joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd7f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
test dl, dl
je 0x4cd819
add esp, 0xfffffff0
call fcn.0040476c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cd8fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5923cc]
cmp dword [eax], 0
jne 0x4cd883
lea eax, [ebp - 0x105]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004054d4
mov eax, dword [ebp - 0x210]
call fcn.0054f6c4
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x4cd924
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x4cd8a3
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x4cd924
mov eax, dword [0x5923cc]
mov eax, dword [eax]
call fcn.00405724
push eax
call sub.kernel32.dll_GetTempFileNameA
push 0xffff
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004054d4
mov ecx, dword [ebp - 0x214]
xor edx, edx
mov eax, esi
call fcn.0041f82c
lea eax, [esi + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004054d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd905
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00405288
ret

Function at 0x4e4890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov ecx, dword [edx]
mov eax, ecx
movzx eax, word [eax]
cmp eax, esi
jbe 0x4e48b7
mov eax, ecx
movzx esi, word [eax + 2]
xor esi, 1
mov eax, dword [eax + 8]
mov dword [edx], eax
jmp 0x4e48c5
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx esi, word [eax + 2]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov edx, dword [ebx + 8]
test edx, edx
jne 0x4e4994
mov ecx, dword [ebx + 0x20]
test ecx, ecx
jne 0x4e4987
mov eax, dword [ebx + 0x18]
test byte [eax + 8], 7
jne 0x4e4934
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x4e4907
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x4e4907
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x4e4937
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x4e4920
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.004eb908
mov edi, eax
jmp 0x4e4937
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x4e4937
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x4e4948
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x4e4979
cmp edi, 0x8f
jle 0x4e496b
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x4e4994
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x4e4994
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x4e4994
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x4e48c5
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e49b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, edx
movzx ecx, word [eax]
mov eax, dword [ebx + 4]
cmp ecx, eax
ja 0x4e49e0
mov eax, edx
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 8]
xor esi, 1
mov dword [edx], eax
jmp 0x4e49f7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x4e4ac6
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x4e4ab9
mov edx, dword [ebx + 0x18]
test byte [edx + 8], 7
jne 0x4e4a66
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x4e4a39
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x4e4a39
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x4e4a69
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x4e4a52
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.004eb908
mov edi, eax
jmp 0x4e4a69
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x4e4a69
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x4e4a7a
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x4e4aab
cmp edi, 0x8f
jle 0x4e4a9d
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x4e4ac6
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x4e4ac6
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x4e4ac6
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x4e49f7
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f5b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x58d890
test edx, edx
jne 0x4f5b20
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4f5be8
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x4f5b2c
test ecx, ecx
je 0x4f5c05
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x4f5bec
xor eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x4fad98
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x4faf25
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x4fade9
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x4fadfa
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x4fae10
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x4fae32
mov ebx, dword [ecx]
test ebx, ebx
jg 0x4fae26
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x4fae2a
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x4fae1a
test di, di
je 0x4faf25
mov dl, byte [eax + 9]
sub dl, 2
je 0x4fae5b
sub dl, 2
je 0x4fae7b
sub dl, 4
je 0x4faeb5
sub dl, 8
je 0x4faed9
jmp 0x4faf25
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x4faf25
