joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e74c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ba2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
call fcn.0041ae80
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], 0xdf9b81e7
mov dword [ebp - 0x1c], 0xf940fadb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0x7dbb92e6
mov dword [ebp - 0x1c], 0x14d846fe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xdf9be395
mov dword [ebp - 0x1c], 0xf940fadb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x7dbb92e6
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], 0x14d846fe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x30]
xorps xmm1, xmmword [ebp - 0x40]
push ecx
push eax
movaps xmmword [ebp - 0x30], xmm1
call fcn.00439820
mov edi, eax
add esp, 8
test edi, edi
je 0x4e7617
push 2
push 0
push edi
call fcn.0043d5f6
add esp, 0xc
push edi
call fcn.004393ab
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.0043d5f6
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
cmp esi, edx
ja 0x4e75eb
mov dword [ecx + 0x10], esi
cmp dword [ecx + 0x14], 0xf
jbe 0x4e75e5
mov ecx, dword [ecx]
mov byte [ecx + esi], 0
jmp 0x4e75fa
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00418dc0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0xf
jbe 0x4e7604
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.0044209f
push edi
call fcn.0043d0a8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e7640
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ba62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0xdf9b81e7
mov dword [ebp - 0x14], 0xf940fadb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x7dbb92e6
mov dword [ebp - 0x14], 0x14d846fe
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0xdf9be395
mov dword [ebp - 0x14], 0xf940fadb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0x7dbb92e6
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0x14d846fe
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x30]
xorps xmm1, xmmword [ebp - 0x40]
push ecx
push eax
movaps xmmword [ebp - 0x30], xmm1
call fcn.00439820
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4e77bc
push 2
push 0
push edi
call fcn.0043d5f6
add esp, 0xc
push edi
call fcn.004393ab
add esp, 4
mov edi, eax
push 0
push 0
push dword [ebp - 0x14]
call fcn.0043d5f6
mov ecx, dword [esi + 0x10]
add esp, 0xc
cmp edi, ecx
ja 0x4e778d
mov dword [esi + 0x10], edi
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x4e7787
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x4e779b
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00418dc0
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4e77a5
mov eax, dword [esi]
push dword [ebp - 0x14]
push edi
push 1
push eax
call fcn.0044209f
push dword [ebp - 0x14]
call fcn.0043d0a8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4eea40
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edi
mov ebx, edi
mov al, byte [edi]
test al, al
je 0x4eea6f
nop
cmp al, 0x2e
je 0x4eeab8
push ebx
call esi
mov ebx, eax
mov al, byte [ebx]
test al, al
jne 0x4eea60
mov ebx, edi
mov dword [ebp - 4], edi
mov al, byte [ebx]
test al, al
je 0x4eea92
nop word [eax + eax]
cmp al, 0x2f
je 0x4eea97
push ebx
call esi
mov ebx, eax
mov dword [ebp - 4], ebx
mov al, byte [ebx]
test al, al
jne 0x4eea80
xor ebx, ebx
mov dword [ebp - 4], ebx
mov al, byte [edi]
mov ecx, edi
test al, al
je 0x4eeaaf
nop
cmp al, 0x2f
je 0x4eeabe
push ecx
call esi
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x4eeaa0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4eea74
mov esi, dword [0x585b2c]
lea eax, [ecx + 2]
mov edi, dword [0x585b28]
push 0
push 3
push esi
push edi
mov dword [ebp - 8], eax
call fcn.00458660
add eax, dword [0x585b30]
mov ecx, eax
mov dword [ebp - 0xc], eax
adc edx, dword [0x585b34]
sub ecx, edi
mov dword [0x585b30], eax
mov eax, edx
sbb eax, esi
mov dword [0x585b34], edx
or ecx, eax
je 0x4eeb14
sub edi, dword [ebp - 0xc]
mov dword [0x585b28], edi
sbb esi, edx
mov dword [0x585b2c], esi
jmp 0x4eeb28
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [0x585b30], eax
adc edx, 0
mov dword [0x585b34], edx
test esi, esi
jg 0x4eeb40
jl 0x4eeb40
cmp edi, 0x176
ja 0x4eeb40
test esi, esi
jg 0x4eeb4b
jl 0x4eeb40
test edi, edi
jae 0x4eeb4b
xorps xmm0, xmm0
