joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eabf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push ebx
mov ebx, dword [esp + 0x68]
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
or eax, 0xffffffff
mov ecx, 1
mov dword [esp + 0x68], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x7c]
push edi
push ebx
xor ebp, ebp
push eax
push ecx
mov dword [esp + 0x60], 0xffffff1c
mov dword [esp + 0x64], 0xffffff1d
mov dword [esp + 0x6c], 0xe5
mov dword [esp + 0x70], 0xe4
mov dword [esp + 0x74], 0xe3
mov dword [esp + 0x7c], 0xffffff1b
mov dword [esp + 0x40], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x38], ebp
call fcn.0051cd80
and eax, 0xff
add esp, 0x10
mov esi, eax
lea eax, [edi + edi*8]
lea eax, [edi + eax*2]
lea edx, [esi - 1]
mov dword [esp + 0x80], edx
lea ecx, [eax + eax*2]
mov eax, dword [0xbca2d8]
lea ecx, [eax + ecx*4]
add ecx, ebx
cmp edx, ebp
mov dword [esp + 0x7c], ecx
jge 0x4eacce
add edx, 8
mov dword [esp + 0x80], edx
cmp esi, edx
je 0x4ead83
lea eax, [esp + esi*4 + 0x50]
lea ebx, [esp + esi*4 + 0x10]
lea ebp, [esp + esi*4 + 0x30]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
mov eax, dword [eax]
add eax, ecx
cmp byte [eax + 0xac2d4c], 0
jne 0x4ead54
mov eax, dword [eax*4 + 0xaf598c]
test eax, 0x80000
jne 0x4ead54
push 1
push eax
call fcn.004ec410
add esp, 8
test al, al
je 0x4ead49
mov edx, dword [ebp]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x84]
add edx, eax
mov eax, dword [ebx]
mov dword [ecx], edx
mov edx, dword [esp + 0x88]
add eax, edi
mov dword [edx], eax
push eax
mov eax, dword [ecx]
mov ecx, dword [esp + 0x78]
push eax
push edi
push ecx
call fcn.005181c0
add esp, 0x10
test eax, eax
jne 0x4ead8d
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
inc esi
add eax, 4
add ebp, 4
add ebx, 4
cmp esi, 8
mov dword [esp + 0x78], eax
jl 0x4ead7b
sub eax, 0x20
sub esi, 8
sub ebp, 0x20
mov dword [esp + 0x78], eax
sub ebx, 0x20
cmp esi, edx
jne 0x4eace6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x60
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x60
ret
Function at 0x516c80
Capabilities:
Create directory

Disassembly:
sub esp, 0x20
push 0xe38e74
call fcn.0041acd0
mov al, byte [0xe38e74]
add esp, 4
test al, al
jne 0x516ca2
call fcn.00516bb0
add esp, 0x20
ret
push 0x5763bc
call fcn.00516a20
push eax
call fcn.00561a0a
add esp, 8
test eax, eax
je 0x516cd4
push eax
call fcn.00561994
push 1
push 0x516c10
push 0x5c
call fcn.004264d0
add esp, 0x10
add esp, 0x20
ret
push ebp
push esi
push edi
push str.campaign.txt
mov ecx, 0x6fdd08
call fcn.0041ae40
call fcn.00516a20
push eax
mov ecx, 0x6fdd08
call fcn.0041b8a0
push 0
call fcn.005169c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0xe38e74
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00516bb0
mov ebp, dword [0xeadfb0]
xor edi, edi
test ebp, ebp
jle 0x516d98
mov edx, dword [0xeadfac]
push ebx
test edi, edi
jl 0x516d56
cmp edi, ebp
jge 0x516d56
mov eax, dword [edx]
mov ecx, dword [0xeadfb8]
add eax, ecx
jmp 0x516d58
xor eax, eax
lea esi, [esp + 0x10]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x516d80
test cl, cl
je 0x516d7c
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x516d80
add eax, 2
add esi, 2
test cl, cl
jne 0x516d5c
xor eax, eax
jmp 0x516d85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x516d8f
mov dword [0xeadfcc], edi
inc edi
add edx, 4
cmp edi, ebp
jl 0x516d42
pop ebx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xe38e74
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00516bb0
call fcn.00516990
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x539820
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0xf55b88]
push esi
test eax, eax
push edi
mov esi, ecx
je case.default.0x53986e
mov al, byte [0xe38e64]
test al, al
je case.default.0x53986e
mov eax, dword [esi + 0x59a64]
test eax, eax
jne 0x53984f
push 0
call fcn.00539730
mov eax, dword [0xe38ec8]
mov ecx, 0xe92bf8
push eax
call fcn.0055f38d
mov eax, dword [esi + 0x59a64]
cmp eax, 3
ja case.default.0x53986e
jmp dword [eax*4 + 0x539a28]
movsx eax, byte [0xe38ea8]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
shl ecx, 4
add ecx, eax
shl ecx, 4
mov eax, dword [ecx + esi + 0x1b08]
test eax, eax
jle case.default.0x53986e
mov eax, dword [esi + 0x59a60]
push 1
push 0
lea edx, [eax*8]
sub edx, eax
shl edx, 4
add edx, ecx
mov ecx, 0xe92bf8
add edx, esi
push edx
call fcn.0055f449
movsx eax, byte [0xe38ea8]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
shl ecx, 4
add ecx, eax
mov eax, dword [esi + 0x59a60]
shl ecx, 4
lea edx, [eax*8]
sub edx, eax
mov eax, esi
shl edx, 4
add eax, ecx
mov eax, dword [edx + eax + 0x64]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
mov dword [0xf55b98], ecx
mov eax, dword [esi + 0x59a60]
inc eax
mov dword [esi + 0x59a6c], 0
mov dword [esi + 0x59a60], eax
mov edx, eax
movsx eax, byte [0xe38ea8]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
shl ecx, 4
add ecx, eax
xor eax, eax
lea edx, [edx + ecx*4]
mov edi, dword [esi + edx*4 + 0x1a40]
cmp edi, 1
pop edi
setne al
inc eax
mov dword [esi + 0x59a64], eax
pop esi
ret
mov dl, byte [0xe38ea8]
movsx eax, dl
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
shl ecx, 4
add ecx, eax
shl ecx, 4
mov eax, dword [ecx + esi + 0x1b0c]
test eax, eax
jle 0x5399b4
movsx eax, dl
push 1
push 0
lea ecx, [eax + eax*2]
lea edi, [ecx + ecx*8]
shl edi, 4
add edi, eax
shl edi, 4
call fcn.00562348
imul eax, dword [edi + esi + 0x1b0c]
cdq
and edx, 0x7fff
mov ecx, 0xe92bf8
add eax, edx
sar eax, 0xf
add eax, 0x32
lea edx, [eax*8]
sub edx, eax
shl edx, 4
add edx, edi
add edx, esi
push edx
call fcn.0055f449
mov dword [esi + 0x59a64], 2
pop edi
pop esi
ret
mov dword [esi + 0x59a64], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x59a68], eax
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x59a68]
mov edi, dword [0xf55b98]
add ecx, edi
cmp eax, ecx
jbe case.default.0x53986e
mov edx, dword [esi + 0x59a60]
mov eax, dword [esi + 0x59a58]
cmp edx, eax
jle 0x539a0e
mov eax, dword [esi + 0x59a54]
mov dword [esi + 0x59a60], eax
mov dword [esi + 0x59a64], 0
mov dword [esi + 0x59a6c], 1
pop edi
pop esi
ret
Function at 0x53db60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
push ebx
lea eax, [edi + 0x30f5c4]
push eax
call fcn.0053f790
lea ecx, [edi + 0x30f5c0]
push ebx
push ecx
call fcn.0053f790
lea edx, [edi + 0x30f548]
add esp, 0x10
mov dword [esp + 0x18], 0x27
mov dword [esp + 0x1c], 0xfd
mov dword [esp + 0x20], 0x10e
mov dword [esp + 0x24], 0x1f2
mov dword [esp + 0x28], 0x234
mov dword [esp + 0x2c], 0x235
mov dword [esp + 0x30], 0x236
mov dword [esp + 0x34], 0x237
mov dword [esp + 0x38], 0x238
mov dword [esp + 0x3c], 0x239
mov dword [esp + 0x40], 0x240
mov dword [esp + 0x44], 0x241
mov dword [esp + 0x48], 0x27a
mov dword [esp + 0x4c], 0x282
mov dword [esp + 0x50], 0x293
mov dword [esp + 0x54], 0x2c7
mov dword [esp + 0x58], 0x2f0
mov dword [esp + 0x5c], 0x2fc
mov dword [esp + 0x60], 0x2fd
mov dword [esp + 0x64], 0x2fe
mov dword [esp + 0x68], 0x2ff
mov dword [esp + 0x6c], 0x300
mov dword [esp + 0x70], 0x301
mov dword [esp + 0x74], 0x312
mov dword [esp + 0x78], 0x317
mov dword [esp + 0x7c], 0x32c
mov dword [esp + 0x80], 0x33c
mov dword [esp + 0x84], 0x353
mov dword [esp + 0x88], 0x370
mov dword [esp + 0x8c], 0x393
lea ebp, [esp + 0x18]
mov dword [esp + 0x10], edx
lea esi, [edi + 0xeb64]
mov dword [esp + 0x14], 0x1e
mov eax, dword [esi]
cmp eax, ebx
je 0x53dcb4
push eax
call fcn.00561a2b
add esp, 4
mov dword [esi], ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp]
mov byte [esi - 0xcc24], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [eax], ecx
add eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
add esi, 0xcc3c
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x53dca3
mov eax, 1
mov dword [edi + 0x30f5d4], ebx
mov dword [edi + 0x30f5c8], eax
mov dword [edi + 0x30f5cc], eax
mov dword [edi + 0x30f5d0], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x55bcf0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0xe92e1c]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp edi, 0x124f80
mov dword [0x1265188], eax
jle 0x55bd0d
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0xc]
push 4
push 0x126518c
push esi
mov dword [0x1265190], edi
call fcn.005660ed
add esp, 0xc
test eax, eax
jne 0x55bd2e
pop edi
pop esi
ret
mov eax, dword [0x126518c]
cmp eax, 0x80000000
jne 0x55bd50
mov ecx, dword [esp + 0x10]
push edi
push ecx
push esi
call fcn.005660ed
add esp, 0xc
test eax, eax
jne 0x55bd68
pop edi
pop esi
ret
test eax, eax
jne 0x55bd70
mov ecx, edi
mov edi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, 1
pop esi
ret
push eax
mov eax, dword [0x1265188]
push eax
push esi
call fcn.005660ed
add esp, 0xc
test eax, eax
jne 0x55bd87
pop edi
pop esi
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [0x126518c]
mov eax, dword [0x1265188]
push edi
push ecx
push edx
push eax
push 0x1265194
call fcn.0055c000
add esp, 0x14
test eax, eax
jne 0x55bd68
pop edi
pop esi
ret

Function at 0x55d330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x55d45b
mov eax, dword [esp + 8]
test ax, ax
je 0x55d356
mov ecx, dword [ecx + 8]
cmp ax, word [ecx + 0x1a]
jb 0x55d356
mov ax, word [ecx + 0x1a]
dec ax
push edi
mov edi, dword [esi + 0x34]
and edi, 0xfffffeff
mov dword [esi + 0x34], edi
mov ecx, dword [esi + 0x38]
test ecx, ecx
mov word [esi + 0x3c], ax
je 0x55d371
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + 0x1c]
mov edi, dword [esp + 0x14]
and eax, 0xffff
shl eax, 4
add eax, edx
cmp di, 0x3e8
mov dword [esi + 0x40], eax
je 0x55d39e
push edi
mov ecx, esi
call fcn.0055d840
push eax
mov ecx, esi
call fcn.0055d300
jmp 0x55d3ad
mov ecx, esi
call fcn.0055d840
push eax
mov ecx, esi
call fcn.0055d2e0
mov eax, dword [esi + 0x40]
mov cl, byte [eax]
movzx dx, byte [eax + 3]
and cl, 7
cmp cl, 4
sete cl
shl edx, cl
test di, di
pop edi
mov word [esi + 0x78], dx
jne 0x55d3e1
mov ecx, dword [esi + 0x44]
push ecx
push eax
call fcn.0055d750
add esp, 8
mov ecx, esi
push eax
call fcn.0055d290
mov edx, dword [esi + 0x44]
mov cx, word [edx + 2]
mov eax, ecx
and eax, 0xffff
mov dword [esp + 8], eax
fild dword [esp + 8]
fcomp dword [esi + 0x48]
fnstsw ax
test ah, 0x41
je 0x55d40a
dec ecx
push ecx
mov ecx, esi
call fcn.0055d290
mov eax, dword [esi + 0x40]
xor ecx, ecx
mov cl, byte [eax + 2]
mov dword [esp + 8], ecx
fild dword [esp + 8]
fstp dword [esi + 0x50]
cmp byte [eax + 0xb], 1
jbe 0x55d45b
mov ecx, dword [eax + 0xc]
xor edx, edx
mov dl, byte [eax + 0xb]
shr edx, 1
mov eax, dword [ecx + edx*8 + 4]
mov ecx, dword [ecx + 4]
xor edx, edx
mov dx, word [ecx + 2]
xor ecx, ecx
mov dword [esi + 0x18], edx
mov cx, word [eax + 2]
xor edx, edx
mov dword [esi + 0x1c], ecx
mov dx, word [eax + 4]
mov eax, dword [esi + 0x18]
mov ecx, edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [esi + 0x20], ecx
pop esi
ret 0xc
Function at 0x55e6c4
Capabilities:
Check os version
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x55e6f5
xor eax, eax
jmp 0x55e927
cmp dword [ebp - 0x88], 2
jne 0x55e71e
cmp dword [ebp - 0x94], 5
jae 0x55e71e
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x200], 1
xor eax, eax
jmp 0x55e927
call dword [sym.imp.mss32.dll__AIL_startup_0]
push 0x40000
push 0x28
call dword [sym.imp.mss32.dll__AIL_set_preference_8]
push 0
push 0xf
call dword [sym.imp.mss32.dll__AIL_set_preference_8]
mov edx, dword [ebp - 0xa0]
mov word [edx + 0x17c], 1
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
mov dx, word [ecx + 0x194]
mov word [eax + 0x17e], dx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x18c]
mov dword [eax + 0x180], edx
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x190]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x18c]
imul edx, eax
mov eax, dword [ebp - 0xa0]
imul edx, dword [eax + 0x194]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x184], edx
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx + 0x190]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, dword [ebp - 0xa0]
imul eax, dword [ecx + 0x194]
mov edx, dword [ebp - 0xa0]
mov word [edx + 0x188], ax
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
mov dx, word [ecx + 0x190]
mov word [eax + 0x18a], dx
mov eax, dword [ebp - 0xa0]
add eax, 0x17c
push eax
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0xa0]
add ecx, 0x178
push ecx
call dword [sym.imp.mss32.dll__AIL_waveOutOpen_16]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55e840
push str.Unable_to_initialize_digital_sound_driver...._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x55e927
push 5
mov ecx, dword [ebp - 0xa0]
call fcn.0055dea2
test eax, eax
jne 0x55e858
xor eax, eax
jmp 0x55e927
mov dword [ebp - 0x9c], 0
jmp 0x55e873
mov edx, dword [ebp - 0x9c]
add edx, 1
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [eax + 0x198]
jge 0x55e89b
mov edx, dword [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0xa0]
call fcn.0055e5d2
jmp 0x55e864
mov dword [ebp - 0x9c], 0
jmp 0x55e8b6
mov eax, dword [ebp - 0x9c]
add eax, 1
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x9c]
cmp edx, dword [ecx + 0x198]
jge 0x55e922
mov eax, dword [ebp - 0x9c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x1ac]
mov dword [edx + eax], 0xffffffff
mov eax, dword [ebp - 0x9c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x1ac]
mov dword [edx + eax + 4], 0
mov eax, dword [ebp - 0x9c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x1ac]
mov dword [edx + eax + 8], 0
jmp 0x55e8a7
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5603f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push str.QuickTime.qts
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x560438
lea ecx, [esp + 0x10]
push 0x104
push ecx
push eax
call esi
test eax, eax
jbe 0x560438
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jbe 0x5604cc
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xf]
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x5604cc
mov cl, byte [eax]
cmp cl, 0x5c
je 0x560481
cmp cl, 0x2f
je 0x560481
dec eax
lea edx, [esp + 0x10]
cmp eax, edx
jae 0x56046a
jmp 0x5604cc
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x5604cc
mov byte [eax + 1], 0
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, eax
test ebx, ebx
jne 0x56054c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x56054c
mov edi, 0x5761d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x567e05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x605158
cmp edx, dword [eax]
je 0x567e27
add eax, 8
inc ecx
cmp eax, 0x6051e8
jl 0x567e18
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x605158]
jne 0x567f55
mov eax, dword [0x1266408]
cmp eax, 1
je 0x567f2f
test eax, eax
jne 0x567e58
cmp dword [0x60496c], 1
je 0x567f2f
cmp edx, 0xfc
je 0x567f55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x567e8f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00566750
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00563380
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x567ed2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00563380
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x570ac4
push edi
call fcn.00562240
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00566750
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00566760
lea eax, [ebp - 0xa0]
push 0x570aa4
push eax
call fcn.00566760
push dword [esi + 0x60515c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00566760
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00569c11
add esp, 0x2c
pop edi
jmp 0x567f55
lea eax, [ebp + 8]
lea esi, [esi + 0x60515c]
push 0
push eax
push dword [esi]
call fcn.00563380
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0xef93e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef93ea
pushal
call 0xef93f0
pop ebp
sub ebp, 0x10
sub ebp, 0xaf93e0
jmp 0xef9406
mov eax, 0xaf93e0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0xba9378d
xor byte [eax], dl
inc eax
dec ecx
jne 0xef941d
jmp 0xef9430
push es
inc eax
push es
add al, 0xb1
lea ecx, [ebp + 0x754c0c8d]
lea ecx, [ebp + 0x35408e8d]
mov ecx, dword [ebp - 0x5ac87273]
lea ecx, [ebp - 0x71908573]
inc ebp
push es
or al, 0x81
lea ecx, [ebp + 0x488e8d]
jmp 0x89f40605
Function at 0x401630
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x4fe0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x4fd8]
mov ebx, dword [esi + 0x4fdc]
shr ecx, 0x1c
mov eax, edi
and eax, 0xf
shl ebx, 4
add ecx, ebx
mov edx, edi
shr edx, 4
shl eax, 0x1c
cmp edi, ecx
sbb ecx, ecx
and ecx, 0x10000000
push ecx
push eax
push edx
mov edx, dword [esi + 0x28]
push 4
push edx
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0x4fe0], eax
je 0x401696
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x4425b8]
push 0x430518
push str.Debug.txt
mov esi, eax
call fcn.0041b556
push esi
push esi
push 0x430530
push str._s_d__x__n
push eax
mov dword [edi], eax
call fcn.0041b49c
mov eax, dword [edi]
push eax
call fcn.0041b44b
push 0xdf
call fcn.00416d90
push eax
call fcn.00416de0
add esp, 0x28
pop edi
pop esi
pop ebx
ret 4
Function at 0x40be70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.00416e50
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esi + 0x10cc078], ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esi], 0x4311b0
mov dword [esi + 0x1097a10], eax
call fcn.0040ef40
mov ecx, dword [esp + 8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x20