joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5497e6
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x54997a
mov eax, dword [ebp + 8]
test eax, eax
je 0x54997a
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + edx*4 + 0x14]
mov eax, dword [eax + 4]
push esi
push edi
inc eax
push eax
push 0x61c2bc
call fcn.005472a6
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.005a3b0e
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov edi, 0x61c2b8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [ebp - 0x64]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x54988a
mov ecx, dword [ebp - 4]
push 0x61c1a4
call fcn.005472a6
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
lea edx, [ebp - 0x64]
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x549960
test ebx, 0x80000000
je 0x549900
test ebx, 0x40000000
je 0x5498c2
cmp dword [ebp + 0xc], 0
je 0x5498b4
cmp dword [ebp + 0xc], 1
je 0x5498b4
and ebx, 0xfffffff
push ebx
push 0x61c294
jmp 0x549911
and ebx, 0xfffffff
push ebx
push 0x61c270
jmp 0x549911
test ebx, 0x20000000
je 0x5498f2
cmp dword [ebp + 0xc], 0
je 0x5498e4
cmp dword [ebp + 0xc], 1
je 0x5498e4
and ebx, 0xfffffff
push ebx
push 0x61c24c
jmp 0x549911
and ebx, 0xfffffff
push ebx
push 0x61c228
jmp 0x549911
and ebx, 0xfffffff
push ebx
push 0x61c208
jmp 0x549911
cmp ebx, 0x20
jg 0x54992e
and ebx, 0xfffffff
push ebx
push 0x61c1e8
mov ecx, dword [ebp - 4]
call fcn.005472a6
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.005a3b0e
add esp, 0xc
lea edi, [ebp - 0x24]
lea edx, [ebp - 0x64]
jmp 0x549940
mov ecx, dword [ebp - 4]
push 0x61c1c4
call fcn.005472a6
lea edx, [ebp - 0x64]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005a3a10
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x54a762
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
lea eax, [ebp - 0x94]
push eax
mov esi, ecx
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
cmp eax, 2
mov edi, dword [ebp - 0x8c]
mov dword [0x61c39c], eax
jne 0x54a7ad
cmp dword [ebp - 0x90], 5
jne 0x54a7ad
test edi, edi
jne 0x54a7ad
mov dl, 1
jmp 0x54a7c4
xor dl, dl
cmp eax, 2
jne 0x54a7c4
cmp dword [ebp - 0x90], 5
jne 0x54a7c4
push 1
pop ecx
cmp edi, ecx
je 0x54a7c6
xor cl, cl
sub eax, 0
je 0x54a8d9
dec eax
je 0x54a836
dec eax
je 0x54a7e5
add esi, 0xdc
push 0x61c4a8
jmp 0x54a8e4
test dl, dl
je 0x54a7f9
add esi, 0xdc
push 0x61c498
jmp 0x54a8e4
test cl, cl
je 0x54a80d
add esi, 0xdc
push 0x61c48c
jmp 0x54a8e4
cmp dword [ebp - 0x90], 5
jb 0x54a826
add esi, 0xdc
push 0x61c47c
jmp 0x54a8e4
add esi, 0xdc
push 0x61c470
jmp 0x54a8e4
test edi, edi
jne 0x54a888
add esi, 0xdc
push 0x61c464
mov ecx, esi
call fcn.005bcec6
lea eax, [ebp - 0x80]
test eax, eax
je 0x54a8eb
cmp byte [ebp - 0x7f], 0x41
jne 0x54a869
push 0x5fe260
mov ecx, esi
call fcn.005bd119
cmp byte [ebp - 0x7f], 0x42
jne 0x54a87b
push 0x61c45c
mov ecx, esi
call fcn.005bd119
cmp byte [ebp - 0x7f], 0x43
jne 0x54a8eb
push 0x61c454
jmp 0x54a8b1
cmp edi, 0xa
jne 0x54a8ba
add esi, 0xdc
push 0x61c448
mov ecx, esi
call fcn.005bcec6
lea eax, [ebp - 0x80]
test eax, eax
je 0x54a8eb
cmp byte [ebp - 0x7f], 0x41
jne 0x54a8eb
push 0x61c444
mov ecx, esi
call fcn.005bd119
jmp 0x54a8eb
cmp edi, 0x5a
jne 0x54a8cc
add esi, 0xdc
push 0x61c430
jmp 0x54a8e4
add esi, 0xdc
push 0x61c424
jmp 0x54a8e4
add esi, 0xdc
push 0x61c418
mov ecx, esi
call fcn.005bcec6
cmp dword [ebp - 0x84], 2
jne 0x54a934
call fcn.0054facd
test eax, eax
mov eax, dword [0x61c3a8]
jne 0x54a907
mov eax, dword [0x61c3ac]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x114]
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push 0x61c3f8
push eax
call fcn.005a3b0e
add esp, 0x1c
jmp 0x54a954
push dword [ebp - 0x8c]
lea eax, [ebp - 0x114]
push dword [ebp - 0x90]
push 0x61c3e8
push eax
call fcn.005a3b0e
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.005bd119
pop edi
pop esi
leave
ret