movlpd qword [0x585b28], xmm0
test ebx, ebx
jne 0x4eeb5c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
jmp 0x4eeb5f
sub ebx, dword [ebp - 8]
lea esi, [ebx + 1]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 1]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push dword [ebp - 8]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x14]
mov edx, edi
push 0x7530
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_Edg_117.0.2045.36
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004edc80
add esp, 0x14
mov esi, eax
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ef6d0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0x67452301
mov eax, ecx
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x9c], 0
ret
Function at 0x4f1740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
test ecx, ecx
je 0x4f1913
cmp dword [ecx + 0x20], 0
je 0x4f1913
cmp dword [ecx + 0x24], 0
je 0x4f1913
mov eax, dword [ecx + 0x1c]
lea edi, [ecx + 0x1c]
test eax, eax
je 0x4f1913
cmp dword [eax], ecx
jne 0x4f1913
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x4f17a4
cmp eax, 0x39
je 0x4f17a4
cmp eax, 0x45
je 0x4f17a4
cmp eax, 0x49
je 0x4f17a4
cmp eax, 0x5b
je 0x4f17a4
cmp eax, 0x67
je 0x4f17a4
cmp eax, 0x71
je 0x4f17a4
cmp eax, 0x29a
jne 0x4f1913
mov edx, dword [edi]
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov eax, dword [edx + 8]
push esi
mov esi, dword [edx + 0x18]
mov dword [edx + 0x14], 0
mov dword [edx + 0x10], eax
test esi, esi
jns 0x4f17dc
neg esi
mov dword [edx + 0x18], esi
cmp esi, 2
jne 0x4f17ec
mov dword [edx + 4], 0x39
xor eax, eax
jmp 0x4f1805
push ebx
mov ebx, 0x2a
test esi, esi
mov eax, 0x71
cmovne eax, ebx
mov dword [edx + 4], eax
mov eax, 1
pop ebx
mov dword [ecx + 0x30], eax
lea eax, [edx + 0x94]
mov dword [edx + 0xb18], eax
mov ecx, edx
lea eax, [edx + 0x988]
mov dword [edx + 0x28], 0
mov dword [edx + 0xb24], eax
lea eax, [edx + 0xa7c]
mov dword [edx + 0xb30], eax
xor eax, eax
mov dword [edx + 0xb20], 0x56ae64
mov dword [edx + 0xb2c], 0x56b390
mov dword [edx + 0xb38], 0x56ae78
mov word [edx + 0x16b8], ax
mov dword [edx + 0x16bc], eax
call fcn.004f6d00
mov esi, dword [edi]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004359b0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x56967a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x569678]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x56967c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x56967e]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop edi
ret
mov eax, 0xfffffffe
pop edi
ret
Function at 0x4f84f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x100ac], 0
je 0x4f8599
cmp dword [esi + 0x7c], 0
jbe 0x4f8599
mov eax, 0xffffff5c
push ebx
sub eax, esi
lea ebx, [esi + 0xa4]
push edi
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
mov ecx, dword [esi + 0x100d0]
xor eax, ecx
mov edx, dword [esi + 0x100dc]
movzx eax, al
mov edi, dword [esi + 0x100d8]
shr ecx, 8
and edi, 0xfffd
or edi, 2
xor ecx, dword [edx + eax*4]
movzx eax, cl
add eax, dword [esi + 0x100d4]
imul eax, eax, 0x8088405
mov dword [esi + 0x100d0], ecx
mov ecx, dword [esi + 0x100d8]
inc eax
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
mov eax, edi
xor eax, 1
mov dword [esi + 0x100d8], ecx
imul eax, edi
shr eax, 8
xor byte [ebx], al
inc ebx
mov eax, dword [ebp - 4]
add eax, ebx
cmp eax, dword [esi + 0x7c]
jb 0x4f8520
pop edi
pop ebx
push dword [esi + 0x7c]
lea eax, [esi + 0xa4]
push eax
push dword [esi + 0x2c]
mov eax, dword [esi + 8]
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0x7c]
add esp, 0x10
sub eax, ecx
mov dword [esi + 0x7c], 0
neg eax
sbb eax, eax
add dword [esi + 0x100c0], ecx
mov ecx, dword [esi + 0x48]
adc dword [esi + 0x100c4], 0
add dword [esi + 0x100c8], ecx
mov dword [esi + 0x48], 0
adc dword [esi + 0x100cc], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fa280
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
mov cl, byte [ebx]
test cl, cl
je 0x4fa2fa
push edi
mov eax, 0x12345678
mov edi, 0x23456789
mov edx, 0x34567890
mov ebx, dword [ebp + 8]
movsx ecx, cl
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, edi
mov dword [esi], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 4], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov ebx, dword [ebp - 4]
inc ebx
mov dword [esi + 8], edx
mov dword [ebp - 4], ebx
mov cl, byte [ebx]
test cl, cl
jne 0x4fa2b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527e30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov eax, edx
mov dword [esp + 4], eax
push esi
push edi
mov edi, ecx
test eax, eax
je 0x527fc4
test edi, edi
je 0x527e9e
cmp byte [edi + 0x1e], 0
jne 0x527fc4
cmp byte [edi + 0xe2], 0
je 0x527e9e
mov eax, 0x44
cmp ax, word [edi + 0xe0]
ja 0x527e9e
mov ebx, dword [edi + 0xec]
test ebx, ebx
je 0x527e9e
mov eax, dword [ebx]
mov dword [edi + 0xec], eax
mov eax, dword [edi + 0xe4]
inc eax
mov dword [edi + 0xe4], eax
cmp eax, dword [edi + 0xe8]
jle 0x527ebe
mov dword [edi + 0xe8], eax
jmp 0x527ebe
push 0x44
call fcn.0054a0f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x527ebe
test edi, edi
je 0x527eb6
mov byte [edi + 0x1e], 1
test ebx, ebx
je 0x527fc4
mov edx, dword [esp + 0xc]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
mov edx, dword [edx]
call fcn.00528700
mov dword [ebx], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 8]
call fcn.005282a0
add esp, 4
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0xc]
push esi
call fcn.00528b30
mov dword [ebx + 0xc], eax
mov ecx, edi
mov eax, dword [esp + 0x14]
push esi
mov edx, dword [eax + 0x10]
call fcn.00528700
add esp, 0xc
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0x14]
push esi
call fcn.00528b30
mov dword [ebx + 0x14], eax
mov ecx, edi
mov eax, dword [esp + 0x14]
push esi
mov edx, dword [eax + 0x18]
call fcn.00528700
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [ebx + 0x18], eax
mov al, byte [ecx + 4]
mov byte [ebx + 4], al
mov edx, dword [ecx + 0x1c]
mov ecx, edi
push esi
call fcn.00527e30
add esp, 4
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0x28]
push esi
call fcn.00528b30
push 0
push esi
mov esi, dword [esp + 0x1c]
mov ecx, edi
mov dword [ebx + 0x28], eax
mov edx, dword [esi + 0x2c]
call fcn.00528b30
mov dword [ebx + 0x2c], eax
add esp, 0x10
mov dword [ebx + 0x30], 0
mov eax, 0xfff7
mov dword [ebx + 0x34], 0
mov cx, word [esi + 6]
and cx, ax
mov dword [ebx + 0x24], 0
mov word [ebx + 6], cx
mov eax, ebx
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x58920c]
sub esp, 0x31c
push ebx
mov ebx, edx
push esi
push edi
test eax, eax
je 0x545176
push eax
push 0x56ee84
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.00547f40
add esp, 0x10
jmp 0x545213
mov eax, dword [0x589578]
test eax, eax
jne 0x5451a8
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x198], 2
sete al
inc eax
mov dword [0x589578], eax
cmp eax, 2
jne 0x5451cc
lea eax, [ebp - 0x318]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x318]
call fcn.00545cb0
jmp 0x5451e9
lea eax, [ebp - 0x218]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
call fcn.00545b50
mov esi, eax
test esi, esi
je 0x545318
push esi
push 0x56ee84
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.00547f40
push esi
call fcn.00441c96
add esp, 0x14
cmp byte [ebp - 0x110], 0
lea eax, [ebp - 0x110]
je 0x545228
inc eax
cmp byte [eax], 0
jne 0x545222
lea ecx, [ebp - 0x110]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x54524b
lea ecx, [ebp + eax - 0x111]
nop
cmp byte [ecx], 0x5c
jne 0x54524b
dec ecx
sub eax, 1
jne 0x545240
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push ebx
push 0xe7
call fcn.00547f40
add esp, 0x10
mov edi, ebx
test ebx, ebx
je 0x545286
cmp byte [ebx], 0
je 0x54527e
inc edi
cmp byte [edi], 0
jne 0x545278
sub edi, ebx
and edi, 0x3fffffff
lea esi, [edi + ebx]
mov ecx, 0x14
mov edx, esi
call fcn.00547cc0
add esi, 2
mov dword [ebp - 4], 0x3e
mov ecx, 4
movzx eax, byte [esi - 2]
lea esi, [esi + 5]
xor edx, edx
div dword [ebp - 4]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
xor edx, edx
mov byte [esi - 7], al
movzx eax, byte [esi - 6]
div dword [ebp - 4]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
xor edx, edx
mov byte [esi - 6], al
movzx eax, byte [esi - 5]
div dword [ebp - 4]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
xor edx, edx
mov byte [esi - 5], al
movzx eax, byte [esi - 4]
div dword [ebp - 4]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
xor edx, edx
mov byte [esi - 4], al
movzx eax, byte [esi - 3]
div dword [ebp - 4]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi - 3], al
sub ecx, 1
jne 0x5452a4
mov byte [edi + ebx + 0x14], cl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5460d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x546124
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x546114
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x56c740]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x5460f4
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x546126
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.005461b0
add esp, 8
test eax, eax
je 0x546140
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x546430
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x54645d
nop dword [eax]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x56c740]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x546440
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40288e
pop dword [ebp - 0x28]
mov eax, 0x5dc5c00f
add eax, 0xa27a687f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xec7404ec
add dword [ebp - 0x38], 0x61de405f
mov dword [ebp - 0x34], 0x29d7092c
sub dword [ebp - 0x34], 0xf7a3bce7
mov dword [ebp - 0x30], 0x4a267171
add dword [ebp - 0x30], 0x225d2bd
mov dword [ebp - 0x2c], 0x74610c46
add dword [ebp - 0x2c], 0x8b9ef3ba
lea eax, [ebp - 0x38]
push eax
mov eax, 0xee4f566a
add eax, 0x11f12a22
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x261eb2af
sub dword [ebp - 0x38], 0xb1ac4959
mov dword [ebp - 0x34], 0xe4753a9a
add dword [ebp - 0x34], 0x5cf726db
mov dword [ebp - 0x30], 0xf3aabdb2
add dword [ebp - 0x30], 0x6fc4aeba
mov dword [ebp - 0x2c], 0xf221a58e
sub dword [ebp - 0x2c], 0xf221a58e
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa438c273
sub eax, 0xa3f8419f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x31952
push 0
call eax
mov ecx, 0x2e4db979
sub ecx, 0x2e4d8587
mov edi, eax
mov ebx, 0xe80a11f4
sub ebx, 0xe7c901f4
add ebx, dword [ebp - 0x28]
mov edx, 0x7574d2c2
sub dword [ebp - 0x14], 0x7b3798b7
mov esi, dword [ebx]
sub dword [ebp - 0x10], edx
xor esi, edx
mov dword [ebp - 0x14], 0x81aa4b98
mov dword [edi], esi
sub dword [ebp - 0x18], ebx
add edi, 4
add ebx, 0x83b780fe
add ebx, 0x7c487f06
loop 0x4029aa
add eax, 0xc29b
mov ebx, eax
add eax, 0x434631b1
add eax, 0xbcb9ce54
mov ecx, 0x13035b3e
sub ecx, 0x12c35b3e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1000e5e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000e5f2
pop dword [ebp - 0x30]
mov eax, 0xcae0c4be
sub eax, 0xbadfdecc
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xcfd45771
sub dword [ebp - 0x40], 0x81821226
mov dword [ebp - 0x3c], 0x5b18a3e5
add dword [ebp - 0x3c], 0xd71aa860
mov dword [ebp - 0x38], 0x596b3383
add dword [ebp - 0x38], 0xf2e110ab
mov dword [ebp - 0x34], 0x956e3ac1
add dword [ebp - 0x34], 0x6a91c53f
lea eax, [ebp - 0x40]
push eax
mov eax, 0xcbd434b2
add eax, 0x442cfb2e
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x9fe39cc
add dword [ebp - 0x40], 0x6a742f8a
mov dword [ebp - 0x3c], 0xfaeff613
add dword [ebp - 0x3c], 0x467c6b62
mov dword [ebp - 0x38], 0xa7442db5
add dword [ebp - 0x38], 0xbc2b3eb7
mov dword [ebp - 0x34], 0xaf1e7633
sub dword [ebp - 0x34], 0xaf1e7633
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x86006858
add eax, 0x8a00c790
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x317c0
push 0
call eax
mov ecx, 0xe7e76c2f
sub ecx, 0xe7e73880
xor edx, edx
add edx, eax
mov ebx, 0xc47477f0
sub ebx, 0xb472edf0
add ebx, dword [ebp - 0x30]
mov esi, 0x17103896
add dword [ebp - 0xc], edi
mov edi, dword [ebx]
add dword [ebp - 8], ecx
sub edi, esi
sub dword [ebp - 0x18], edi
mov dword [edx], edi
xor dword [ebp - 0x28], 0x338e0752
add edx, 0x3803f71
add edx, 0xfc7fc093
add ebx, 0x4339b0cc
add ebx, 0xbcc64f38
loop 0x1000e710
add eax, 0xc18f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfcc089ef
sub ecx, 0xecc089ef
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10001330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101f9e50]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 0
je 0x10001364
mov dword [ebp - 0x1c], 0x20119
jmp 0x1000136b
mov dword [ebp - 0x1c], 0x20219
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x100013df
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100013d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016059f
mov esp, ebp
pop ebp
ret