joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507a14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x507a2d
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x507a3a
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x507a58
cld
pop edi
pop esi
xor ecx, ecx
mov cl, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x507a7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
xor ecx, ecx
mov cl, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x507ac3
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.004050ac
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.004050ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x508054
Capabilities:
Read data from internet
Read file on windows
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax - 0x1009], 0
je 0x5080a5
push 0
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x130]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x168]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb eax, eax
inc eax
pop ebp
ret
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x130]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x164]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x50cc68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50cdbc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
mov eax, dword [0x57ec88]
call fcn.00405324
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x50cd2f
mov dl, 1
mov eax, dword [0x41ff34]
call fcn.00403f08
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50cd1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x50cdc8
mov edx, 0x50cdc8
mov eax, dword [0x57a668]
call fcn.00506dd4
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407ce4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cd26
mov eax, dword [ebp - 0x10]
call fcn.00403f38
ret
push 1
push dword [0x57ec88]
push 0x50cdd8
lea edx, [ebp - 0x1c]
mov eax, dword [0x579590]
mov eax, dword [eax]
call fcn.004c5528
push dword [ebp - 0x1c]
push 0x50cdd8
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004051e4
mov eax, dword [ebp - 0x18]
call fcn.00405324
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x1d2], 0
je 0x50cd9c
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1d4]
call dword [ebx + 0x1d0]
jmp 0x50cda1
call fcn.00506e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cdc3
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404e6c
ret

Function at 0x50fd70
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x50fd9e
mov eax, ebx
call fcn.00510824
cmp dword [ebx + 0x40], 0
je 0x50fd97
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x50fe0f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x50fe01
cmp dword [ebx + 8], 0
je 0x50fdc0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x50fdd2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x50fe01
cmp dword [ebx + 8], 0
je 0x50fdb3
cmp eax, 3
je 0x50fde5
dec eax
jne 0x50fdb3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x50fdb3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x50fdb3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x50fe2d
cmp dword [ebx + 0x14], 0xcc
je 0x50fe2d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0050fe38
pop ebx
ret
Function at 0x526e4c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41eb58]
call fcn.00405984
xor eax, eax
push ebp
push 0x526f90
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x577ff0], 0
jne 0x526e9f
mov ecx, dword [0x578db0]
mov dl, 1
mov eax, dword [0x40acb8]
call fcn.0041102c
call fcn.0040479c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403750
mov eax, ebx
call fcn.00405738
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x526fa0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406e70
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405748
test eax, eax
jle 0x526f37
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x526f30
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004050ec
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004050b8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040bc98
test eax, eax
jne 0x526f30
mov ebx, 0x15
jmp 0x526f3c
mov ebx, 0x10
jmp 0x526f3c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x577ff0]
call fcn.00526da4
mov eax, dword [ebp - 8]
call fcn.00526da4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526f97
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404e6c
lea eax, [ebp - 0x10]
mov edx, dword [0x41eb58]
call fcn.00405a54
ret

Function at 0x53d264
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004085f8
ret