Function at 0x54c157
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp + 0xc]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x54c18b
mov edi, dword [ebp - 4]
xor eax, eax
cmp eax, esi
mov ebx, eax
jne 0x54c1ae
push dword [ebp + 0x10]
call dword [sym.imp.kernel32.dll_lstrlen]
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ebx, eax
cmp edi, esi
je 0x54c1b9
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x54e20f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp ecx, ebx
je 0x54e2c4
push dword [edi + 4]
call fcn.005c0c0c
mov esi, eax
cmp esi, ebx
je 0x54e2c4
cmp dword [esi + 0x1c], ebx
je 0x54e2c4
push ebx
push 0xd
push ebx
mov ecx, esi
call fcn.005c0ccb
mov esi, dword [esi + 0x1c]
push 0x69
push ebx
push 0x1036
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.user32.dll_SendMessageA]
cmp dword [edi], ebx
mov dword [ebp - 0x2c], 0x2f
jle 0x54e2bc
mov esi, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, esi
sub ecx, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x54e288
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + esi]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + esi]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x101b
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
inc ebx
add esi, 4
cmp ebx, dword [edi]
jl 0x54e282
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.0054e2c9
pop edi
pop esi
pop ebx
leave
ret

Function at 0x54fa83
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x54fab5
cmp dword [ebp - 0x90], 5
ja 0x54fac8
xor eax, eax
cmp dword [ebp - 0x90], 5
jne 0x54facb
cmp dword [ebp - 0x8c], eax
jbe 0x54facb
push 1
pop eax
leave
ret
Function at 0x54facd
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x98], 2
je 0x54fb00
push 1
pop eax
jmp 0x54fbde
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
push 1
push 8
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
mov byte [ebp - 3], 5
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.advapi32.dll_OpenThreadToken]
test eax, eax
jne 0x54fb52
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x54fb9d
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x54fb9d
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x4a8]
push eax
push 2
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_GetTokenInformation]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp esi, ebx
je 0x54fb9d
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 8]
push eax
call dword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x54fba1
xor eax, eax
jmp 0x54fbde
xor esi, esi
cmp dword [ebp - 0x4a8], ebx
push edi
jbe 0x54fbd2
lea edi, [ebp - 0x4a4]
push dword [edi]
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_EqualSid]
test eax, eax
jne 0x54fbcf
inc esi
add edi, 8
cmp esi, dword [ebp - 0x4a8]
jb 0x54fbb2
jmp 0x54fbd2
push 1
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_FreeSid]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x550f90
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
mov eax, ecx
sar eax, 2
and ecx, 3
test eax, eax
mov esi, edx
je 0x550fb9
mov edx, dword [esi]
xor edx, dword [0x648690]
add esi, 4
mov dword [edi], edx
add edi, 4
dec eax
jne 0x550fa6
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret 4

