joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bef78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, eax
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x4befad
inc ebx
mov eax, edx
mov edx, ecx
shr edx, 8
and edx, 0xffffff
movzx esi, byte [eax]
xor ecx, esi
and ecx, 0xff
xor edx, dword [ecx*4 + 0x56ded4]
mov ecx, edx
inc eax
dec ebx
jne 0x4bef8a
mov eax, ecx
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4d52cc
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004057a0
xor eax, eax
push ebp
push 0x4d5333
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004057b0
call fcn.00456a4c
mov ebx, 0x1505
test eax, eax
jle 0x4d531d
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
shl ebx, 5
add ebx, esi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d5306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d533a
lea eax, [ebp - 4]
call fcn.00405320
ret

Function at 0x4f3b0c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5673b4]
cmp byte [eax], 0
jne 0x4f3b3a
mov ecx, 0xaf
mov edx, 0x4f3b88
mov eax, 0x4f3bac
call fcn.0040524c
mov eax, ebx
call fcn.00405b28
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4f3b78
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405cc0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f3bc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x5673b4]
cmp byte [eax], 0
jne 0x4f3be3
mov ecx, 0xbd
mov edx, 0x4f3c24
mov eax, 0x4f3c48
call fcn.0040524c
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4f3c16
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4f3c16
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4f3c16
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4f4798
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f492a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x4f47d9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4f47f6
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x4f47ec
mov eax, edi
call fcn.0048b770
mov dword [ebp - 4], eax
jmp 0x4f47f6
mov eax, esi
call fcn.0048b770
mov dword [ebp - 4], eax
mov eax, dword [0x5673b4]
cmp byte [eax], 0
je 0x4f490f
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x4f490f
test ebx, ebx
je 0x4f490f
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x4f4938]
movzx edx, word [0x4f493c]
cmp dx, ax
jne 0x4f490f
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x4f490f
push ebp
call fcn.004f45dc
pop ecx
test al, al
je 0x4f490f
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004f43f0
mov eax, dword [ebp - 8]
call fcn.0048d2bc
test eax, eax
jne 0x4f48bd
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x4f48bd
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x4f4896
cmp dword [esi + 0x64], 0
jne 0x4f4896
mov eax, dword [esi + 4]
mov edx, dword [0x48a0e8]
call fcn.00404468
test al, al
jne 0x4f48bd
push dword [ebp - 0xc]
push 0x4f4944
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.004f3c5c
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405dd8
push ebp
lea eax, [ebp - 0x14]
call fcn.004f4638
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405e20
je 0x4f490f
push ebp
mov eax, dword [ebp - 0xc]
call fcn.004f4708
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x4f48ef
cmp dword [esi + 0x6c], 0
je 0x4f490f
mov eax, ebx
mov edx, dword [0x48a0e8]
call fcn.00404468
test al, al
je 0x4f490f
cmp dword [ebx + 0x38], 0
je 0x4f490f
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4931
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405b40
ret

Function at 0x4f7e14
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x567adc]
cmp dword [eax], 2
je 0x4f7e32
mov ecx, 0x35f
mov edx, 0x4f7e64
mov eax, 0x4f7e88
call fcn.0040524c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4f7db4
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x56e5a8], eax
cmp dword [0x56e5a8], 0
jne 0x4f7e59
call fcn.0045c09c
ret
Function at 0x4f8744
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4f87a8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405590
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00456230
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f87af
lea eax, [ebp - 0xc]
call fcn.00405320
ret

Function at 0x4f8824
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4f8880
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4f884f
call fcn.0045c09c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004031a0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4f8880
call fcn.0045c09c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4f8e54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x42b80c]
call fcn.004060d0
xor eax, eax
push ebp
push 0x4f8ff5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55ff44], 0
jne 0x4f8eaf
mov ecx, dword [0x5672f4]
mov dl, 1
mov eax, dword [0x454974]
call fcn.0045aa10
call fcn.00404c54
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a14
mov eax, ebx
call fcn.00405cec
mov dword [ebp - 0x24], eax
mov esi, 0x4f9004
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407404
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405cfc
test eax, eax
jle 0x4f8f98
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4f8f84
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405590
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4f8f2a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004055a8
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4f8f40
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004055a8
mov eax, dword [ebp - 0x54]
call fcn.004057b0
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405590
mov eax, dword [ebp - 0x58]
call fcn.004057b0
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4f8f86
xor eax, eax
test al, al
je 0x4f8f91
mov ebx, 0x15
jmp 0x4f8f9d
mov ebx, 0x10
jmp 0x4f8f9d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x55ff44]
call fcn.004f8cd4
mov eax, dword [ebp - 4]
call fcn.004f8cd4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8ffc
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405344
lea eax, [ebp - 0xc]
mov edx, dword [0x42b80c]
call fcn.004061a0
ret
Function at 0x519cac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x519d06
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00519c9c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.005199b8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005194d0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519d0d
lea eax, [ebp - 4]
call fcn.00405320
ret
Function at 0x521728
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x521757
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x5217d6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0051ffe4
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5217a4
mov cx, word [esp]
sub cx, si
jmp 0x5217a6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x52178d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5217cc
mov cx, word [esp]
sub cx, si
jmp 0x5217ce
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5217b5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x521833
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.005213fc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x52181e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x521833
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x521732
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x527c6c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x56f618
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x527c8e
shr eax, 1
xor eax, 0xedb88320
jmp 0x527c90
shr eax, 1
dec edx
jne 0x527c7c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x527c75
mov byte [0x56fa18], 1
pop esi
pop ebx
ret