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x4fae6b
jmp 0x4faf25
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x4faf25
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x4faea5
jmp 0x4faf25
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x4faf25
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x4faec5
jmp 0x4faf25
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x4faf25
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x4faef0
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x539b74
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x539ba4
mov eax, ebx
call fcn.0053a698
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x539b9d
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x539c1c
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x539c0e
mov edx, dword [ebx + 8]
test edx, edx
je 0x539bca
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x539bdc
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x539c0e
mov edx, dword [ebx + 8]
test edx, edx
je 0x539bbc
cmp eax, 3
je 0x539bf0
dec eax
jne 0x539bbc
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x539bbc
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x539bbc
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x539c3c
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x539c3c
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00539c48
pop ebx
ret

Function at 0x54f6a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405724
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x54f6b9
test al, 0x10
jne 0x54f6bd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x550f48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00550c3c
mov dword [esp + 4], ebx
xor ebx, ebx
cmp edi, ebx
jle 0x550f77
mov eax, dword [esp + 4]
cmp byte [eax + ebx], 0x1c
je 0x550f77
inc ebx
cmp edi, ebx
jg 0x550f68
mov eax, dword [esp + 4]
cmp byte [eax + ebx], 0x1c
jne 0x55102c
inc ebx
lea eax, [ebx + 4]
cmp edi, eax
jle 0x55102c
mov eax, dword [esp + 4]
movzx ebp, byte [eax + ebx]
inc ebx
mov eax, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax + ebx]
inc ebx
mov eax, dword [esp + 4]
test byte [eax + ebx], 0x80
je 0x550fe6
mov eax, dword [esp + 4]
movzx esi, byte [eax + ebx + 2]
shl esi, 0x18
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx + 3]
shl eax, 0x10
add esi, eax
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx + 4]
shl eax, 8
add esi, eax
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx + 5]
add esi, eax
add ebx, 6
jmp 0x550fff
mov eax, dword [esp + 4]
movzx esi, byte [eax + ebx]
shl esi, 8
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx + 1]
or esi, eax
add ebx, 2
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov esi, eax
lea eax, [esi + ebx]
cmp edi, eax
jl 0x55102c
mov eax, dword [esp + 4]
add eax, ebx
push eax
push esi
mov edx, ebp
mov eax, dword [esp + 8]
call fcn.00550bd4
add ebx, esi
cmp edi, ebx
jg 0x550f77
mov eax, dword [esp]
mov byte [eax + 0xc], 0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55b8e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405714
xor eax, eax
push ebp
push 0x55ba2a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x55b9b2
mov eax, dword [0x5923cc]
cmp dword [eax], 0
jne 0x55b971
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004054d4
mov eax, dword [ebp - 0x214]
call fcn.0054f6c4
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x55ba3c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x55b99d
mov eax, dword [0x5923cc]
mov eax, dword [eax]
call fcn.0054f6c4
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x55ba3c
mov eax, dword [0x5923cc]
mov eax, dword [eax]
call fcn.00405724
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebx + 8]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004054d4
jmp 0x55b9bd
lea eax, [ebx + 8]
mov edx, dword [ebp - 4]
call fcn.004052b8
xor eax, eax
push ebp
push 0x55b9fd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x41a7b8]
call fcn.0041f82c
mov esi, eax
mov dword [ebx + 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, esi
call fcn.0041f398
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55ba09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ba31
lea eax, [ebp - 0x214]
call fcn.00405264
lea eax, [ebp - 4]
call fcn.00405264
ret
Function at 0x55ba44
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
call fcn.0055b8d8
test al, al
je 0x55bb95
mov eax, dword [ebp - 4]
call fcn.0055b8d8
test al, al
je 0x55bb95
mov eax, ebx
call fcn.0055bccc
mov eax, dword [ebp - 4]
call fcn.0055bccc
cmp dword [ebp + 0x14], 0
jne 0x55bb0e
cmp dword [ebp + 0x10], 0
jne 0x55bb0e
mov eax, dword [ebx + 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, dword [ebp + 0xc]
jne 0x55bb0e
cmp eax, dword [ebp + 8]
jne 0x55bb0e
mov eax, dword [ebx + 4]
