joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3818
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x5924f3], 0
push 0x4c38f0
call sub.KERNEL32.DLL_GetModuleHandleW
mov ebx, eax
push 0x4c390c
push ebx
call fcn.00408f68
test eax, eax
je 0x4c38a4
lea edx, [esp + 4]
push edx
call eax
push 0x4c3934
push ebx
call fcn.00408f68
mov esi, eax
test esi, esi
je 0x4c38ae
push esp
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4c38ae
cmp dword [esp], 0
je 0x4c38ae
call fcn.004bf208
test al, al
je 0x4c38ae
push 0x4c3954
push ebx
call fcn.00408f68
test eax, eax
je 0x4c38ae
push 0x4c3988
push 0x4c39a8
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00408f68
test eax, eax
je 0x4c38ae
mov byte [0x5924f3], 1
jmp 0x4c38ae
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4c38c7
sub ax, 5
je 0x4c38d0
sub ax, 3
je 0x4c38d9
jmp 0x4c38e2
mov byte [0x58a7b4], 1
jmp 0x4c38e9
mov byte [0x58a7b4], 3
jmp 0x4c38e9
mov byte [0x58a7b4], 2
jmp 0x4c38e9
mov byte [0x58a7b4], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4c39c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4c3a34
mov edx, 0x80000002
xor eax, eax
call fcn.004be87c
test eax, eax
jne 0x4c3a2d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4c3a88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4c3a24
cmp dword [ebp - 0xc], 4
jne 0x4c3a24
cmp dword [ebp - 8], 4
jne 0x4c3a24
movzx eax, word [ebp - 0x10]
mov word [0x5924ec], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x4c3c30
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4c3cdf
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x5924e8], eax
cmp byte [0x5924f2], 0
je 0x4c3cdf
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4c3cd0
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4c3cdf
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x5924ec], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x5924ee], al
movzx eax, word [esp + 0x22c]
mov word [0x5924f0], ax
jmp 0x4c3cdf
cmp eax, 4
jne 0x4c3cdf
call fcn.004c39c4
call fcn.004c3aa0
add esp, 0x230
ret

Function at 0x4c5198
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.0041a634
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
add esp, 0x210
pop ebx
ret
Function at 0x4c51d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
test eax, eax
je 0x4c5204
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040601c
jmp 0x4c5210
mov edx, ebx
mov eax, 0x25
call fcn.004c5198
add esp, 0x20c
pop ebx
ret

Function at 0x4c5218
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
test eax, eax
je 0x4c5244
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040601c
jmp 0x4c5250
mov edx, ebx
mov eax, 0x24
call fcn.004c5198
add esp, 0x20c
pop ebx
ret
Function at 0x4c67d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4c67d8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4c68a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, 0x4c68bc
call fcn.004bad48
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00433bc0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00406098
mov eax, dword [ebp - 0x20]
push eax
push 0x4c68f8
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.0042e80c
add esp, 0x10
push 3
push 0x4c6908
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0042e80c
add esp, 0xc
lea eax, [ebp - 0x30]
call fcn.0042fe90
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
push 0x4c6910
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.0042e80c
add esp, 0x10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c68a9
lea eax, [ebp - 0x30]
call fcn.0042e804
lea eax, [ebp - 0x20]
call fcn.00405afc
lea eax, [ebp - 0x1c]
call fcn.0040809c
lea eax, [ebp - 0x18]
call fcn.0042e804
lea eax, [ebp - 4]
call fcn.00405dfc
ret

Function at 0x4c691c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4c6a64
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4c6a80
call fcn.004068e0
test eax, eax
jg 0x4c6965
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6a94
call fcn.004062f0
test bl, bl
je 0x4c6a13
lea eax, [ebp - 8]
call fcn.004c65a4
mov eax, dword [ebp - 8]
call fcn.00419864
test al, al
je 0x4c69c6
push 3
lea eax, [ebp - 0x14]
call fcn.004c65a4
push dword [ebp - 0x14]
push 0x4c6ab0
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004063d4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.00406060
mov eax, dword [ebp - 0xc]
call fcn.004057c0
push eax
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x20
ja 0x4c6a34
xor eax, eax
push ebp
push 0x4c69e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c67d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c6a34
push 3
push 0x4c6ab4
push 0x4c6ab4
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
push 0x4c6ab4
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6a6b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405e04
lea eax, [ebp - 0xc]
call fcn.00404ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret
Function at 0x4c6ab8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4c6b84
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4c6b23
push 5
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x4c6b61
push 0
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6b9c
call fcn.004062f0
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4c6bb8
call fcn.004c074c
jmp 0x4c6b61
push 0x80
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x4c6b61
push 0
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6bdc
call fcn.004062f0
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4c6bb8
call fcn.004c074c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6b8b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405e04
lea eax, [ebp - 4]
call fcn.00405dfc
ret

Function at 0x4c93e0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c93e9
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
mov eax, dword [ebp - 8]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4c9580
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov edx, dword [ebp - 4]
mov eax, 0x4c959c
call fcn.004068e0
test eax, eax
jle 0x4c944e
call fcn.004c8e5c
test al, al
jne 0x4c944e
mov al, 1
call fcn.004c8dd4
call fcn.004c8e5c
test al, al
je 0x4c9550
lea eax, [ebp - 0x1c]
call fcn.004c9048
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.00406060
cmp dword [ebp - 8], 0
jne 0x4c9479
lea eax, [ebp - 8]
mov edx, 0x4c95bc
call fcn.00405e60
mov eax, dword [ebp - 8]
call fcn.004c8fdc
xor eax, eax
push ebp
push 0x4c94c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004b9078
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c94cd
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00406038
mov eax, dword [ebp - 0x20]
call fcn.004c8fdc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9587
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00405e04
lea eax, [ebp - 0xc]
call fcn.00404ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret
Function at 0x4d3390
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004cff90
test al, al
je 0x4d33f0
cmp byte [esi + 0x94], 0
jne 0x4d33f0
cmp byte [esp], 0
je 0x4d33c1
push 0
call fcn.004c8118
push eax
call sub.user32.dll_ShowWindow
mov edx, esi
xor eax, eax
call fcn.004d313c
mov bl, 1
cmp byte [esi + 0x94], 0
jne 0x4d33f0
cmp byte [esi + 0x95], 0
jne 0x4d33f0
mov eax, dword [esi]
call fcn.00419864
test al, al
je 0x4d33f0
mov eax, dword [esi]
call fcn.004c06dc
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x4dc3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4dc440
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4dc45c
call fcn.004062f0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
push 0x4dc478
push 0x4dc494
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc447
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret
Function at 0x4fc064
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405df4
mov esi, 0x59272c
xor eax, eax
push ebp
push 0x4fc2b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_LoadLibraryW
mov dword [esi], eax
cmp dword [esi], 0
je 0x4fc297
push 0x4fc2c4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592730], eax
cmp dword [0x592730], 0
jne 0x4fc0d1
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_FreeLibrary
jmp 0x4fc297
push 0x4fc2d4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592734], eax
push 0x4fc2e8
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592738], eax
push 0x4fc304
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x59273c], eax
push 0x4fc320
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592740], eax
push 0x4fc33c
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592744], eax
push 0x4fc354
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592748], eax
push 0x4fc378
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x59274c], eax
push 0x4fc39c
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592750], eax
push 0x4fc3c4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592754], eax
push 0x4fc3e4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592758], eax
push 0x4fc408
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x59275c], eax
push 0x4fc438
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592760], eax
push 0x4fc450
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592764], eax
push 0x4fc470
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592768], eax
push 0x4fc4a4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x59276c], eax
push 0x4fc4cc
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592770], eax
push 0x4fc4f4
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592774], eax
push 0x4fc524
mov eax, dword [esi]
push eax
call fcn.00408f68
mov dword [0x592778], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00419d6c
lea eax, [ebp - 8]
mov edx, 0x4fc564
call fcn.00406230
mov eax, dword [ebp - 8]
call fcn.00419864
test al, al
je 0x4fc28b
xor eax, eax
push ebp
push 0x4fc281
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x4fc59c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00419d6c
push dword [ebp - 0x10]
push 0x4fc5ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004063d4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fc28b
call dword [0x592730]
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc2b9
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405e04
ret
Function at 0x4ffcf4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4ffd22
mov eax, ebx
call fcn.005007a8
cmp dword [ebx + 0x40], 0
je 0x4ffd1b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4ffd93
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4ffd85
cmp dword [ebx + 8], 0
je 0x4ffd44
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4ffd56
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4ffd85
cmp dword [ebx + 8], 0
je 0x4ffd37
cmp eax, 3
je 0x4ffd69
dec eax
jne 0x4ffd37
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4ffd37
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4ffd37
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4ffdb1
cmp dword [ebx + 0x14], 0xcc
je 0x4ffdb1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004ffdbc
pop ebx
ret

Function at 0x511690
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x592788
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5116b2
shr eax, 1
xor eax, 0xedb88320
jmp 0x5116b4
shr eax, 1
dec edx
jne 0x5116a0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x511699
mov byte [0x592b88], 1
pop esi
pop ebx
ret

Function at 0x5116d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x592b88], 0
jne 0x5116e7
call fcn.00511690
mov eax, edi
dec eax
test eax, eax
jl 0x51170f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x592788]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5116f1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x51445c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5144f6.0
jmp dword [ecx*4 + 0x51448f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5144c1
sub dl, 8
je 0x5144d0
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x514104
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x51415c
jmp case.0x5144f6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5144f6.0
movzx ecx, byte [ecx + 0x5144fd]
jmp dword [ecx*4 + 0x51450e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x514208
jmp case.0x5144f6.0
cmp dl, 3
jne 0x51453b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x514260
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x51421c
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5142a4
jmp case.0x5144f6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x514566
sub dl, 8
je 0x514572
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5142d0
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x51433c
jmp case.0x5144f6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x514591
sub dl, 8
je 0x51459d
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5143f8
jmp case.0x5144f6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x514420
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x51463f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00513608
test eax, eax
je 0x51463f
mov eax, ebx
call fcn.00514648
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5145d8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x514648
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x514679
dec al
je 0x5146b4
dec al
je 0x5146f9
dec al
je 0x514762
jmp 0x5147ec
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5147ec
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x514689
jmp 0x5147ec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5147ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5146c4
jmp 0x5147ec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5147ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x514728
xor ebp, ebp
jmp 0x514738
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x514741
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x514709
jmp 0x5147ec
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5147ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5147bb
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00511718
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x514776
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51a18c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x51a1dd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x51a1c4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x51a1b4
jmp 0x51a1dd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x51a1c5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x530d94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dl, 1
mov eax, dword [0x4b7c48]
call fcn.004b7d7c
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0xc]
mov dword [esi + 0x378], ebx
xor eax, eax
push ebp
push 0x530eb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x30], 0x531470
mov ecx, dword [0x58bb34]
mov ecx, dword [ecx]
mov edx, dword [0x58bc1c]
mov edx, dword [edx + 0xc]
mov eax, dword [ebp + 8]
mov eax, ebx
call fcn.004b8c84
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530ebe
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0xc]
cmp byte [ebx + 0x37c], 0
je 0x530e2b
mov eax, dword [ebp + 8]
mov eax, ebx
mov ecx, 0xfffffffd
mov edx, 0x530ed0
mov ebx, dword [eax]
call dword [ebx + 0x12c]
jmp 0x530e9f
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x530e3c
je 0x530e4b
sub eax, 2
je 0x530e64
jmp 0x530e88
mov eax, dword [ebp + 8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x128]
jmp 0x530e9f
mov eax, dword [ebp + 8]
mov eax, ebx
mov ecx, 0xfffffffd
mov edx, 0x530ed0
mov ebx, dword [eax]
call dword [ebx + 0x12c]
jmp 0x530e9f
mov eax, dword [ebp + 8]
mov eax, dword [ebx + 0x378]
call fcn.004b7ea8
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, ebx
mov edx, 0x530ee8
mov ebx, dword [eax]
call dword [ebx + 0x12c]
jmp 0x530e9f
mov eax, dword [ebp + 8]
mov eax, ebx
mov ecx, 0xfffffffc
mov edx, 0x530f00
mov ebx, dword [eax]
call dword [ebx + 0x12c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x378]
call fcn.00403dd4
ret