joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x20]
test eax, eax
je 0x55d460
push 0x7c9
mov ecx, 0x6cb110
call fcn.004d1220
push eax
push 0x17
push 0x6cb110
call fcn.004d0860
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575c70
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6ebb8c]
mov dword [ebp - 0x210], 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
lea edx, [ebp - 0x210]
push edx
push 0x59697c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x134]
test eax, eax
je 0x55d44f
cmp dword [esi + 0xc], 0
jne 0x55d4c5
push str.bdcap32.dll
mov ecx, esi
call fcn.0055d5f0
test eax, eax
jns 0x55d4ab
push 0x7ca
jmp 0x55d435
mov eax, dword [esi]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call dword [eax + 0xc]
cmp dword [esi + 0xc], 0
je 0x55d588
mov eax, dword [esi]
push 0x140
push 0xf
push esi
call dword [eax + 0x40]
mov ecx, esi
call fcn.0055d9d0
push 0
mov ecx, 0x6a6f10
call fcn.00549880
push eax
lea eax, [ebp - 0x108]
push str._sScreenShot
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x55d51f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x55d44f
push 0x104
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
push 0x596a5c
push str.Capture
lea eax, [ebp - 0x108]
push eax
call fcn.0055d900
lea eax, [ebp - 0x20c]
mov ecx, 0x6cb110
push eax
push 0x971
call fcn.004d1220
push eax
push 0x17
push 0x6cb110
call fcn.004d0860
add esp, 0x10
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
push 4
push 0
push eax
push esi
call fcn.0055db30
test eax, eax
js 0x55d44f
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00575c70
mov esp, ebp
pop ebp
ret

Function at 0x562100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x104]
push 0xff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call dword [sym.imp.MSVCR120.dll_strrchr]
add esp, 8
mov esi, ebx
mov byte [eax + 1], 0
mov al, byte [ebx]
inc ebx
test al, al
jne 0x562160
lea edi, [ebp - 0x104]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x562170
mov ecx, ebx
lea eax, [ebp - 0x104]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0xff
push dword [ebp - 0x110]
mov ecx, ebx
push 0
push dword [ebp - 0x108]
and ecx, 3
push dword [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00575c70
mov esp, ebp
pop ebp
ret
Function at 0x569c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6a5d79]
push ebx
push esi
push eax
push eax
mov ebx, ecx
mov ecx, 0x6a6f10
push 0
call fcn.00549880
push eax
lea eax, [ebp - 0x108]
push str._sData_d_d.UIE
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x569ca4
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x569cb6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575c70
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x110], 0x61208
jne 0x569c9d
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x168
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x569c9d
cmp dword [ebp - 0x10c], 0x168
push esi
ja 0x569c9e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.00575c70
mov esp, ebp
pop ebp
ret

Function at 0x56c060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6a5d79]
push ebx
push edi
push eax
push eax
mov ebx, ecx
mov ecx, 0x6a6f10
push 0
call fcn.00549880
push eax
lea eax, [ebp - 0x108]
push str._sData_d_d.UIE
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x56c109
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 0x61208
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x168
lea eax, [ebx + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00575c70
mov esp, ebp
pop ebp
ret
Function at 0x56c720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582319
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a73f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CDungeonMgr.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
push 0x1e0
lea ebx, [edi + 0x70]
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc4]
push 0
push eax
call sub.MSVCR120.dll_memset
push 0x1e0
lea eax, [ebx + 0x2a4]
push 0
push eax
call sub.MSVCR120.dll_memset
push 0x48e
xorps xmm0, xmm0
push 0
movq qword [ebx + 0x484], xmm0
push ebx
mov word [ebx + 0x48c], 0
call sub.MSVCR120.dll_memset
add esp, 0x24
mov dword [edi + 0x4fe], 0
lea ecx, [edi + 0x4fe]
mov dword [edi + 0x502], 0
call fcn.0056e090
mov dword [edi + 0x4fe], eax
add edi, 0x506
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov ecx, dword [ebp - 0x10]
lea esi, [ecx + 0x52a]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea ebx, [ecx + 0x54e]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push 0x48e
lea eax, [ecx + 0x70]
mov byte [ebp - 4], 6
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0xc8
mov ecx, edi
call fcn.0049a3f0
push 0x14
mov ecx, esi
call fcn.0049a3f0
mov esi, dword [ebp - 0x10]
push 0x404
push 0
lea eax, [esi + 0x58e]
mov dword [esi + 0x572], 0
push eax
mov dword [esi + 0x57a], 0
mov dword [esi + 0x576], 0xf
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [esi + 4]
push 0xc8
call fcn.0049a3f0
push 0x14
mov ecx, ebx
mov dword [esi + 0x57e], 0
mov dword [esi + 0x582], 0
mov dword [esi + 0x586], 0
mov dword [esi + 0x58a], 0
call fcn.0049a3f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x570b90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5825b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6a73f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.005729a0
mov dword [edi], eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.005729d0
mov dword [edi + 8], eax
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0052c050
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x571640
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x25b]
push esi
mov esi, dword [ebp + 0xc]
push 0x1f3
push 0
push eax
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], esi
mov byte [ebp - 0x25c], 0
call sub.MSVCR120.dll_memset
xor eax, eax
mov byte [ebp - 0x260], 0
push 0x63
push eax
mov word [ebp - 0x25f], ax
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x67]
push eax
call sub.MSVCR120.dll_memset
add esp, 0x18
test ebx, ebx
je 0x5717c1
test esi, esi
je 0x5717c1
push edi
lea eax, [ebp - 0x25c]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x571768
cmp byte [ebp - 0x25c], 0
je 0x571768
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esi, [ebp - 0x25c]
push 0x597244
push esi
call edi
test eax, eax
je 0x571754
push 0x597248
push esi
call edi
test eax, eax
je 0x571754
movzx eax, byte [esi]
mov byte [ebp - 0x260], al
movzx eax, byte [esi + 1]
mov byte [ebp - 0x25f], al
lea eax, [ebp - 0x68]
push 0x64
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 0x25e], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x571770
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x68]
push ebx
push eax
push dword [ebp - 0x264]
call dword [sym.imp.MSVCR120.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x571785
add esi, 4
cmp byte [esi], 0
jne 0x5716e7
mov ebx, dword [ebp - 0x264]
mov esi, dword [ebp - 0x268]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575c70
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x264]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575c70
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00575c70
mov esp, ebp
pop ebp
ret 8
Function at 0x571ee0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5827bb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], 0
mov byte [ebp - 0x230], 0
push 0
push 0x585acc
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00404180
push esi
push 0
push 0x400
mov byte [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x571f96
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00408a70
cmp dword [ebp - 0x21c], 0x10
jb 0x572000
push dword [ebp - 0x230]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x572000
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x571fb5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x571fe7
lea eax, [ebp - 0x114]
mov ecx, ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00571640
push esi
test eax, eax
je 0x571fad
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x230]
call fcn.004a5d20
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00408a70
lea ecx, [ebp - 0x230]
call fcn.00514b70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00575c70
mov esp, ebp
pop ebp
ret 8
Function at 0x5723f0
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
jne 0x57247d
call fcn.00572480
push 0
push 0
push 0
push 0
mov dword [edi + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [0x6f18f8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0x571910
push 0
push 0
mov dword [0x6f18fc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6f1900], eax
test eax, eax
jne 0x572467
push eax
push eax
push 0x10
push dword [0x6b0330]
mov dword [0x6b0978], 1
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x6c9394]
mov dword [edi + 0x44], eax
mov dword [edi + 0x40], 1
mov dword [edi + 0x4c], 0
pop edi
ret

Function at 0x572870
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x6a73f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
je 0x572971
mov ecx, dword [0x6c9394]
mov eax, ecx
sub eax, dword [esi + 0x44]
cmp eax, 0x1e
jb 0x5728c7
cmp dword [esi + 0x48], 0
jne 0x5728c7
mov dword [esi + 0x48], 1
push dword [0x6f18f8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x6c9394]
mov dword [esi + 0x44], eax
mov ecx, dword [0x6c9394]
mov eax, dword [esi + 0x4c]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x5728f3
sub ecx, eax
cmp ecx, 0x1e
jb 0x5728f3
push 0
push 0
push 0x10
push dword [0x6b0330]
mov dword [0x6b0978], 1
call esi
push dword [0x6f1900]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x57291b
push 0
push 0
push 0x10
push dword [0x6b0330]
mov dword [0x6b0978], 1
call esi
push 0x2c8
lea eax, [ebp - 0x2cc]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10007
lea eax, [ebp - 0x2d0]
push eax
push dword [0x6f1900]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x572971
push 0
push 0
push 0x10
push dword [0x6b0330]
mov dword [0x6b0978], 1
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00575c70
mov esp, ebp
pop ebp
ret

Function at 0x5752d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
sar eax, 2
and esi, 3
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x4c], esi
lea edx, [eax*4]
mov dword [ecx + 0x50], edx
push edi
test eax, eax
je 0x57530f
xor edi, edi
xor edi, dword [ebx]
lea ebx, [ebx + 4]
dec eax
mov dword [ecx + 0x54], edi
mov dword [ecx + 0x48], eax
jne 0x575301
test esi, esi
je 0x57532c
mov edi, dword [ecx + 0x54]
mov eax, dword [ebp + 8]
movsx eax, byte [edx + eax]
inc edx
xor edi, eax
mov dword [ecx + 0x50], edx
dec esi
mov dword [ecx + 0x54], edi
mov dword [ecx + 0x4c], esi
jne 0x575316
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4177e2
Capabilities:
Get common file path