Function at 0x527cac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x56fa18], 0
jne 0x527cc3
call fcn.00527c6c
mov eax, edi
dec eax
test eax, eax
jl 0x527ceb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56f618]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x527ccd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x52a958
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x52a9f2.0
jmp dword [ecx*4 + 0x52a98b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52a9bd
sub dl, 8
je 0x52a9cc
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a604
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a65c
jmp case.0x52a9f2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x52a9f2.0
movzx ecx, byte [ecx + 0x52a9f9]
jmp dword [ecx*4 + 0x52aa0a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a708
jmp case.0x52a9f2.0
cmp dl, 3
jne 0x52aa37
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a75c
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a718
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a7a0
jmp case.0x52a9f2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52aa62
sub dl, 8
je 0x52aa6e
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a7cc
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a838
jmp case.0x52a9f2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52aa8d
sub dl, 8
je 0x52aa99
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a8f4
jmp case.0x52a9f2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52a91c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x52ab3d
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00529b10
test eax, eax
je 0x52ab3d
mov eax, ebx
call fcn.0052ab48
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x52aad6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52ab48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x52ab79
dec al
je 0x52abb4
dec al
je 0x52abf9
dec al
je 0x52ac62
jmp 0x52acec
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x52acec
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52ab89
jmp 0x52acec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52acec
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52abc4
jmp 0x52acec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52acec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x52ac28
xor ebp, ebp
jmp 0x52ac38
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x52ac41
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52ac09
jmp 0x52acec
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52acec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x52acbb
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00527cf4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52ac76
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53b09c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x53b0ca
mov eax, ebx
call fcn.0053bb50
cmp dword [ebx + 0x40], 0
je 0x53b0c3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x53b13b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x53b12d
cmp dword [ebx + 8], 0
je 0x53b0ec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x53b0fe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x53b12d
cmp dword [ebx + 8], 0
je 0x53b0df
cmp eax, 3
je 0x53b111
dec eax
jne 0x53b0df
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x53b0df
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x53b0df
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x53b159
cmp dword [ebx + 0x14], 0xcc
je 0x53b159
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0053b164
pop ebx
ret
Function at 0x54e140
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x54e149
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54e31d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
test esi, esi
je 0x54e2fa
mov eax, dword [ebp - 8]
call fcn.004565d8
test al, al
je 0x54e1d7
mov edx, dword [0x567574]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
call fcn.00405638
mov eax, dword [ebp - 0x18]
call fcn.004befb8
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.004561c4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00455780
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.00455780
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00405748
je 0x54e2fa
cmp dword [ebp + 8], 0
je 0x54e2fa
mov eax, dword [0x567634]
mov eax, dword [eax]
mov edx, dword [eax + 0xd0]
mov eax, dword [0x56777c]
mov eax, dword [eax]
call fcn.0054f188
lea ecx, [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0054e07c
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x466104]
call fcn.0046b2e4
mov esi, eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
call fcn.004d8408
mov ecx, dword [ebp - 0x24]
mov eax, dword [0x567634]
mov eax, dword [eax]
mov edx, dword [eax + 0x14]
lea eax, [ebp - 0x20]
call fcn.00405638
mov edx, dword [ebp - 0x20]
mov ecx, esi
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0xc]
test al, al
jne 0x54e26e
mov byte [ebp - 9], 1
mov eax, dword [0x567634]
mov eax, dword [eax]
mov edx, dword [eax + 0xf4]
mov eax, dword [0x56777c]
mov eax, dword [eax]
call fcn.0054f188
mov eax, esi
call fcn.004042dc
cmp byte [ebp - 9], 0
jne 0x54e2ec
push 0
mov eax, dword [0x56777c]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x54e33c
call fcn.0054f334
mov dl, 1
mov eax, dword [0x54ff48]
call fcn.005502f0
mov esi, eax
mov dword [ebx + 8], esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0055024c
test al, al
jne 0x54e2cf
mov byte [ebp - 9], 1
mov eax, dword [0x567634]
mov eax, dword [eax]
mov edx, dword [eax + 0xf4]
mov eax, dword [0x56777c]
mov eax, dword [eax]
call fcn.0054f188
mov eax, dword [ebx + 8]
call fcn.004042dc
push 0
mov eax, dword [0x56777c]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x54e34c
call fcn.0054f334
mov eax, dword [ebp - 4]
call fcn.004057b0
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e324
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.00405344
lea eax, [ebp - 4]
call fcn.00405320
ret
Function at 0x551938
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057a0
xor eax, eax
push ebp
push 0x5519e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a14
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a14
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004057b0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x5519bf
test bl, bl
je 0x5519bf
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5519ee
lea eax, [ebp - 4]
call fcn.00405320
ret