Function at 0x550fcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x61cb50
push Ordinal_4
mov esi, ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x551037
lea ecx, [ebp - 8]
mov eax, 0x104
push ecx
push eax
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.005bd16d
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x61cb44
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x551025
push 1
pop edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd1bc
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x5511fc
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, 0x5d44b4
call fcn.005a39e4
sub esp, 0x18
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.005a595c
test eax, eax
mov eax, dword [ebp + 8]
pop ecx
je 0x551255
cmp byte [eax + 1], 0x3a
jne 0x551255
push 2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.005babe0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.005bce76
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005bcd3d
jmp 0x5512a9
cmp byte [eax], 0x5c
jne 0x551260
cmp byte [eax + 1], 0x5c
je 0x5512a9
push esi
mov esi, 0x104
push esi
lea ecx, [ebp + 8]
call fcn.005bd16d
push eax
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.005bd1bc
push 2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.005babe0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.005bce76
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005bcd3d
pop esi
push ebx
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.005bab64
mov eax, dword [eax]
cmp byte [eax], 0x5c
lea ecx, [ebp - 0x10]
setne bl
call fcn.005bcd3d
test bl, bl
pop ebx
je 0x5512d7
push 0x5c
lea ecx, [ebp + 8]
call fcn.005bd140
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x551315
mov eax, dword [ebp - 0x14]
mul dword [ebp - 0x18]
push edi
push dword [ebp - 0x1c]
push edx
push eax
call fcn.005a68d0
xor ecx, ecx
cmp ecx, edx
ja 0x551315
jb 0x551312
cmp dword [ebp - 0x20], eax
jae 0x551315
push 1
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.005bcd3d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x5564ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6489e0]
push esi
xor esi, esi
cmp eax, 8
jne 0x556588
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x61cb50
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x55658a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x61d9a0
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x55657d
mov eax, dword [ebp - 0xc]
and eax, 0xff
sub eax, 7
je 0x55657a
dec eax
dec eax
je 0x55657d
dec eax
je 0x556576
dec eax
dec eax
je 0x556572
sub eax, 4
je 0x55656e
sub eax, 0xd
jne 0x55657d
push 5
jmp 0x55657c
push 4
jmp 0x55657c
push 1
jmp 0x55657c
push 3
jmp 0x55657c
push 2
pop esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x55658a
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x557f94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x62d104]
push edi
xor edi, edi
cmp eax, edi
je 0x557fc2
push esi
mov esi, eax
cmp esi, edi
je 0x557fbb
mov ecx, esi
call fcn.0043e9b1
push esi
call fcn.005bcaa7
pop ecx
mov dword [0x62d104], edi
pop esi
call fcn.00535c92
mov ecx, 0x648df8
call fcn.005577dd
mov eax, dword [0x64b0a8]
cmp eax, edi
je 0x557fe7
push 0x8000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [0x64b0a4]
cmp ecx, edi
je 0x55800d
call fcn.005c4154
mov ecx, dword [0x64b0a4]
cmp ecx, edi
je 0x55800d
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [0x64b0a4], edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push 0x611310
push edi
push 0x61cb50
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x55805e
mov eax, dword [0x635dac]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x61dcfc
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
call fcn.00553235
push 1
pop eax
pop edi
leave
ret
Function at 0x563660
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push edi
mov edi, dword [esp + 0x10]
cmp edi, 2
jne 0x563697
mov edx, dword [esp + 0x14]
test edx, edx
je 0x5636d1
mov cl, byte [eax + 1]
mov bl, byte [eax]
xor bl, cl
mov byte [eax], bl
mov cl, bl
mov bl, byte [eax + 1]
xor bl, cl
mov byte [eax + 1], bl
mov cl, bl
xor byte [eax], cl
add eax, 2
dec edx
jne 0x563677
pop edi
pop ebx
ret
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x5636d1
push ebp
push esi
mov esi, edi
sar esi, 1
mov ebp, ecx
lea ecx, [edi + eax - 1]
cmp eax, ecx
jae 0x5636ca
nop
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x5636b0
add eax, esi
dec ebp
jne 0x5636a7
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x5637e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x64b410], 0x80000000
jne 0x5637ef
xor eax, eax
ret
mov eax, dword [esp + 4]
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.005a4423
add esp, 0x10
cmp eax, 1
je 0x563817
mov dword [0x64b410], 0x80000000
xor eax, eax
ret
lea eax, [esp + 4]
lea ecx, [esp + 7]
push ebx
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x563820
add dword [0x64b410], 4
mov eax, dword [esp + 8]
pop ebx
ret

