joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dce80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x732198]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
movzx eax, cx
mov edx, eax
push edi
mov edi, eax
test ecx, 0x10000
jne 0x4dcf06
movaps xmm0, xmmword [0x6eea30]
push esi
push 0x5b
pop ecx
mov word [ebp - 0xc], cx
xor esi, esi
mov ecx, 0xdb
mov word [ebp - 0xa], cx
push 0x5d
pop ecx
mov word [ebp - 8], cx
mov ecx, 0xdd
mov word [ebp - 6], cx
lea ecx, [eax - 0x61]
lea eax, [edx - 0x20]
cmp cx, 0x19
movzx edx, ax
mov eax, edi
movups xmmword [ebp - 0x2c], xmm0
cmova edx, eax
movaps xmm0, xmmword [0x6eea40]
movups xmmword [ebp - 0x1c], xmm0
movzx eax, dx
cmp ax, word [ebp + esi*2 - 0x2c]
jne 0x4dcefd
movzx eax, word [ebp + esi*2 - 0x2a]
add esi, 2
cmp esi, 0x14
jl 0x4dcef1
pop esi
cwde
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp - 4]
shr eax, 0xf
xor ecx, ebp
and al, 1
pop edi
call fcn.0050db53
leave
ret

Function at 0x4dee29
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f1a7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x732198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x1c]
test esi, esi
jne 0x4dee6b
push esi
sub esp, 0x10
lea esi, [ebp + 0xc]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004cd31f
mov esi, eax
call fcn.004d14b9
movsd xmm4, qword [esi + 0x30]
xorps xmm1, xmm1
cvtsi2ss xmm1, dword [ebp + 0xc]
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
movss xmm2, dword [eax + 0x84]
cvtps2pd xmm0, xmm2
mov eax, dword [ebp + 8]
movsd xmm3, qword [0x56e000]
divsd xmm4, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 4]
mulss xmm0, xmm2
subss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
mulsd xmm0, xmm4
cvtsi2ss xmm1, dword [ebp + 0x10]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm3
movsd qword [ebp - 0x14], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 8]
add ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mulss xmm0, xmm2
subss xmm1, xmm0
cvtps2pd xmm0, xmm1
mulsd xmm0, xmm4
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm3
movsd qword [ebp - 0x1c], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov dword [eax + 4], ecx
cvtps2pd xmm0, xmm0
mulsd xmm0, xmm4
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm3
movsd qword [ebp - 0x24], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
cvtps2pd xmm0, xmm0
mulsd xmm0, xmm4
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm3
movsd qword [ebp - 0x2c], xmm0
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 0x18
Function at 0x4eaa9a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5641e4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x732198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x1c]
test esi, esi
jne 0x4eaadd
push 1
sub esp, 0x10
lea esi, [ebp + 0xc]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004cd31f
mov esi, eax
call fcn.004d14b9
xorps xmm0, xmm0
movsd xmm3, qword [esi + 0x30]
cvtsi2ss xmm0, dword [esi + 4]
movss xmm1, dword [eax + 0x84]
mulss xmm0, xmm1
mov eax, dword [ebp + 8]
movsd xmm2, qword [0x56e000]
cvttss2si ecx, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 8]
mulss xmm0, xmm1
cvttss2si edx, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
divsd xmm3, xmm0
cvtsi2ss xmm1, dword [ebp + 0xc]
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 0x24]
subss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
divsd xmm0, xmm3
cvtsi2ss xmm1, dword [ebp + 0x10]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 0x28]
add ecx, dword [ebp - 0x14]
mov dword [eax], ecx
subss xmm1, xmm0
cvtps2pd xmm0, xmm1
divsd xmm0, xmm3
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov dword [eax + 4], ecx
cvtps2pd xmm0, xmm0
divsd xmm0, xmm3
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [ebp - 0x24], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
cvtps2pd xmm0, xmm0
divsd xmm0, xmm3
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [ebp + 0x14], xmm0
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 0x18

Function at 0x4f8a82
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
shr esi, 0xf
push 0x11
and esi, 1
call ebx
shr eax, 0xf
mov edi, esi
or edi, 2
and al, 1
push 0x12
cmove edi, esi
call ebx
mov ebx, edi
shr eax, 0xf
or ebx, 4
and al, 1
push 0xa5
cmove ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, ebx
call edi
shr eax, 0xf
test al, 1
je 0x4f8ae4
push 0xa3
call edi
shr eax, 0xf
test al, 1
jne 0x4f8ae4
and esi, 0xfffffffd
or esi, 4
mov eax, dword [0x750d18]
and eax, 0x70
pop edi
or eax, esi
pop esi
mov dword [0x750d18], eax
pop ebx
ret

Function at 0x4f949f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
and ecx, 1
mov eax, ebx
shl ecx, 4
mov edx, ecx
or edx, 0x20
and al, 2
mov eax, dword [0x750d18]
cmove edx, ecx
and eax, 0xffffff8f
mov ecx, edx
or ecx, 0x40
and bl, 0x10
pop ebx
cmove ecx, edx
or ecx, eax
mov dword [0x750d18], ecx
pop ebp
jmp fcn.004f8a82
Function at 0x510d15
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x539444
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0050e210
mov eax, dword [0x732198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0053d89b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x539486
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5395e2
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0050e240
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x7522e8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0054b502
mov ecx, dword [esi*4 + 0x7522e8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x5395db
cmp eax, dword [edi + ecx + 0x24]
jne 0x5395db
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5395db
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0054b502
add esp, 0x14
test edx, edx
jl 0x5395db
jg 0x539551
test eax, eax
jb 0x5395db
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5395db
jl 0x53956b
cmp dword [ebp - 0x1008], eax
ja 0x5395db
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x539589
test ebx, ebx
je 0x5395c2
cmp ecx, edi
jae 0x5395c2
mov al, byte [ecx]
cmp al, 0xd
jne 0x5395a3
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5395af
cmp byte [ecx + 1], 0xa
jne 0x5395af
inc ecx
jmp 0x5395af
movzx eax, al
movsx eax, byte [eax + 0x732690]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x539589
cmp edx, ebx
jne 0x539589
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5395e0
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0050db53
leave
ret

Function at 0x5494cb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6f9020
push 0x6f9018
push str.FlsAlloc
push 0x1e
call fcn.005492f8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5494ff
push dword [ebp + 8]
mov ecx, esi
call dword [0x5685a4]
call esi
jmp 0x549505
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x549549
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6f9030
push 0x6f9028
push str.FlsGetValue
push 0x20
call fcn.005492f8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x549580
push dword [ebp + 8]
mov ecx, esi
call dword [0x5685a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x54a806
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x7522e8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x54a846
cmp byte [ebx], 0xa
jne 0x54a846
or byte [eax + edi + 0x28], 4
jmp 0x54a84b
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x54a949
mov al, byte [edx]
cmp al, 0x1a
je 0x54a92b
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x54a87a
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x54a89f
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x54a8a9
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x54a85c
jmp 0x54a949
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x54a926
cmp dword [ebp - 0xc], 0
je 0x54a926
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x7522e8]
test byte [eax + edi + 0x28], 0x48
je 0x54a900
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x54a8eb
mov byte [esi], dl
jmp 0x54a8fc
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x7522e8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x54a949
cmp byte [ebp - 1], 0xa
jne 0x54a90f
cmp esi, ebx
jne 0x54a90f
mov byte [esi], 0xa
jmp 0x54a948
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0054b520
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x54a949
mov byte [esi], 0xd
jmp 0x54a948
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x7522e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x54a945
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x54a949
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x54a952
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x7522e8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x54a995
cmp word [esi], dx
jne 0x54a995
or byte [edi + eax + 0x28], 4
jmp 0x54a99a
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x54aaed
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x54aacd
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x54a9dc
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x54aa12
cmp eax, edx
jae 0x54aa1e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x54a9b4
jmp 0x54aaed
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x54aac9
cmp dword [ebp - 0x14], 0
je 0x54aac9
mov eax, dword [ebx*4 + 0x7522e8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x54aaa1
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x54aa6a
mov word [esi], cx
jmp 0x54aa9d
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x7522e8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x7522e8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x7522e8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x54aaed
pop ebx
cmp word [ebp - 4], bx
jne 0x54aab2
cmp esi, dword [ebp + 0xc]
jne 0x54aab2
mov word [esi], bx
jmp 0x54aaea
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0054b520
add esp, 0x10
cmp word [ebp - 4], bx
je 0x54aaed
push 0xd
jmp 0x54aae6
mov ecx, dword [ebx*4 + 0x7522e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x54aae4
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x54aaed
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x54b30e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054b17f
Function at 0x552017
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5520b4
push ebx
push esi
call fcn.00551fe0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0054b7cb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x552061
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5520b3
push edi
push eax
call fcn.00544acb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x552081
call fcn.005445e7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5520b2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0054b7cb
add esp, 0x20
test eax, eax
jne 0x5520a0
push edi
call fcn.005445e7
jmp 0x5520a8
push ebx
call fcn.005445e7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5520b7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5520c8
pop esi
ret
push ebx
push edi
push esi
call fcn.00551fe0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00544acb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5520f0
push ebx
push esi
push edi
call fcn.00524c60
add esp, 0xc
push 0
call fcn.005445e7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x55283c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00552363
Function at 0x556a9e
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00556a1a
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x556c16
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x556c16
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x556bc5
jg 0x556af7
test eax, eax
je 0x556bbb
push 1
push 0x1000
call fcn.00546297
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x556b1d
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x556bb2
push 0x8000
push ebx
call fcn.00543bdc
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x556b49
jg 0x556b44
cmp ecx, 0x1000
jb 0x556b49
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005500d0
add esp, 0x10
cmp eax, 0xffffffff
je 0x556b8e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x556b44
jl 0x556b75
test ecx, ecx
jne 0x556b36
push dword [ebp - 0xc]
push ebx
call fcn.00543bdc
push esi
call fcn.005445e7
add esp, 0xc
xor edi, edi
jmp 0x556c27
cmp byte [edi + 0x24], 0
je 0x556ba5
cmp dword [edi + 0x20], 5
jne 0x556ba5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x556bb0
mov edi, dword [edi + 0x18]
jmp 0x556bb2
xor edi, edi
push esi
call fcn.005445e7
pop ecx
jmp 0x556c27
test ecx, ecx
jg 0x556b87
jl 0x556bc5
test eax, eax
jae 0x556b87
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0054b520
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x556be8
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x556b87
jmp 0x556c1f
push ebx
call fcn.00552cc5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x556b87
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x556c27
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x556c24
mov edi, dword [edi + 0x18]
jmp 0x556c27
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0054b520
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
mov ecx, 0x93a00cd
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x6da304aa
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219