joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e513
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x58bfaf
call fcn.004a0b36
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x55e630
cmp byte [ebx + 0x3e], 0
je 0x55e630
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004a0bde
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x55e55f
xor al, al
jmp 0x55e632
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00413750
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x55e58f
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004a0bde
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x55e5c4
sub eax, 1
je 0x55e5c8
dec eax
sub eax, 1
je 0x55e61e
xor bl, bl
jmp 0x55e620
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x55e5d8
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x55e600
cmp eax, 0x10
jae 0x55e5e7
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0053606b
add esp, 0x10
cmp esi, eax
jne 0x55e5c0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x55e61e
test esi, esi
jne 0x55e583
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004142d0
jmp 0x55e57d
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00406580
mov al, bl
jmp 0x55e632
mov al, 1
call fcn.004a0ae0
ret
Function at 0x55e7a1
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x58bf28
call fcn.004a0b36
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x55e7c6
xor eax, eax
jmp 0x55e93f
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x55e7f2
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x55e7f2
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x55e93f
cmp dword [esi + 0x4c], 0
je 0x55e93c
mov ecx, esi
call fcn.0055e6b6
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x55e825
push dword [esi + 0x4c]
push edi
call fcn.0055e395
pop ecx
pop ecx
test al, al
je 0x55e93c
movzx ebx, di
jmp 0x55e93c
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00413750
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x55e85d
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.004a0bde
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x55e930
cmp eax, 1
jg 0x55e90b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x55e8a6
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x55e8d3
cmp eax, 0x10
jae 0x55e8b5
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0053606b
add esp, 0x10
cmp edi, eax
jne 0x55e906
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x55e8d6
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x55e900
test edi, edi
jne 0x55e851
cmp dword [ebp - 0x18], 0x20
jae 0x55e92a
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.004142d0
jmp 0x55e84b
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x55e92a
cmp eax, 3
jne 0x55e930
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.0055e395
pop ecx
pop ecx
test al, al
je 0x55e92a
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00406580
mov ax, bx
call fcn.004a0ae0
ret 4
Function at 0x56139e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5613ab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005613b7

Function at 0x562c9c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
push esi
push edi
sub eax, 0
je 0x562d19
sub eax, 1
je 0x562d0a
sub eax, 1
je 0x562cfb
sub eax, 1
je 0x562ce3
sub eax, 1
je 0x562cd6
sub eax, 1
jne 0x562d2f
cmp byte [ecx], 0
mov eax, str.true
mov edx, str.false
cmove eax, edx
push eax
jmp 0x562d1e
cmp dword [ecx], 0
mov eax, 0x5bd104
cmovne eax, dword [ecx]
jmp 0x562cd3
movsd xmm0, qword [ecx]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp + 8]
call fcn.00564968
add esp, 0xc
jmp 0x562d26
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.00564a6a
jmp 0x562cf6
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.005649ff
jmp 0x562cf6
push 0x5bd104
mov ecx, dword [ebp + 8]
call fcn.004059c0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4
push 8
pop ecx
mov esi, 0x5b3540
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
call fcn.00531469
int3

Function at 0x562d69
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x562d85
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x562d7c
sub esi, ecx
mov eax, accept
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.00538e7d
mov edi, eax
pop ecx
test edi, edi
je 0x562dba
push esi
push dword [ebp + 8]
push edi
call fcn.0052e100
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
push 9
pop ecx
mov esi, str.Failed_to_allocate_string_value_buffer
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00531469
int3
Function at 0x56d1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
call fcn.00534ef2
mov ecx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
xorps xmm1, xmm1
movsd qword [ebp - 0x20], xmm1
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov al, byte [eax]
mov dword [esi], ecx
mov byte [ebp - 1], al
movzx eax, byte [ecx]
test byte [eax + 0x5b6201], 8
je 0x56d21b
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x5b6201], 8
jne 0x56d20b
mov dword [ebp + 8], ecx
lea eax, [ebp + 8]
push eax
call fcn.0056c860
mov esi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x30
jne 0x56d358
mov cl, byte [esi + 1]
cmp cl, 0x78
je 0x56d245
cmp cl, 0x58
jne 0x56d358
mov al, byte [ebp - 1]
add esi, 2
mov cl, byte [esi]
cmp cl, al
jne 0x56d260
cmp dword [ebp - 0xc], 0
jne 0x56d2be
mov dword [ebp - 0xc], 1
jmp 0x56d2bb
movzx eax, cl
test byte [eax + 0x5b6201], 0x10
je 0x56d2be
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x56d27d
cmp cl, 0x30
jne 0x56d27d
inc dword [ebp - 0x14]
jmp 0x56d2b1
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x56d2b0
movsx eax, cl
push eax
call fcn.0056cdcb
movsd xmm1, qword [ebp - 0x20]
mulsd xmm1, qword [0x5b43d8]
pop ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
jmp 0x56d2b1
inc edi
cmp dword [ebp - 0xc], 0
mov al, byte [ebp - 1]
je 0x56d2bb
dec edi
inc esi
jmp 0x56d24b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], edi
push 0
pop edi
add eax, ecx
je 0x56d358
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov cl, byte [esi]
shl eax, 2
cmp cl, 0x70
je 0x56d2e9
cmp cl, 0x50
jne 0x56d339
lea eax, [ebp + 8]
inc esi
push eax
mov dword [ebp + 8], esi
call fcn.0056c860
mov edx, dword [ebp + 8]
mov esi, eax
pop ecx
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x5b6201], 2
je 0x56d358
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x5b6201], 2
mov al, byte [edx]
jne 0x56d30a
test esi, esi
je 0x56d32a
neg edi
mov ecx, dword [ebp - 8]
mov eax, ecx
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, edi
mov dword [esi], edx
cmp dword [ebp - 0x18], 0
je 0x56d346
xorps xmm1, xmmword [0x5c4410]
push eax
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.00538c4c
add esp, 0xc
jmp 0x56d35a
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x573148
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004a1290
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.00565763
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.0057ef43
pop ecx
pop ecx
test esi, esi
jne 0x5731be
push 1
push ebx
push edi
call fcn.005737d2
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.0053581f
pop ecx
test eax, eax
je 0x57331a
push 0
push 0
push edi
call fcn.00566dc3
jmp 0x573315
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.00566c35
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x57319b
push esi
push edi
call fcn.00566519
pop ecx
pop ecx
cmp eax, 3
jne 0x57328b
push esi
push edi
call fcn.00566ac2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x57323b
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.00535c70
mov esi, eax
push ebx
push esi
call fcn.005363c9
push 0x5bd104
push edi
call fcn.00565c29
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x573283
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.00566a16
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.0056734c
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.005367d1
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.005673cb
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x5732ef
push 0
push esi
push edi
call fcn.00566b22
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x57329d
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x5732dc
sub eax, 0x15
je 0x5732c9
sub eax, 0xb
je 0x5732c5
dec eax
sub eax, 1
jne 0x573309
push dword [ebp - 0x1018]
push edi
call fcn.005738e7
pop ecx
pop ecx
jmp 0x5732ed
push 1
jmp 0x5732de
push dword [ebp - 0x1018]
push edi
call fcn.0057375e
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x5732ef
push 0
push dword [ebp - 0x1018]
push edi
call fcn.005737d2
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x5731e2
jmp 0x57319b
push str.invalid_format
push esi
push edi
call fcn.00566939
add esp, 0xc
jmp 0x573334
test ebx, ebx
jne 0x57332f
push 0xfffffffffffffffe
push edi
call fcn.005661e4
push edi
call fcn.00565bf7
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x573345
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.00565763
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x57340b
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.00566519
pop ecx
pop ecx
cmp eax, 3
jne 0x5733de
push edi
push ebx
call fcn.0056581e
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x5733a0
call fcn.00566370
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.00564915
add esp, 0x1c
jmp 0x5733bb
call fcn.00566439
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.00564915
add esp, 0x10
test esi, esi
je 0x5733c3
test eax, eax
jg 0x573406
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x573364
test esi, esi
jne 0x57340b
push esi
push esi
push ebx
call fcn.00566dc3
add esp, 0xc
jmp 0x57340e
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.00566b22
add esp, 0xc
test esi, esi
je 0x5733c3
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0053606b
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x5733c3
xor esi, esi
inc esi
jmp 0x5733c5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57375e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a1290
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.00566a16
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0056734c
push esi
push edi
push 1
push eax
call fcn.005367d1
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x573791
lea eax, [ebp - 0x1014]
push eax
call fcn.005673cb
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x57d561
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5fa228], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x5fa218
jne 0x57d5eb
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0052eb40
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x444]
call fcn.00405800
push eax
mov ecx, edi
call fcn.004057b0
push 0
push 1
lea ecx, [ebp - 0x444]
call fcn.004060d0
push ebx
lea ecx, [ebp - 0x42c]
call fcn.00405880
cmp dword [0x5fa22c], 8
lea ecx, [ebp - 0x444]
cmovae edi, dword [0x5fa218]
push edi
call fcn.00405800
push str._install_path_
lea ecx, [ebp - 0x45c]
call fcn.00405800
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.0057d4ac
add esp, 0xc
lea ecx, [ebp - 0x45c]
xor ebx, ebx
push ebx
push 1
call fcn.004060d0
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.004060d0
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0052eb40
add esp, 0xc
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.00405800
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x45d], 0x5c
mov byte [ebp - 0x45e], 0x2f
jb 0x57d6be
mov ecx, dword [esi]
jmp 0x57d6c0
mov ecx, esi
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
jb 0x57d6d0
mov ecx, dword [esi]
jmp 0x57d6d2
mov ecx, esi
lea edx, [ebp - 0x45d]
push edx
lea edx, [ebp - 0x45e]
push edx
push eax
push ecx
call fcn.0051f3e4
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ebx
push 1
call fcn.004060d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x57d70b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x22c
push 0
push eax
call fcn.0052eb40
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x57d7aa
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x57d79f
cmp dword [edi + 0x14], 8
jb 0x57d770
mov eax, dword [edi]
jmp 0x57d772
mov eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x57d792
lea eax, [ebp - 0x228]
mov ecx, ebx
push eax
call fcn.0057e12b
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x57d766
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a04e0
mov esp, ebp
pop ebp
ret

Function at 0x57d7bb
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5d4074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.0052eb40
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x57d7fe
xor al, al
jmp 0x57d86d
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x57d860
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405800
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041acf0
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00425400
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00406580
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.004060d0
lea eax, [ebp - 0x260]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x57d817
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a04e0
mov esp, ebp
pop ebp
ret
Function at 0x57e932
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push ecx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x57e9a7
push esi
push edi
call fcn.004a0767
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x57e99f
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5beba4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x57e99f
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.004a0532
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57e9ad
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x57e9cf
cmp word [ebp - 0x24], 6
je 0x57e9cf
xor al, al
jmp 0x57e9d1
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x183a100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd85000]
push edi
jmp 0x183a11a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x183a121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183a110
mov eax, 1
add ebx, ebx
jne 0x183a133
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x183a144
jne 0x183a163
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183a163
dec eax
add ebx, ebx
jne 0x183a150
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x183a128
add ebx, ebx
jne 0x183a15f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x183a1b5
xor ecx, ecx
sub eax, 3
jb 0x183a17b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x183a1ea
sar eax, 1
mov ebp, eax
jmp 0x183a186
add ebx, ebx
jne 0x183a186
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183a154
inc ecx
add ebx, ebx
jne 0x183a194
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183a154
add ebx, ebx
jne 0x183a1a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x183a196
jne 0x183a1b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x183a196
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x183a1d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x183a1c6
jmp 0x183a116
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x183a1d4
add edi, ecx
jmp 0x183a116
pop esi
mov edi, esi
mov ecx, 0x332
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x183a1f2
cmp byte [edi], 2
jne 0x183a1f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x183a1f7
lea edi, [esi + 0x1438000]
mov eax, dword [edi]
or eax, eax
je 0x183a266
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14407ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1440824]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x183a224
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1440828]
or eax, eax
je 0x183a260
mov dword [ebx], eax
add ebx, 4
jmp 0x183a241
call dword [esi + 0x1440838]
mov ebp, dword [esi + 0x144082c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x183a29a
sub esp, 0xffffff80
jmp 0x4060f7
Function at 0x46c209
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52166c]
cmp eax, 0xffffffff
jne 0x46c315
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa2cec0
call sub.msvcrt.dll_memset
mov dword [0xa2cec0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa2cf04
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa2cf04
mov dword [esp + 0x20], 0xa2cec0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x46c30b
mov eax, dword [0xa2cf04]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cf04]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa2cf08]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x52166c], 1
jmp 0x46c315
mov dword [0x52166c], 0
mov eax, dword [0x52166c]
leave
ret