joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51b520
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5333a8
test esi, esi
jne 0x51b53a
xor eax, eax
jmp 0x51b63c
cmp dword [ebp], 0
jne 0x51b545
call fcn.0051b4b0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x51b615
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x51b551
test edi, edi
jbe 0x51b637
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x51b619
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x525f38
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x525f40
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x526178
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5333b8], 0
jne 0x5260f5
xor eax, eax
push ebp
push 0x5260d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5260b5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
lea edx, [ebp - 0x44]
mov eax, 0x526190
call fcn.00467420
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x20]
call fcn.00415a40
push 0x5261b4
push 0x526224
push 0x526234
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00411504
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00411504
add esp, 0x10
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x30]
call fcn.00415b28
push 0x526248
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00411504
add esp, 0xc
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x68]
call fcn.00415604
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0xc]
mov ecx, 0x526254
call fcn.00406914
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x526264
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00411504
add esp, 0xc
lea eax, [ebp - 0x88]
lea edx, [ebp - 8]
call fcn.00416034
cmp dword [ebp - 8], 0
je 0x5260a2
mov al, byte [0x526274]
push eax
lea eax, [ebp - 0x8c]
push eax
mov ecx, 0x526280
mov edx, 0x52628c
mov eax, dword [ebp - 8]
call fcn.0040f1a8
mov edx, dword [ebp - 0x8c]
mov eax, 0x5333b8
call fcn.00404ca0
mov eax, dword [ebp - 4]
mov edx, dword [0x5333b8]
call fcn.00404ca0
call fcn.00404688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x526103
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5260bc
call sub.ole32.dll_CoUninitialize
ret
mov eax, dword [ebp - 4]
mov edx, dword [0x5333b8]
call fcn.00404ca0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52617f
lea eax, [ebp - 0x8c]
call fcn.00404c4c
lea eax, [ebp - 0x88]
mov edx, dword [0x4010bc]
mov ecx, 2
call fcn.00405760
lea eax, [ebp - 0x68]
call fcn.004068d0
lea eax, [ebp - 0x64]
mov edx, dword [0x4010bc]
mov ecx, 2
call fcn.00405760
lea eax, [ebp - 0x44]
call fcn.004068d0
lea eax, [ebp - 0x40]
mov edx, dword [0x4010cc]
mov ecx, 3
call fcn.00405760
lea eax, [ebp - 0xc]
call fcn.004068d0
lea eax, [ebp - 8]
call fcn.00404c4c
ret
Function at 0x52629c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050fc
xor eax, eax
push ebp
push 0x5263d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c4c
mov eax, dword [ebp - 4]
call fcn.00409cbc
test al, al
je 0x5263aa
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040510c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x5263aa
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405298
mov eax, dword [ebp - 0x10]
call fcn.0040510c
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5263aa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5263e4
mov eax, dword [ebp - 0x10]
call fcn.0040510c
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5263aa
cmp dword [ebp - 0xc], 0x34
jb 0x5263aa
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
call fcn.00407dcc
movzx eax, ax
lea edx, [ebp - 0x18]
call fcn.004096d0
push dword [ebp - 0x18]
push 0x5263f0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 8]
call fcn.004096d0
push dword [ebp - 0x1c]
push 0x5263f0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.00407dcc
movzx eax, ax
lea edx, [ebp - 0x20]
call fcn.004096d0
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 5
call fcn.00404fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5263dc
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404c70
lea eax, [ebp - 0x10]
call fcn.00404c4c
lea eax, [ebp - 4]
call fcn.00404c4c
ret
Function at 0x5263f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050fc
mov eax, dword [ebp - 8]
call fcn.004050fc
lea eax, [ebp - 0x164]
mov edx, dword [0x408408]
call fcn.00405644
xor eax, eax
push ebp
push 0x526582
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00409ccc
test al, al