Function at 0x563900
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x64b410], 0x80000000
jne 0x56390f
xor eax, eax
ret
mov eax, dword [esp + 4]
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.005a4423
add esp, 0x10
cmp eax, 1
je 0x563937
mov dword [0x64b410], 0x80000000
xor eax, eax
ret
lea eax, [esp + 4]
lea ecx, [esp + 7]
push ebx
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x563940
add dword [0x64b410], 4
mov eax, dword [esp + 8]
pop ebx
ret

Function at 0x563a00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x64b410], 0x80000000
jne 0x563a13
fld dword [0x5de170]
ret
mov eax, dword [esp + 4]
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.005a4423
add esp, 0x10
cmp eax, 1
je 0x563a3f
mov dword [0x64b410], 0x80000000
fld dword [0x5de170]
ret
lea eax, [esp + 4]
lea ecx, [esp + 7]
push ebx
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x563a48
mov eax, dword [0x64b410]
fld dword [esp + 8]
add eax, 4
mov dword [0x64b410], eax
pop ebx
ret
Function at 0x563bc0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x64b410], 0x80000000
jne 0x563bcf
xor eax, eax
ret
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
lea ecx, [esp + 0xf]
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x563be5
add dword [0x64b410], 4
add dword [esi], 4
mov eax, dword [esp + 0xc]
pop esi
pop ebx
ret

Function at 0x563c70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x64b410], 0x80000000
jne 0x563c83
fld dword [0x5de170]
ret
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
lea ecx, [esp + 0xf]
lea esp, [esp]
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, bl
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov dl, bl
xor byte [eax], dl
inc eax
dec ecx
cmp eax, ecx
jb 0x563ca0
mov ecx, dword [0x64b410]
fld dword [esp + 0xc]
add ecx, 4
mov dword [0x64b410], ecx
add dword [esi], 4
pop esi
pop ebx
ret

Function at 0x570763
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x5df628
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x5707bb
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x5707bb
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x5707bb
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x5707e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x5df628
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x570852
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5df644
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x570849
cmp dword [ebp - 0xc], 4
jne 0x570849
cmp dword [ebp - 0x10], edi
je 0x570849
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [0x620500], edi
xor eax, eax
jmp 0x57087a
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [0x620500], edi
jge 0x570875
mov dword [0x620500], edi
call fcn.005707bf
test eax, eax
je 0x570875
emms
mov dword [0x620500], 1
mov eax, dword [0x620500]
pop edi
leave
ret
Function at 0x57095a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x570991
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x5709b3
cmp dword [ebp - 0x20], 4
ja 0x5709bd
jne 0x5709ad
cmp dword [ebp - 0x1c], 0xa
jb 0x5709ad
cmp word [ebp - 0x18], 0x55d
jae 0x5709bd
mov byte [ebp + 0x73], 1
jmp 0x5709bd
cmp dword [ebp - 0x14], 2
jne 0x5709d3
test bl, bl
je 0x5709ee
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x5709de
dec eax
je 0x5709d7
sub eax, 3
jne 0x5709d3
cmp byte [ebp + 0x73], 0
je 0x5709ff
xor eax, eax
jmp 0x570a07
call fcn.0057087d
jmp 0x570a07
cmp byte [ebp + 0x73], 0
jne 0x5709d3
call fcn.005708b5
and eax, 4
jmp 0x570a07
cmp dword [ebp + 0x7c], 0xa
je 0x5709ff
push dword [ebp + 0x7c]
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
jmp 0x570a07
call fcn.005708b5
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x573182
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x5732a3
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x573287
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x5731d9
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x5731b7
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret