joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556260
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x5562c0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x557a00
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x557aa0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x55b8e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x55d120
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x55d181
mov al, byte [edi]
test al, al
je 0x55d181
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x55d139
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x578c50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00435930
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
lea ebp, [eax - 1]
push edi
lea ecx, [ebp - 0x29]
cmp esi, ecx
jle 0x578c8f
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.0054e960
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp ebp, 0x29
jge 0x578cb3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.0054e960
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x28]
push 0
lea edx, [ebx + 1]
mov byte [ebx], 0
mov dword [esp + 0x30], edx
add ebx, 0x15
call fcn.00548c50
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push eax
push ecx
call fcn.005489a0
mov ecx, ebp
xor eax, eax
sub ecx, esi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, ebx
mov ecx, esi
sub eax, esi
mov esi, dword [esp + 0x4c]
add eax, ebp
mov edx, ecx
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x48]
push esi
call fcn.00549b00
add esp, 0x20
test eax, eax
jg 0x578d36
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
add ebp, 0xffffffec
push 0x48
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.0054e540
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [esp + 0x2c], edi
jne 0x578d72
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.0054e960
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.00548c50
push eax
push 0x14
push esi
push ebp
push edi
call fcn.00579020
add esp, 0x14
test ebp, ebp
jle 0x578d9c
mov eax, ebx
sub edi, ebx
mov ecx, ebp
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x578d8f
mov edi, dword [esp + 0x2c]
call fcn.00548c50
push eax
push ebp
push ebx
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.00579020
lea ecx, [esp + 0x24]
add esp, 0x14
mov eax, esi
sub ecx, esi
mov esi, 0x14
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x578dc0
push edi
call fcn.0054e7c0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x579500
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x5795d5
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x579523
cmp al, 0x6b
jne 0x5795d5
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x579591
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x579545
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x579545
cmp cl, 0xbb
jne 0x57956e
inc edx
cmp edx, eax
jl 0x579533
sub eax, edx
test edx, edx
jne 0x579594
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0054e960
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0054e960
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x5795bd
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0054e960
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0054e960
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x5834e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x5834f9
mov edi, ebx
mov ebx, eax
jmp 0x5834fb
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jg 0x58350b
mov eax, esi
jmp 0x583515
push eax
push esi
call fcn.0054c1f0
add esp, 8
test eax, eax
jne 0x58351d
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x583541
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x583527
pop ebp
cmp eax, dword [edi + 4]
jge 0x583558
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x583546
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x58357e
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x58357e
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x583568
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x5f19e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5f1a0b
cmp dword [edi + 0x3c], 0
jne 0x5f1a0b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00609d0e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005f1a4a
pop edi
pop esi
pop ebx
ret 8

Function at 0x5f31a1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5f31d9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005f04c7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005f049f
jmp 0x5f31e5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5f31e9
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x6afd08
mov ecx, edi
call fcn.005f01a9
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x5f323c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x5f324f
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.005f04c7
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.005f049f
jmp 0x5f324f
mov ecx, esi
call fcn.005f590f
test eax, eax
je 0x5f324f
push edi
mov ecx, eax
call fcn.005f31a1
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x5f4fa3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5f4fe5
call fcn.00609d0e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5f4fe5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5f4fdc
xor eax, eax
jmp 0x5f4fed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005f4ff3
pop edi
pop esi
pop ebx
ret 4
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7b7f1f7f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x32bd2da4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e004]
jne 0x40100a
repz ret
jmp fcn.004019eb

Function at 0x406948
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040256b
and dword [ebp - 4], 0
cmp dword [0x470264], 0
mov ebx, eax
jne 0x4069f9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406aaa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406aaa
push eax
call fcn.004024f9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x470264], eax
call esi
push eax
call fcn.004024f9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x470268], eax
call esi
push eax
call fcn.004024f9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47026c], eax
call esi
push eax
call fcn.004024f9
pop ecx
mov dword [0x470274], eax
test eax, eax
je 0x4069f9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004024f9
pop ecx
mov dword [0x470270], eax