jne 0x52645a
mov eax, dword [ebp - 8]
call fcn.00409cf0
mov eax, dword [ebp - 4]
call fcn.00409ccc
test al, al
je 0x526546
mov eax, dword [ebp - 8]
call fcn.00409ccc
test al, al
je 0x526546
mov eax, dword [ebp - 4]
call fcn.00404f0c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x526499
lea eax, [ebp - 4]
mov edx, 0x526598
call fcn.00404f14
mov eax, dword [ebp - 8]
call fcn.00404f0c
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x5264b8
lea eax, [ebp - 8]
mov edx, 0x526598
call fcn.00404f14
lea eax, [ebp - 0xc]
mov ecx, 0x5265a4
mov edx, dword [ebp - 4]
call fcn.00404f58
lea ecx, [ebp - 0x164]
mov edx, 0x3f
mov eax, dword [ebp - 0xc]
call fcn.00409e44
mov ebx, eax
test ebx, ebx
jne 0x526539
push 0
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.00404f58
mov eax, dword [ebp - 0x168]
call fcn.0040510c
push eax
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 4]
call fcn.00404f58
mov eax, dword [ebp - 0x16c]
call fcn.0040510c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x164]
call fcn.00409e94
mov ebx, eax
test ebx, ebx
je 0x5264e1
lea eax, [ebp - 0x164]
call fcn.00409eb8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526589
lea eax, [ebp - 0x16c]
mov edx, 2
call fcn.00404c70
lea eax, [ebp - 0x164]
mov edx, dword [0x408408]
call fcn.00405714
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c70
ret

Function at 0x528234
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5282cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c4c
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x5282b7
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x5282b7
lea eax, [ebp - 8]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404ebc
mov eax, dword [ebp - 8]
call fcn.0047b5c4
test al, al
je 0x5282b7
lea eax, [ebp - 8]
mov edx, 1
call fcn.0052817c
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404ca0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5282d4
lea eax, [ebp - 8]
call fcn.00404c4c
ret
Function at 0x5287b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x528964
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005297c0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
xor edi, edi
mov ecx, edi
mov eax, 1
shl eax, cl
and eax, esi
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x5288ec
lea eax, [ebp - 0x3c]
mov ebx, edi
add bl, 0x41
mov edx, ebx
call fcn.00404e34
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x10]
mov ecx, 0x52897c
call fcn.00404f58
mov edx, 0x528980
lea eax, [ebp - 0x40]
call fcn.00403448
lea eax, [ebp - 0x44]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x40]
mov cl, 2
call fcn.00403418
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x4c]
call fcn.00403448
mov edx, 0x528984
lea eax, [ebp - 0x4c]
mov cl, 4
call fcn.00403418
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x14]
call fcn.00404eb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00405250
test eax, eax
jg 0x5288ec
mov eax, dword [ebp - 0x10]
call fcn.0040510c
mov ebx, eax
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x5288ec
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov eax, dword [0x531390]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x1c]
jne 0x5288d3
cmp eax, dword [ebp - 0x20]
jae 0x5288ec
jmp 0x5288d5
jge 0x5288ec
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404ca0
inc edi
cmp edi, 0x1a
jne 0x528805
lea eax, [ebp - 0x50]
push eax
fild qword [ebp - 0x38]
fdiv dword [0x528988]
fdiv dword [0x528988]
fdiv dword [0x528988]
fstp xword [ebp - 0x64]
wait
lea eax, [ebp - 0x64]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 3
lea edx, [ebp - 0x58]
xor ecx, ecx
mov eax, 0x528994
call fcn.0040a844
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 8]
call fcn.00404ca0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52896b
lea eax, [ebp - 0x50]
call fcn.00404c4c
lea eax, [ebp - 0x3c]
call fcn.00404c4c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c70
ret
Function at 0x52964c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5296c7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [esi + 0x380]
call fcn.00409cbc
test al, al
je 0x5296b1
push 1
lea edx, [ebp - 4]
mov eax, dword [esi + 0x328]
call fcn.00445a0c
mov eax, dword [ebp - 4]
call fcn.0040510c
push eax
push 0x5296d8
mov eax, dword [esi + 0x380]
call fcn.0040510c
push eax
push 0x5296dc
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jle 0x5296b1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5296ce
lea eax, [ebp - 4]
call fcn.00404c4c
ret

Function at 0x52b088
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, esp
call fcn.00528094
test al, al
je 0x52b151
mov eax, dword [0x5335d4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x52b14c
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x5335d4]
call fcn.0041a768
mov dword [edi], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x52b144
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
dec eax
je 0x52b0de
dec eax
je 0x52b11a
dec eax
je 0x52b135
jmp 0x52b144
push 0
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
call fcn.0040510c
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
call fcn.0040510c
push eax
push 0x52b158
mov eax, dword [0x531558]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jle 0x52b144
mov eax, dword [edi]
mov byte [eax + 0x25], 1
jmp 0x52b144
mov eax, dword [edi]
mov ecx, dword [eax + 0x20]
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
call fcn.005282dc
mov edx, dword [edi]
mov byte [edx + 0x25], al
jmp 0x52b144
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
call fcn.005285d4
mov edx, dword [edi]
mov byte [edx + 0x25], al
inc esi
dec ebx
jne 0x52b0af
call fcn.005280b4
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x52b5c0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x52b76f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00528094
test al, al
jne 0x52b73f
lea edx, [ebp - 0x10]
mov eax, dword [0x5335b8]
mov eax, dword [eax + 0x328]
call fcn.00445a0c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x52b788
call fcn.00404f58
mov eax, dword [ebp - 0xc]
call fcn.0047b5c4
test al, al
jne 0x52b623
mov eax, dword [ebp - 0xc]
call fcn.0047b5cc
mov eax, dword [0x5335d4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x52b738
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x5335d4]
call fcn.0041a768
mov dword [edi], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x52b730
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
dec eax
je 0x52b66a
dec eax
je 0x52b6ce
jmp 0x52b730
push dword [ebp - 0xc]
mov eax, dword [edi]
push dword [eax + 0x14]
lea edx, [ebp - 0x14]
mov eax, dword [edi]
mov eax, dword [eax + 4]
call fcn.004096d0
push dword [ebp - 0x14]
push 0x52b79c
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404fcc
mov eax, dword [ebp - 8]
call fcn.00409cbc
test al, al
jne 0x52b6bf
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040510c
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
call fcn.0040510c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov eax, dword [edi]
add eax, 0x20
mov edx, dword [ebp - 8]
call fcn.00404ca0
jmp 0x52b730
push dword [ebp - 0xc]
mov eax, dword [edi]
push dword [eax + 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [edi]
mov eax, dword [eax + 4]
call fcn.004096d0
push dword [ebp - 0x18]
push 0x52b7ac
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404fcc
mov eax, dword [ebp - 8]
call fcn.00409cbc
test al, al
jne 0x52b723
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040510c
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
call fcn.0040510c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov eax, dword [edi]
add eax, 0x20
mov edx, dword [ebp - 8]
call fcn.00404ca0
inc esi
dec ebx
jne 0x52b637
mov al, 1
call fcn.00528074
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b776
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404c70
lea eax, [ebp - 0x10]
call fcn.00404c4c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404c70
ret
Function at 0x52be74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x52b884
call fcn.0040704c
xor eax, eax
push ebp
push 0x52bf97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x531558]
mov eax, dword [eax]
call fcn.00465990
call fcn.0052b7f8
test al, al
jne 0x52bf70
lea eax, [ebp - 0x14]
call fcn.005256c0
mov edx, dword [ebp - 0x14]
mov eax, 0x5335e4
call fcn.00404ca0
lea eax, [ebp - 0x18]
mov ecx, 0x52bfac
mov edx, dword [0x5335e4]
call fcn.00404f58
mov eax, dword [ebp - 0x18]
call fcn.00409cbc
test al, al
je 0x52bf4a
call fcn.00525cec
push 1
push 0
mov ecx, dword [0x531360]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
mov edx, 0x52bfc4
call fcn.00404f58
mov eax, dword [ebp - 0x1c]
call fcn.0040510c
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x52bfac
mov edx, dword [0x5335e4]
call fcn.00404f58
mov eax, dword [ebp - 0x20]
call fcn.0040510c
push eax
push 0x52bfcc
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x531558]
mov eax, dword [eax]
call fcn.00465b14
jmp 0x52bf7c
mov ecx, dword [0x5313c4]
mov eax, dword [0x531558]
mov eax, dword [eax]
mov edx, dword [0x527b40]
call fcn.004659a8
mov eax, dword [0x531558]
mov eax, dword [eax]
call fcn.00465a28
jmp 0x52bf7c
mov eax, dword [0x531558]
mov eax, dword [eax]
call fcn.00465b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bf9e
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404c70
ret
Function at 0x417490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movd mm7, dword [ebp + 8]
punpcklwd mm7, mm7
punpckldq mm7, mm7
movq mm4, mm7
psrlw mm4, 7
paddw mm7, mm4
movd mm6, dword [ebp + 0x2c]
punpckldq mm6, mm6
pand mm6, qword [0x55d6e8]
mov eax, dword [ebp + 0xc]
shl eax, 2
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
sub dword [ebp + 0x28], eax
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
or ecx, ecx
je 0x417558
movq mm5, qword [esi]
movq mm4, qword [edi]
movq mm3, mm5
movq mm2, mm4
movq mm1, mm3
movq mm0, mm2
psrlw mm1, 8
psrlw mm0, 8
psubw mm1, mm0
pmullw mm1, mm7
psllw mm0, 8
paddw mm1, mm0
pand mm1, qword [0x55d6f8]
pand mm3, qword [0x55d700]
pand mm2, qword [0x55d700]
psubw mm3, mm2
pmullw mm3, mm7
psrlw mm3, 8
paddw mm3, mm2
pand mm3, qword [0x55d700]
por mm3, mm1
pand mm5, qword [0x55d6e8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x55d738]
pand mm3, mm5
por mm4, mm3
movq qword [ebx], mm4
add esi, 8
add edi, 8
add ebx, 8
dec ecx
jne 0x4174dc
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x4175b7
movd mm5, dword [esi]
movd mm4, dword [edi]
movq mm3, mm5
movq mm2, mm4
punpcklbw mm3, dword [0x55d6d8]
punpcklbw mm2, dword [0x55d6d8]
psubw mm3, mm2
pmullw mm3, mm7
psrlw mm2, 8
paddw mm3, mm2
psrlw mm3, 8
packuswb mm3, mm3
pand mm5, qword [0x55d6e8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x55d738]
pand mm3, mm5
por mm4, mm3
movd dword [ebx], mm4
add esi, 4
add edi, 4
add ebx, 4
add esi, dword [ebp + 0x28]
add edi, dword [ebp + 0x20]
add ebx, dword [ebp + 0x18]
dec edx
jne 0x4174d3
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x28
Function at 0x4175d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movd mm7, dword [ebp + 8]
punpcklwd mm7, mm7
punpckldq mm7, mm7
movq mm4, mm7
psrlw mm4, 7
paddw mm7, mm4
mov eax, dword [ebp + 0x2c]
and eax, 0xffffff
movd mm6, eax
punpckldq mm6, mm6
mov eax, dword [ebp + 0xc]
mov edx, eax
shl eax, 1
add eax, edx
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
sub dword [ebp + 0x28], eax
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
or ecx, ecx
je 0x4176de
push ecx
movd mm5, dword [esi]
mov eax, dword [esi + 2]
shr eax, 8
movd mm3, eax
psllq mm3, 0x20
por mm5, mm3
movd mm4, dword [edi]
mov eax, dword [edi + 2]
shr eax, 8
movd mm3, eax
psllq mm3, 0x20
por mm4, mm3
movq mm3, mm5
movq mm2, mm4
psrlw mm3, 8
psrlw mm2, 8
psubw mm3, mm2
pmullw mm3, mm7
psllw mm2, 8
paddw mm3, mm2
pand mm3, qword [0x55d6f8]
movq mm2, mm5
movq mm1, mm4
pand mm2, qword [0x55d700]
pand mm1, qword [0x55d700]
psubw mm2, mm1
pmullw mm2, mm7
psrlw mm2, 8
paddw mm2, mm1
pand mm2, qword [0x55d700]
por mm3, mm2
pand mm5, qword [0x55d6e8]
pand mm3, qword [0x55d6e8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x55d738]
pand mm3, mm5
por mm4, mm3
movd eax, mm4
psrlq mm4, 0x18
mov word [ebx], ax
movd ecx, mm4
shr eax, 0x10
or eax, ecx
mov dword [ebx + 2], eax
pop ecx
add esi, 6
add edi, 6
add ebx, 6
dec ecx
jne 0x417623
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x417786
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 2]
shl eax, 0x10
mov cx, word [esi]
or eax, ecx
movd mm5, eax
xor eax, eax
xor ecx, ecx
mov al, byte [edi + 2]
shl eax, 0x10
mov cx, word [edi]
or eax, ecx
movd mm4, eax
movq mm3, mm5
movq mm2, mm4
psrlw mm3, 8
psrlw mm2, 8
psubw mm3, mm2
pmullw mm3, mm7
psllw mm2, 8
paddw mm3, mm2
pand mm3, qword [0x55d6f8]
movq mm2, mm5
movq mm1, mm4
pand mm2, qword [0x55d700]
pand mm1, qword [0x55d700]
psubw mm2, mm1
pmullw mm2, mm7
psrlw mm2, 8
paddw mm2, mm1
pand mm2, qword [0x55d700]
por mm3, mm2
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x55d738]
pand mm3, mm5
por mm4, mm3
movd eax, mm4
mov word [ebx], ax
shr eax, 0x10
mov byte [ebx + 2], al
add esi, 3
add edi, 3
add ebx, 3
add esi, dword [ebp + 0x28]
add edi, dword [ebp + 0x20]
add ebx, dword [ebp + 0x18]
dec edx
jne 0x417616
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x28