joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec39e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5ac4af
call fcn.00591b5c
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x607098
mov eax, dword [ebp - 0x10]
and byte [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004cde9c
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0x28], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0x34], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0x35], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004f0921
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xa8
call fcn.004cde9c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc4
call fcn.004cde9c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4f1298
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5aca07
call fcn.00591b5c
sub esp, 0x228
mov eax, dword [0x6c0bc0]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x234], ecx
lea eax, [ebp - 0x20c]
push eax
push 0x1f3
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4f12d4
jmp 0x4f1380
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004cd951
lea ecx, [ebp - 0x230]
call fcn.004cde9c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x214]
call fcn.004e456a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x20
call fcn.004ccbf8
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x20
call fcn.0055420c
push eax
lea ecx, [ebp - 0x214]
call fcn.004e4882
push 0x61b5f4
push 0x61b020
lea ecx, [ebp - 0x230]
call fcn.004ce765
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.004cf7bb
push str..tmp
mov ecx, dword [ebp + 8]
call fcn.004cd951
and byte [ebp - 4], 0
lea ecx, [ebp - 0x214]
call fcn.004d61fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004ce1b7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.0058cc82
leave
ret 4
Function at 0x4f4d99
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5acce8
call fcn.00591b5c
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004e80b6
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00526774
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00522b4d
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x607cdc
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0x607cd0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0x607ca4
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004cde9c
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0x50
mov eax, dword [ebp - 0x10]
and byte [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00514d8e
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x120
call fcn.00523dba
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x300
call fcn.004cde9c
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
and dword [eax + 0x31c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x320], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x324], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x328], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0x32c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x330], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x334
call fcn.004d17b0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x34c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x350], 0x1e
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x514bad
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
movzx eax, byte [0x671264]
test eax, eax
je 0x514bd5
push dword [ebp + 8]
call fcn.005148d2
pop ecx
movzx eax, al
test eax, eax
jne 0x514bd5
xor al, al
jmp 0x514c1f
push dword [ebp + 8]
push 1
mov ecx, dword [ebp - 0xc]
call fcn.00516be9
mov byte [ebp - 1], 1
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x4c], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x514c1c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
push dword [ebp + 8]
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00514f71
and byte [ebp - 1], 0
mov al, byte [ebp - 1]
leave
ret 4
Function at 0x51662d
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x120]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x51665f
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
jmp 0x516756
cmp dword [ebp + 8], 0
jne 0x51666c
mov dword [ebp + 8], 0x5460
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x114], 0
and dword [ebp - 0x110], 0
and dword [ebp - 0x11c], 0
jmp 0x516699
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x110]
jae 0x5166c3
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp + eax*4 - 0x10c]
cmp eax, dword [ecx + 0x4c]
jne 0x5166c1
jmp 0x5166c3
jmp 0x51668c
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x110]
jne 0x5166fd
cmp dword [ebp - 0x110], 0x40
jae 0x5166fd
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx + 0x4c]
mov dword [ebp + eax*4 - 0x10c], ecx
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
xor eax, eax
test eax, eax
jne 0x516683
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x51673a
push str.select_returned_a_socket_error
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
jmp 0x516756
cmp dword [ebp - 4], 1
jne 0x516744
mov al, 1
jmp 0x516756
push str.socket_is_not_ready_for_writing.
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
leave
ret 8
Function at 0x51675a
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov dword [ebp - 0x12c], ecx
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x51678c
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
jmp 0x5168b7
cmp dword [ebp + 8], 0
jne 0x516799
mov dword [ebp + 8], 0x1499700
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x3e8
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
imul eax, eax, 0x3e8
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x120], eax
and dword [ebp - 0x118], 0
and dword [ebp - 0x128], 0
jmp 0x5167fa
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x118]
jae 0x516824
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp + eax*4 - 0x114]
cmp eax, dword [ecx + 0x4c]
jne 0x516822
jmp 0x516824
jmp 0x5167ed
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x118]
jne 0x51685e
cmp dword [ebp - 0x118], 0x40
jae 0x51685e
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx + 0x4c]
mov dword [ebp + eax*4 - 0x114], ecx
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
xor eax, eax
test eax, eax
jne 0x5167e4
lea eax, [ebp - 0x124]
push eax
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x51689b
push str.select_returned_a_socket_error
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
jmp 0x5168b7
cmp dword [ebp - 4], 1
jne 0x5168a5
mov al, 1
jmp 0x5168b7
push str.socket_is_not_ready_for_writing
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
leave
ret 8
Function at 0x516d27
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp + 0x10]
and byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x516d74
push 0x78
push 0
mov ecx, dword [ebp + 0xc]
call fcn.004f2178
mov ecx, dword [ebp + 0xc]
call fcn.004f1f9a
movzx eax, al
test eax, eax
je 0x516d74
push str.Wait_for_data_aborted_by_app
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
xor al, al
jmp 0x516f0f
mov eax, dword [ebp - 0x128]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x516d9d
push str.Wait_for_data_passed_invalid_socket.
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
xor al, al
jmp 0x516f0f
cmp dword [ebp + 8], 0
jne 0x516daa
mov dword [ebp + 8], 0x14
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x3e8
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], 0x7a120
jbe 0x516dda
mov dword [ebp + 8], 0x7a120
mov eax, dword [ebp + 8]
imul eax, eax, 0x3e8
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
jne 0x516df9
cmp dword [ebp - 8], 0
jne 0x516df9
mov dword [ebp - 8], 0x3e8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x11c], eax
and dword [ebp - 0x118], 0
and dword [ebp - 0x124], 0
jmp 0x516e28
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x118]
jae 0x516e52
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0x114]
cmp eax, dword [ecx + 0x4c]
jne 0x516e50
jmp 0x516e52
jmp 0x516e1b
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x118]
jne 0x516e8c
cmp dword [ebp - 0x118], 0x40
jae 0x516e8c
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0x4c]
mov dword [ebp + eax*4 - 0x114], ecx
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
xor eax, eax
test eax, eax
jne 0x516e12
lea eax, [ebp - 0x120]
push eax
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x516f03
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
push str.The_peer_has_closed_the_socket__TCP__connection
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
push 2
mov eax, dword [ebp - 0x128]
push dword [eax + 0x4c]
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [ebp - 0x128]
push dword [eax + 0x4c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x128]
or dword [eax + 0x4c], 0xffffffff
mov eax, dword [ebp - 0x128]
and byte [eax + 0x48], 0
xor al, al
jmp 0x516f0f
cmp dword [ebp - 4], 0
jne 0x516f0d
xor al, al
jmp 0x516f0f
mov al, 1
leave
ret 0x14
Function at 0x518f0f
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x604ad8
movzx eax, byte [0x6c4e90]
test eax, eax
jne 0x518fd9
mov dword [ebp - 4], 0x4c11db7
and dword [ebp - 8], 0
jmp 0x518f44
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xff
jg 0x518fd2
push 8
push dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
call fcn.00518fde
shl eax, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x6c4a90], eax
and dword [ebp - 0xc], 0
jmp 0x518f78
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x518faf
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x6c4a90]
shl eax, 1
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx*4 + 0x6c4a90]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x6c4a90], eax
jmp 0x518f71
push 0x20
mov eax, dword [ebp - 8]
push dword [eax*4 + 0x6c4a90]
mov ecx, dword [ebp - 0x10]
call fcn.00518fde
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x6c4a90], eax
jmp 0x518f3d
mov byte [0x6c4e90], 1
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x51d9ce
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5ae4f8
call fcn.00591b5c
sub esp, 0x34
mov dword [ebp - 0x40], ecx
and dword [ebp - 0x1c], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x51da3b
push dword [ebp - 0x14]
call fcn.00565bb9
pop ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x51da96
cmp dword [ebp - 0x10], 0
je 0x51da96
cmp dword [ebp + 0x10], 0
je 0x51da96
lea ecx, [ebp - 0x38]
call fcn.004cde9c
and dword [ebp - 4], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
call fcn.004cfd88
lea ecx, [ebp - 0x38]
call fcn.0055420c
push eax
push str.RegistryQueryError
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
call dword [eax + 0x28]
push dword [ebp + 0xc]
push str.ValueName
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
call dword [eax + 0x28]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004ce1b7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x51dc83
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5aed1c
call fcn.00591b5c
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004e80b6
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x60b67c
mov eax, dword [ebp - 0x10]
mov byte [eax + 8], 0xce
mov eax, dword [ebp - 0x10]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004d8514
mov eax, dword [ebp - 0x10]
and dword [eax + 0x28], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x671270]
mov dword [eax + 0x2c], ecx
mov eax, dword [0x671270]
inc eax
mov dword [0x671270], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x52d339
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5aed1c
call fcn.00591b5c
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004e80b6
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x60d2e8
mov eax, dword [ebp - 0x10]
and dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.005088b2
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00508ed9
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.004cde9c
mov eax, dword [ebp - 0x10]
and dword [eax + 0x7c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x80], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x84], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x88], 0
mov eax, dword [ebp - 0x10]
and word [eax + 0x8c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x90], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x94], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x98], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x9c], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x52d5ce
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5aed1c
call fcn.00591b5c
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004e80b6
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x60d2ec
mov eax, dword [ebp - 0x10]
and byte [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004cde9c
mov eax, dword [ebp - 0x10]
and byte [eax + 0x29], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
and dword [eax + 0x34], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x38], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0x54], 0
push 8
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x44
push eax
call fcn.0058ee10
add esp, 0xc
push 8
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x4c
push eax
call fcn.0058ee10
add esp, 0xc
push 8
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x3c
push eax
call fcn.0058ee10
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x52f8f9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x18]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x52f92f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jae 0x52f976
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x52f956
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x52f974
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x52f974
mov eax, dword [ebp - 8]
jmp 0x52f978
jmp 0x52f91f
xor eax, eax
leave
ret 4
Function at 0x531593
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
and dword [ebp - 8], 0
or dword [ebp - 4], 0xffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x51
call fcn.004d5565
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5315c2
jmp 0x531686
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x2c], 0
je 0x53166e
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x28], 0
je 0x53166e
and dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
mov eax, dword [ebp - 0x14]
push dword [eax + 0x28]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 0x2c]
je 0x53166e
cmp dword [ebp + 0xc], 0
je 0x53165b
push str.Failed_to_write_data_to_file
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
mov ecx, dword [ebp + 8]
call fcn.004d1049
push eax
push str.filename
mov ecx, dword [ebp + 0xc]
call fcn.004e9d1c
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push str.data_size
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x2c]
push dword [ebp - 0xc]
push str.bytes_written
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x2c]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004e81eb
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x531686
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004e81eb
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 1
cmp dword [ebp + 0x10], 0
je 0x5316a5
and byte [ebp - 0xd], 0
lea eax, [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00530b69
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004f24ac
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x533dd2
Capabilities:
Delete file

Disassembly:
mov eax, 0x5ac2de
call fcn.00591b5c
sub esp, 0x28
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
and dword [eax + 0xc0], 0
and byte [ebp - 0xe], 0
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x5a]
test eax, eax
je 0x533e08
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x34], 4
jne 0x533e08
mov byte [ebp - 0xe], 1
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
call fcn.00531ce7
movzx eax, al
test eax, eax
jne 0x533e21
xor al, al
jmp 0x533f95
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
call fcn.005320c0
movzx eax, al
test eax, eax
jne 0x533e3a
xor al, al
jmp 0x533f95
and byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x58]
test eax, eax
je 0x533ed7
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x59]
test eax, eax
je 0x533ed7
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x533ec4
mov ecx, dword [ebp - 0x34]
add ecx, 0x80
call fcn.004d1628
test eax, eax
jbe 0x533e9f
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
call fcn.0053293a
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x533e9f
push str.Failed_to_inflate_WinZip_AES_encrypted_data_to_temp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
xor al, al
jmp 0x533f95
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
add eax, 0xb8
push eax
mov eax, dword [ebp - 0x34]
add eax, 0xb0
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.00533c36
mov byte [ebp - 0xd], al
jmp 0x533ed5
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.00533abb
mov byte [ebp - 0xd], al
jmp 0x533f4c
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x58]
test eax, eax
je 0x533f00
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x59]
test eax, eax
jne 0x533f00
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.00533d19
mov byte [ebp - 0xd], al
jmp 0x533f4c
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x58]
test eax, eax
jne 0x533f3b
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x59]
test eax, eax
je 0x533f3b
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
add eax, 0xb8
push eax
mov eax, dword [ebp - 0x34]
add eax, 0xb0
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.00533c36
mov byte [ebp - 0xd], al
jmp 0x533f4c
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.00533d43
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax + 0x5b]
test eax, eax
je 0x533f92
mov ecx, dword [ebp - 0x34]
add ecx, 0x5c
call fcn.0055420c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x533f92
lea ecx, [ebp - 0x30]
call fcn.004cde9c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004cfd54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004ce1b7
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0xc