Function at 0x53e2a4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x53e2c9
cmp dword [esp + 4], 5
jb 0x53e2c9
mov al, 1
jmp 0x53e2cb
xor eax, eax
add esp, 0x94
ret
Function at 0x54fb38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54fd98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x54fb9b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0054f650
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0041197c
cmp al, 1
jne 0x54fb9b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0054f918
test al, al
je 0x54fd27
cmp dword [ebp - 8], 0
jge 0x54fbb9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0054f650
mov eax, dword [ebp - 0x210]
call fcn.00405124
cmp ebx, eax
jge 0x54fc03
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0054f650
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x579984]
and eax, 0xff
bt dword [edx], eax
jae 0x54fc03
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x54fc17
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0054fb14
cmp ebx, dword [ebp - 8]
je 0x54fd19
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x54fc43
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404140
and eax, 0x7f
movzx eax, word [eax*2 + 0x578840]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x54fd06
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404140
and eax, 0x7f
movzx eax, word [eax*2 + 0x578840]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004ab768
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404140
and eax, 0x7f
movzx eax, word [eax*2 + 0x578840]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004ab768
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54fd0d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x54fd7a
cmp dword [ebp - 8], 0
jge 0x54fd32
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0054f650
mov eax, dword [ebp - 0x218]
call fcn.00405124
cmp eax, dword [ebp - 8]
jg 0x54fd6c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0054f650
mov eax, dword [ebp - 0x21c]
call fcn.00405124
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054fb14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54fd9f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404e6c
ret
Function at 0x5566b4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x578a64]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x5566f0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x556708
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x556701
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403750
xor edx, edx
mov eax, 0x578c64
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x556772
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x556726
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5569b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x5569c9
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x5569c2
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x5569db
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x5569d4
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.005565a4
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x5569f5
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.005566b4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x556a7a
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x556a97
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00556634
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x556ac0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x556ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x556af1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x556aea
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x556b05
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0055649c
test bl, bl
jne 0x556bd8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x57ed18
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x556b3c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x556b50
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.005569b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x556b82
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x556b31
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x556ba5
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x556bb6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x556bca
jmp 0x556c93
cmp bl, 1
jne 0x556c93
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x57ed72
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x556bf8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x556c0c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.005569b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x556c3e
sub ebx, 6
inc dword [ebp - 8]
jne 0x556bed
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x556c65
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x556c76
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x556c8a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00556520
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x557af0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405314
xor eax, eax
push ebp
push 0x557c1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404e48
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405324
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x557bf9
mov eax, ebx
call fcn.00402bd4
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00405324
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x557c2c
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040c218
push dword [ebp - 0x14]
push 0x557c38
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.0040c218
push dword [ebp - 0x18]
push 0x557c38
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040c218
push dword [ebp - 0x1c]
push 0x557c38
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040c218
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call fcn.004051e4
mov eax, esi
call fcn.00402c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557c23
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404e6c
lea eax, [ebp - 4]
call fcn.00404e48
ret
Function at 0x4010c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4010cf
xor eax, eax
pop esi
ret 8
lea eax, [esi + 8]
push eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [esi + 0xc]
sbb edx, edx
and edx, 0x10000
push edx
push ecx
push 0x401070
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x401109
mov edx, dword [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
ret 8

Function at 0x401120
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x40112c
pop esi
ret
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
ret

Function at 0x401310
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x850
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x848], eax
mov ecx, dword [esp + 0x860]
push esi
mov esi, dword [esp + 0x858]
lea eax, [esp + 0x868]
push eax
push ecx
lea edx, [esp + 0x450]
push edx
mov byte [esp + 0x10], 0x56
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x45
call fcn.005c5e93
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test byte [0x69aaa8], 8
je 0x4013b5
movsx edx, byte [esp + esi + 4]
lea ecx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [esp + 0x1c]
movzx edx, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x20]
push ecx
push edx
push eax
lea ecx, [esp + 0x34]
push str.__02d:_02d:_02d__03d_thread:_d__c___s
push ecx
call fcn.005c1f0c
add esp, 0x24
jmp 0x4013ed
movsx eax, byte [esp + esi + 4]
movzx ecx, word [esp + 0x16]
lea edx, [esp + 0x448]
push edx
movzx edx, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1c]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push str.__02d:_02d:_02d__03d__c___s
push edx
call fcn.005c1f0c
add esp, 0x20
test byte [0x69aaa8], 4
je 0x40142a
push 0x6650a8
push 0x69da58
call fcn.005c24a0
mov esi, eax
add esp, 8
test esi, esi
je 0x40142a
lea eax, [esp + 0x18]
push esi
push eax
call fcn.005c5ead
push esi
push 0xa
call fcn.005c5d09
push esi
call fcn.005c217c
add esp, 0x14
test byte [0x69aaa8], 1
je 0x401440
lea ecx, [esp + 0x18]
push ecx
call fcn.005c5fbc
add esp, 4
test byte [0x69aaa8], 2
je 0x40145d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x18]
push edx
call esi
push 0x6650ac
call esi
mov ecx, dword [esp + 0x84c]
pop esi
xor ecx, esp
call fcn.005bfcb8
add esp, 0x850
ret