call fcn.004043f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004043f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040bb10
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405724
push eax
mov eax, dword [ebx + 8]
call fcn.00405724
push eax
call sub.kernel32.dll_CopyFileA
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dl, 1
mov eax, dword [0x41a7b8]
call fcn.0041f82c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 2
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x41a7b8]
call fcn.0041f82c
mov dword [ebx + 4], eax
jmp 0x55bb95
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebx + 4]
call fcn.0041f334
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0041f334
mov eax, 0x100000
call fcn.00402e50
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x55bb4b
cmp dword [ebp + 8], 0x100000
jae 0x55bb52
jmp 0x55bb4d
jge 0x55bb52
mov esi, dword [ebp + 8]
jmp 0x55bb57
mov esi, 0x100000
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, esi
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x55bb8b
cmp dword [ebp + 8], 0
ja 0x55bb3a
jmp 0x55bb8d
jg 0x55bb3a
mov eax, dword [ebp - 8]
call fcn.00402e80
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x55bd00
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x5670d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp dword [0x591f2c], 0
jne 0x5670ef
call fcn.00566610
mov edx, edi
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x56711f
inc ecx
mov eax, ebx
mov ebx, edx
xor bl, byte [eax]
and ebx, 0xff
mov esi, dword [0x591f2c]
mov ebx, dword [esi + ebx*4]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc eax
dec ecx
jne 0x5670fb
mov eax, edx
pop edi
pop esi
pop ebx
ret
Function at 0x567128
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00405524
mov ebx, eax
test ebx, ebx
jne 0x567140
xor eax, eax
jmp 0x567180
cmp dword [0x591f2c], 0
jne 0x56714e
call fcn.00566610
mov eax, esi
mov edx, ebx
test edx, edx
jle 0x567180
mov esi, 1
mov cl, byte [edi + esi - 1]
xor cl, al
and ecx, 0xff
mov ebx, dword [0x591f2c]
mov ecx, dword [ebx + ecx*4]
shr eax, 8
and eax, 0xffffff
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x56715b
pop edi
pop esi
pop ebx
ret

Function at 0x56a524
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef8
mov dword [esp], edx
mov ebx, eax
mov byte [0x591ff8], 0
mov byte [0x591ffc], 0
mov eax, dword [esp]
call fcn.00405524
mov ebp, eax
test ebp, ebp
jle 0x56a557
cmp ebp, 0x100
jl 0x56a55b
xor eax, eax
jmp 0x56a55d
mov al, 1
mov byte [esp + 4], al
cmp byte [esp + 4], 0
je 0x56a5d2
xor ecx, ecx
mov esi, ebx
lea edi, [esp + 6]
mov byte [esi], cl
mov eax, ecx
cdq
idiv ebp
mov eax, dword [esp]
mov al, byte [eax + edx]
mov byte [edi], al
inc ecx
inc edi
inc esi
cmp ecx, 0x100
jne 0x56a570
xor edi, edi
mov ecx, pe_nt_image_headers32
mov eax, ebx
lea esi, [esp + 6]
xor edx, edx
mov dl, byte [eax]
add edi, edx
xor edx, edx
mov dl, byte [esi]
add edi, edx
and edi, 0xff
mov dl, byte [eax]
mov byte [esp + 5], dl
mov dl, byte [ebx + edi]
mov byte [eax], dl
mov dl, byte [esp + 5]
mov byte [ebx + edi], dl
inc esi
inc eax
dec ecx
jne 0x56a597
lea edx, [ebx + 0x100]
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00403150
mov al, byte [esp + 4]
add esp, 0x108
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x56a5f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x56a685
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x56a61a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x578884
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x578890
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5789c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, edx
dec ecx
test ecx, ecx
jl 0x5789dd
inc ecx
xor esi, esi
xor byte [eax + esi], 0xa5
inc esi
dec ecx
jne 0x5789d5
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
call fcn.00578794
mov esi, 8
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.00578884
dec esi
jne 0x5789f0
xor esi, esi
xor ebx, ebx
mov eax, esi
shl eax, 5
mov edx, ebx
shl edx, 2
add eax, edx
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 8]
call fcn.00578884
inc ebx
cmp ebx, 8
jne 0x578a02
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.00578884
inc esi
cmp esi, 0xc
jne 0x578a00
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.00578884
mov eax, dword [ebp - 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov byte [edx + 0x600], al
mov eax, dword [ebp - 0xc]
shr eax, 0x10
mov edx, dword [ebp - 4]
mov byte [edx + 0x601], al
mov eax, dword [ebp - 0xc]
shr eax, 8
mov edx, dword [ebp - 4]
mov byte [edx + 0x602], al
mov eax, dword [ebp - 0xc]
and eax, 0x7f
mov edx, dword [ebp - 4]
or dword [edx + eax*4], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x58095c
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
mov eax, ebx
call fcn.00405724
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
pop ebx
ret