Disassembly:
cmp byte [eax + eax + 1], cl
and dword [esp + 0x18], 0
push 0xc
call fcn.00472241
mov esi, eax
test esi, esi
pop ecx
je 0x41780d
mov ecx, 0x4c2994
call 0xcd0e446b
int3
nop
nop
nop

Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x4b9aa0]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4b9070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
and al, 0xd
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4b9aa0], eax
test eax, eax
pop ebx
je 0x4178d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b905c
push eax
call esi
mov ecx, dword [0x4b9aa0]
push 0x4b9044
push ecx
mov dword [0x4b9a9c], eax
call esi
mov ecx, dword [0x4b9a9c]
mov dword [0x4b9aa4], eax
test ecx, ecx
je 0x4178c7
test eax, eax
je 0x4178c7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x4b9aa0], 0
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x45b267
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xc
push es
xchg edi, eax
xor eax, 0x3a0f816
syscall
xor byte [ebp + 0x17308f03], ch
xor byte [edi], dl
xor byte [edi], dl
pop es
or al, 0x48
xor al, 0x7a
mov dword [0xcfba022c], eax
xor bl, 0x14
lodsb al, byte [esi]
xlatb
loopne 0x45b258
insd dword es:[edi], dx
cmp byte [edi - 0x75e58d93], dh
xor al, 0x85
ljmp 0xe129
Function at 0x468d62
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
mov dh, 0xef
adc eax, 0xf0af9b81
xor eax, 0xf1028343
mov al, byte [0xa802235c]
xchg esp, eax
clc
add eax, 0xa04170e3
outsb dx, byte [esi]
or byte [ebp - 0x542b6e68], bh
je 0x468d59
lea cx, fs:[edi - 0x39eefccb]
adc esi, eax
mov dword [0xcf4c2842], eax
jnp 0x468d2f
test dword [ebp + 0x29], edi
ret 0x3216
jg 0x468cf9
or byte [esi + 0x34], bh
inc ebp
fcom qword [eax]
loope 0x468cd0
out 0x36, eax
dec ebx
invalid
aad 0xf2
pushal
ret 0x2cc1
test eax, 0xbd99a08a
jo 0x468d2d
xchg ebp, eax
lcall 0x9e11, 0xc1a7c235
fisubr word [edi + 0x20]
add dh, byte [ebx + 0x5a]
je 0x468db3
push ebx
mov al, byte es:[0xd2a48247]
dec eax
push esp
pop es
adc eax, 0x3d66548f
inc eax
jle 0x468d57
into
invalid
xchg edx, eax
mov ecx, 0x2af04d30
sbb dword [ebx - 0x3da95e3c], 0xfffffffa
inc ebp
add dword [ebp + 0x7b], ecx
and dl, byte [esi - 0x1867cf9b]
xchg edx, eax
cwde
push ecx
xchg esi, eax
xor byte gs:[eax + 0x519892e7], bl
scasb al, byte es:[edi]
loop 0x468dc5
xchg ebp, eax
mov ah, 0x46
rol byte [eax*4 + 0x2e5ffb0e], 0x2d
mov esi, 0xf4d2f0e0
pop ebp
jo 0x468dd8
pop edi
sub eax, 0xd2f0e0be
hlt
pop edx
bound edi, qword [edx]
xchg bh, al
hlt
Function at 0x474c1a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00474e0d
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call int.0047f962
xor ebx, ebx
cmp eax, ebx
jne 0x474dc8
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00474e0d
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047c641
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4cdf36
add esp, 0x10
test eax, eax
jne 0x474ce3
push esi
call fcn.004722cc
mov esi, eax
cmp esi, ebx
pop ecx
je 0x474ce3
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x474cce
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x474ce3
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474cdc
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00480e75
cmp byte [esp + 0x13], bl
je 0x474d13
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00474e4a
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x474d83
push 0x14
call 0x4cd1a3
cmp eax, ebx
pop ecx
je 0x474d3d
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x474d3f
xor edi, edi
cmp edi, ebx
je 0x474d83
push esi
push edi
call fcn.00474370
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474438
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474561
add esp, 0x18
call fcn.00474e0d
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047f02f
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474d9a
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x474dac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x474def
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x474def
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474438
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474561
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47be7a
Capabilities:
Encode data using xor

Disassembly:
sub byte [edi - 0x2f], 0x7e
xchg ecx, eax
push 0x53cc8c2f
das
mov esp, cs
push ebx
das
mov esp, cs
push ebx
pop ss
jno 0x47beaa
inc edi
add esi, esi
dec ecx
aaa
sub dword [edx + 0x6c5067e7], edx
push ds
inc esp
jns 0x47be74
int3
inc eax
or ch, byte [ecx + 0x4c]
invalid