mov eax, dword [0x470270]
cmp eax, ebx
je 0x406a51
cmp dword [0x470274], ebx
je 0x406a51
push eax
call fcn.00402574
push dword [0x470274]
mov esi, eax
call fcn.00402574
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406a51
test edi, edi
je 0x406a51
call esi
test eax, eax
je 0x406a48
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406a48
test byte [ebp - 0xc], 1
jne 0x406a51
or dword [ebp + 0x10], 0x200000
jmp 0x406a8a
mov eax, dword [0x470268]
cmp eax, ebx
je 0x406a8a
push eax
call fcn.00402574
pop ecx
test eax, eax
je 0x406a8a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a8a
mov eax, dword [0x47026c]
cmp eax, ebx
je 0x406a8a
push eax
call fcn.00402574
pop ecx
test eax, eax
je 0x406a8a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x470264]
call fcn.00402574
pop ecx
test eax, eax
je 0x406aaa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406aac
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x469fd0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x46e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test ebx, ebx
jle 0x46a02d
and dword [ebp - 0x808], 0
lea ecx, [ebp - 0x808]
call fcn.00469fc8
mov al, byte [ebp - 0x808]
xor byte [edi + esi], al
cmp ebx, 0xf
jne 0x46a028
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc esi
cmp esi, ebx
jl 0x469fea
pop esi
cmp ebx, 0x2d
jne 0x46a044
or dword [0x275839c], 0xffffffff
mov dword [0x2758398], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
leave
ret
Function at 0x404d7d
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x85c
mov eax, 0x442f07
call fcn.0042a4aa
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
mov edi, ecx
call fcn.0042b7e0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
call fcn.0042b7e0
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
mov ebx, 0x448f00
xor ecx, ecx
call fcn.0040ba50
lea eax, [ebp - 0x830]
push eax
mov ebx, str.cachedump
xor ecx, ecx
call fcn.0040ba50
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404fcf
xor eax, eax
push esi
mov word [ebp - 0x420], ax
xor ebx, ebx
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.0042b7e0
add esp, 0xc
push 1
push ebx
lea eax, [ebp - 0x420]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.client_log.zip
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.0042b7e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.client_log
lea eax, [ebp - 0x218]
push eax
call edi
lea esi, [ebp - 0x218]
call fcn.0040b530
mov eax, esi
push eax
lea ebx, [ebp - 0x628]
call fcn.0040b839
lea eax, [ebp - 0x84c]
push eax
call fcn.00405902
mov eax, esi
xor ebx, ebx
push eax
lea esi, [ebp - 0x868]
mov dword [ebp - 4], ebx
call fcn.004015bd
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 0x84c]
push eax
push ecx
mov eax, esi
push eax
lea edi, [ebp - 0x84c]
call fcn.0040596a
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.00401828
lea eax, [ebp - 0x830]
push eax
lea esi, [ebp - 0x868]
call fcn.004015bd
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 0x84c]
push eax
push ecx
mov eax, esi
push eax
call fcn.0040596a
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.00401828
lea ecx, [ebp - 0x868]
call fcn.0041b6a1
push eax
mov eax, edi
mov byte [ebp - 4], 3
call fcn.00405951
push ebx
push 1
lea esi, [ebp - 0x868]
mov byte [ebp - 4], bl
call fcn.00401828
lea ecx, [ebp - 0x868]
call fcn.0041b71a
push eax
mov eax, edi
mov byte [ebp - 4], 4
call fcn.00405951
push ebx
push 1
lea esi, [ebp - 0x868]
mov byte [ebp - 4], bl
call fcn.00401828
mov ecx, edi
lea ebx, [ebp - 0x420]
call fcn.004216fa
test eax, eax
jne 0x404f99
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, ebx
call fcn.0040d1dc
jmp 0x404fad
push eax
push 0x448f58
push 0
xor edi, edi
xor esi, esi
call fcn.0040baf4
add esp, 0xc
lea esi, [ebp - 0x218]
call fcn.0040b9cb
lea edi, [ebp - 0x84c]
call fcn.004059f3
push dword [ebp - 0x84c]
call fcn.00429220
pop ecx
call fcn.0042a52d
ret
Function at 0x4056cc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11bc
call fcn.00434be0
mov eax, dword [0x454070]
xor eax, esp
mov dword [esp + 0x11b8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.GlobalA51BB395_ECF3_4294_9A75_995BAB94ED74
mov dword [esp + 0x14], edi
call fcn.004049c8
test eax, eax
je 0x40570a
push 2
pop eax
jmp 0x4058cb
cmp dword [0x456cf8], 2
je 0x40571b
xor eax, eax
inc eax
jmp 0x4058cb
call fcn.0040c89d
mov esi, str.17D54393_825C_44ab_B8AB_BC49A255D47B
push esi
call fcn.004049c8
test eax, eax
jne 0x4058c9
push esi
push 0x12
push 0x12
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0x190
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.0042b7e0
add esp, 0xc
lea eax, [esp + 0x30]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 3
call dword [sym.imp.libcurl32.dll_curl_global_init]
mov dword [esp], str.SetProcessDPIAware
push str.user32.dll
mov byte [0x457b7a], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
cmp eax, ebx
je 0x40579d
call eax
call fcn.004060a1
call fcn.0041d062
mov eax, dword [0x459394]
cmp eax, ebx
jne 0x4057c6
push 0x4497a8
call fcn.00409b48
push eax
call esi
mov dword [0x459394], eax
cmp eax, ebx
je 0x4057ce
push 0x40102b
push edi
call eax
call fcn.0041fe5d
lea ecx, [esp + 0x14]
call fcn.0041b6a1
cmp dword [eax + 0x18], 8
jb 0x4057e7
mov eax, dword [eax + 4]
jmp 0x4057ea
add eax, 4
push eax
call fcn.00408456
push ebx
push 1
lea esi, [esp + 0x1c]
call fcn.00401828
call fcn.0040bb42
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x405856
push str._X64AgentProtectThread
push 0xe1
push str..poagent.cpp
push str._s._d:_s
lea eax, [esp + 0x1d0]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [esp + 0x1c0]
push eax
mov eax, dword [0x456d00]
push dword [eax + 4]
push 0x404c13
call fcn.0040a3a5
push eax
call edi
jmp 0x405865
mov eax, dword [0x456d00]
push dword [eax + 4]
xor ebx, ebx
call fcn.00402a14
call fcn.004014e0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041b65d
test eax, eax
je 0x40588a
push 0
push str.CLIENT_ONLINE
call fcn.00409bf1
push str._PobusProtectRoutine
push 0xee
push str..poagent.cpp
push str._s._d:_s
lea eax, [esp + 0x1d0]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [esp + 0x1c0]
push eax
call fcn.0041d3f3
push eax
call edi
mov eax, dword [esp + 0x10]
call fcn.0040542d
xor eax, eax
mov ecx, dword [esp + 0x11c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004291e7
mov esp, ebp
pop ebp
ret 0x10