eax
mov byte [edi], dl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x421ca1
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x427530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b4d08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x669404]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
lea ecx, [ebp + 8]
lea esi, [esp + 0x14]
call fcn.0041df60
lea ecx, [ebp + 0xc]
call fcn.0041df60
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, esi
push ecx
mov ecx, edi
call edx
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4275aa
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x471d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb700
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x669404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 1
call fcn.00471030
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 4]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 4]
mov dword [esi + 8], edx
xor eax, eax
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
lea eax, [esi + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004720a0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47e950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8b5e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x669404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
push eax
call fcn.0047f140
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [esi], vtable.boost::thread_exception.0
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [ebp - 4], 2
lea eax, [esi + 0x30]
mov dword [eax], vtable.boost::exception.0
mov dword [ebp + 8], eax
mov dword [eax + 4], ecx
mov byte [ebp - 4], 3
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
or ecx, 0xffffffff
mov dword [eax + 0x10], ecx
mov byte [ebp - 4], 4
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [eax], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [ebp - 4], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4bcb50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b92bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x669404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 1
call fcn.00471030
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 4]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 4]
mov dword [esi + 8], edx
xor ebx, ebx
mov word [esi + 0x30], bx
mov dword [ebp - 4], ebx
lea eax, [esi + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x4bcbcb
mov ecx, dword [ebp + 8]
lea edi, [ecx + 0x1c]
push eax
call fcn.004bd3b0
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x506b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
mov dword [ebp - 4], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x506ba5
mov eax, 0x3fff
jmp 0x506ba9
mov eax, dword [ebp - 4]
inc eax
xor ecx, ecx
mov dword [ebp - 4], eax
mov edx, 2
mul edx
seto cl
push esi
neg ecx
or ecx, eax
push ecx
call fcn.00543310
mov esi, eax
add esp, 4
test esi, esi
je 0x506c06
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call sub.MSVCR100.dll_memset
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x506c0d
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x506c12
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.00406180
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50c850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, edx
je 0x50c885
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
mov dword [ebp + 8], ecx
cmp ecx, edx
jne 0x50c861
pop edi
pop esi
pop ebp
ret
Function at 0x50c890
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baa83
mov eax, dword fs:[0]
push eax
mov eax, 0x1010
call fcn.00549c70
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1018], eax
xor esi, esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x101c]
push ecx
push 0x1000
lea edx, [ebp - 0x1010]
push edx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x50c910
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x1c], 8
jb 0x50c907
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
xor al, al
jmp 0x50c99b
mov ebx, dword [ebp - 0x101c]
shr ebx, 2
xor edi, edi
cmp ebx, esi
jbe 0x50c97d
nop
mov edx, dword [ebp + edi*4 - 0x1010]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1014], esp
push 0xffffffffffffffff
push esi
lea edx, [ebp + 8]
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], esi
push edx
mov word [ecx], ax
call fcn.00406730
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.0050cdf0
mov dword [ebp - 0x1014], eax
cmp eax, esi
je 0x50c978
mov esi, dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.0041df60
xor esi, esi
inc edi
cmp edi, ebx
jb 0x50c920
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x1c], 8
jb 0x50c997
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov al, 1
mov word [ebp + 8], cx
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x1c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret 0x20
Function at 0x50d080
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov esi, eax
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x10], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x50d0b7
mov eax, dword [esi]
jmp 0x50d0b9
mov eax, esi
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 1
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50d0f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x50d108
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x50d13a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x50d136
cmp esi, eax
jae 0x50d13a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x50d128
cmp esi, eax
jb 0x50d140
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x5139e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba239
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x669404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], eax
mov byte [ebx], al
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100
mov esi, eax
push 0x86
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x513ac6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x513ada
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x513ada
test edi, edi
je 0x513ada
lea eax, [edi + 1]
push eax
call fcn.00543310
push edi
mov esi, eax
push ebx
push esi
call sub.MSVCR100.dll_memcpy
mov eax, esi
add esp, 0x10
mov byte [esi + edi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x513a93
mov edi, dword [ebp + 8]
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00405f10
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x513af0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baa00
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20dc
call fcn.00549c70
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20b0], eax
mov dword [ebp - 0x20ac], ecx
xor edx, edx
mov word [ebp - 0x20a4], dx
push 0x1046
push edx
lea eax, [ebp - 0x20a2]
push eax
call sub.MSVCR100.dll_memset
xor ecx, ecx
mov word [ebp - 0x105c], cx
push 0x1046
push ecx
lea edx, [ebp - 0x105a]
push edx
call sub.MSVCR100.dll_memset
push 0x38
push 0
lea eax, [ebp - 0x20e8]
push eax
call sub.MSVCR100.dll_memset
add esp, 0x24
mov dword [ebp - 0x20ec], 0x3c
lea ecx, [ebp - 0x105c]
mov dword [ebp - 0x20dc], ecx
mov eax, 0x823
mov dword [ebp - 0x20d8], eax
lea edx, [ebp - 0x20a4]
mov dword [ebp - 0x20c0], edx
mov dword [ebp - 0x20bc], eax
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x513bc8
mov esi, dword [esi]
lea eax, [ebp - 0x20ec]
push eax
push 0x10000000
push 0
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov esi, eax
mov dword [ebp - 0x20a8], esi
test esi, esi
je 0x513c23
lea ecx, [ebp - 0x105c]
push ecx
mov ecx, ebx
call fcn.00414e10
lea edx, [ebp - 0x20a4]
push edx
mov ecx, edi
call fcn.00414e10
mov ax, word [ebp - 0x20d4]
mov ecx, dword [ebp - 0x20b0]
mov word [ecx], ax
mov edx, dword [ebp - 0x20e0]
mov eax, dword [ebp - 0x20ac]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x513c49
xor eax, eax
cmp esi, 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret