joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca6cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4ca76e
cmp dword [ebx + 0x90], 0
jne 0x4ca768
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4ca644
call fcn.00409e80
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x4ca768
push 3
mov eax, dword [esp + 4]
push eax
call fcn.0040a010
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.0040a020
test al, 8
je 0x4ca72e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ca768
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00471a50
push eax
call fcn.0040a2c0
dec esi
cmp esi, 0xffffffff
jne 0x4ca73d
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ca98c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x55735c]
cmp dword [eax + 0x170], 0
je 0x4caaf1
test bl, bl
jne 0x4caa3f
cmp dword [esi + 0x98], 0
jne 0x4caa34
mov eax, esi
call fcn.004cd4dc
push eax
push 0x4ca898
call fcn.00409e80
cmp dword [esi + 0x40], 0
je 0x4caa05
mov eax, dword [0x55735c]
cmp byte [eax + 0xcf], 0
je 0x4caa05
mov eax, dword [esi + 0xd4]
call fcn.00407c58
mov edi, eax
cmp edi, 0
jl 0x4caa05
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call fcn.0040a2f0
dec edi
cmp edi, 0xffffffff
jne 0x4ca9ee
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4caa34
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00471a50
push eax
call fcn.0040a2e0
dec edi
cmp edi, 0xffffffff
jne 0x4caa14
inc dword [esi + 0x98]
jmp 0x4caaf1
cmp dword [esi + 0x98], 0
jle 0x4caaf1
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x4caaf1
cmp dword [esi + 0x40], 0
je 0x4caa9c
mov eax, dword [0x55735c]
cmp byte [eax + 0xcf], 0
je 0x4caa9c
mov eax, dword [esi + 0xd4]
call fcn.00407c58
mov edi, eax
cmp edi, 0
jl 0x4caa9c
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call fcn.0040a2f0
dec edi
cmp edi, 0xffffffff
jne 0x4caa85
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4caacb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00471a50
push eax
call fcn.0040a2e0
dec edi
cmp edi, 0xffffffff
jne 0x4caaab
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x4c02a4]
call fcn.00407e18
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4cb6ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x4cb717
cmp byte [ebx + 0xcf], 0
jne 0x4cb717
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call fcn.0040a048
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004067cc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4cb704
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4cb724
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406690
jmp 0x4cb724
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406690
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ccc9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x4ccd0a
mov eax, esi
call fcn.004b3674
test al, al
je 0x4ccd0a
mov eax, dword [ebx + 0x80]
call fcn.004b32c8
push eax
call fcn.0040a0d8
test eax, eax
je 0x4ccd0a
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4cccfe
push 0
mov eax, dword [ebx + 0x80]
call fcn.004b32c8
push eax
call fcn.0040a2f0
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.004aa8f8
jmp 0x4ccd0a
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.004ccae8
pop esi
pop ebx
ret

Function at 0x4cdbc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.00406690
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042f910
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4cdc0c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call fcn.00409718
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406890
add esp, 0x200
pop ebx
ret

Function at 0x4cdc3c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call fcn.00409738
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406890
add esp, 0x200
pop ebx
ret

Function at 0x4cdc68
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call fcn.00409798
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406890
add esp, 0x200
pop ebx
ret
Function at 0x4ce004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ce0bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042f910
lea eax, [ebx + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406890
push 0
push 0x1a
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042f910
lea eax, [ebx + 4]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406890
lea edx, [ebp - 0x214]
xor eax, eax
call fcn.004034ac
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0045db04
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0xc]
call fcn.00406690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce0c6
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00406688
ret

Function at 0x4f8adc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4f8b36
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004f8ad0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004e99bc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004e9520
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8b3d
lea eax, [ebp - 4]
call fcn.00406680
ret
Function at 0x50c4c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x50c4cc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50c73a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.0042f694
xor ecx, ecx
mov dl, 1
mov eax, dword [0x46fb50]
call fcn.004757d0
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5085a4]
call fcn.004d38c8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0050af0c
add eax, 0x40
mov edx, 0x50c754
call fcn.00406690
mov dl, 1
mov eax, dword [0x46f6e0]
call fcn.00474dfc
mov dword [ebp - 0x10], eax
push 0x50c7a4
mov eax, dword [ebp - 8]
push dword [eax + 0x40]
push 0x50c7c8
mov eax, dword [ebp - 8]
push dword [eax + 0x44]
push 0x50c7e4
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0x50c810
mov eax, dword [ebp - 8]
push dword [eax + 0x50]
push 0x50c840
mov eax, dword [ebp - 8]
push dword [eax + 0x54]
push 0x50c85c
mov eax, dword [ebp - 8]
push dword [eax + 0x58]
push 0x50c878
mov eax, dword [ebp - 8]
push dword [eax + 0x60]
lea eax, [ebp - 0x18]
mov edx, 0xe
call fcn.00406b34
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 4]
xor edx, edx
call fcn.004066e4
xor eax, eax
push ebp
push 0x50c61d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x50c60c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x64]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0050908c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
call fcn.004758f8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x50c898
call fcn.00406a64
mov eax, dword [ebp - 0x1c]
call fcn.0040671c
push eax
call fcn.004098a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c613
ret
Function at 0x50d3c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x42f440]
call fcn.00407048
xor eax, eax
push ebp
push 0x50d581
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54eb70], 0
jne 0x50d414
mov ecx, dword [0x54f8dc]
mov dl, 1
mov eax, dword [0x45abc8]
call fcn.00462960
call fcn.00405030
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b20
mov eax, ebx
call fcn.004064c0
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x50d590
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00408714
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x50d45b
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x50d527
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004095a4
test eax, eax
je 0x50d513
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.00406890
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004068f8
mov eax, dword [ebp - 4]
test eax, eax
je 0x50d4b6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x50d4b6
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004059f8
mov ebx, eax
test ebx, ebx
je 0x50d4c1
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x50d4de
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x50d4de
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004059f8
mov edi, eax
test edi, edi
je 0x50d4e9
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.0040671c
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040671c
push eax
push 1
push 0x400
call fcn.004093ac
sub eax, 2
test eax, eax
sete al
jmp 0x50d515
xor eax, eax
test al, al
je 0x50d520
mov ebx, 0x15
jmp 0x50d52c
mov ebx, 0x10
jmp 0x50d52c
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x54eb70]
call fcn.0050d22c
mov eax, dword [ebp - 0xc]
call fcn.0050d22c
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.0040872c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d588
lea eax, [ebp - 0x14]
mov edx, dword [0x42f440]
call fcn.00407120
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406688
ret
Function at 0x5187d8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x518806
mov eax, ebx
call fcn.0051928c
cmp dword [ebx + 0x40], 0
je 0x5187ff
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x518877
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x518869
cmp dword [ebx + 8], 0
je 0x518828
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51883a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x518869
cmp dword [ebx + 8], 0
je 0x51881b
cmp eax, 3
je 0x51884d
dec eax
jne 0x51881b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51881b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51881b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x518895
cmp dword [ebx + 0x14], 0xcc
je 0x518895
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005188a0
pop ebx
ret
Function at 0x52cd6c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x558154
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x52cd8e
shr eax, 1
xor eax, 0xedb88320
jmp 0x52cd90
shr eax, 1
dec edx
jne 0x52cd7c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x52cd75
mov byte [0x558554], 1
pop esi
pop ebx
ret

Function at 0x52cdac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x558554], 0
jne 0x52cdc3
call fcn.0052cd6c
mov eax, edi
dec eax
test eax, eax
jl 0x52cdeb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x558154]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x52cdcd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x52fba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x52fc3a.0
jmp dword [ecx*4 + 0x52fbd3]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52fc05
sub dl, 8
je 0x52fc14
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f86c
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f8c0
jmp case.0x52fc3a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x52fc3a.0
movzx ecx, byte [ecx + 0x52fc41]
jmp dword [ecx*4 + 0x52fc52]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f960
jmp case.0x52fc3a.0
cmp dl, 3
jne 0x52fc7f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f9b8
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f974
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52f9fc
jmp case.0x52fc3a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52fcaa
sub dl, 8
je 0x52fcb6
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52fa28
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52fa8c
jmp case.0x52fc3a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52fcd5
sub dl, 8
je 0x52fce1
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52fb3c
jmp case.0x52fc3a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52fb64
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x52fd83
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0052eda8
test eax, eax
je 0x52fd83
mov eax, ebx
call fcn.0052fd8c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x52fd1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52fd8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x52fdbd
dec al
je 0x52fdf8
dec al
je 0x52fe3d
dec al
je 0x52fea6
jmp 0x52ff30
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x52ff30
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52fdcd
jmp 0x52ff30
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52ff30
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52fe08
jmp 0x52ff30
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52ff30
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x52fe6c
xor ebp, ebp
jmp 0x52fe7c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x52fe85
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52fe4d
jmp 0x52ff30
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52ff30
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x52feff
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0052cdf4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52feba
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53e700
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406678
xor eax, eax
push ebp
push 0x53e878
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045d6f8
test al, al
jne 0x53e73c
mov word [ebp - 6], 0
jmp 0x53e862
xor eax, eax
push ebp
push 0x53e85b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x53e835
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x46f914]
call fcn.00475310
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x53e781
cmp eax, 0x1000
jae 0x53e79b
jmp 0x53e783
jge 0x53e79b
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00405124
jmp 0x53e862
lea edx, [ebp - 0x4c]
mov ecx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.00475088
cmp word [ebp - 0x4c], 0x5a4d
je 0x53e7cb
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00405124
jmp 0x53e862
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x144]
mov ecx, 0xf8
mov eax, dword [ebp - 0xc]
call fcn.00475088
cmp dword [ebp - 0x144], 0x4550
je 0x53e80c
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00405124
jmp 0x53e862
movzx eax, word [ebp - 0x12e]
and ax, 0x2000
cmp ax, 0x2000
jne 0x53e825
mov word [ebp - 6], 2
jmp 0x53e82b
mov word [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53e845
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e862
mov eax, dword [ebp - 0xc]
call fcn.00404578
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e87f
lea eax, [ebp - 4]
call fcn.00406680
ret
Function at 0x53f620
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x53f6e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x53f6fc
mov edx, dword [ebx + 0x4a0]
call fcn.00406a64
mov eax, dword [ebp - 4]
call fcn.0045d6f8
test al, al
jne 0x53f686
push 0x53f720
push dword [ebx + 0x4a0]
push 0x53f6fc
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406b34
mov eax, dword [ebp - 8]
call fcn.0040671c
push eax
call fcn.004098a0
jmp 0x53f6c9
mov eax, ebx
call fcn.00540098
test al, al
jne 0x53f6c9
push 0
push 0
mov eax, dword [ebx + 0x460]
call fcn.0040671c
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x53f6fc
mov edx, dword [ebx + 0x4a0]
call fcn.00406a64
mov eax, dword [ebp - 0xc]
call fcn.0040671c
push eax
push 0x53f754
push 0
call fcn.0042f428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53f6eb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406688
ret

Function at 0x53fad4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call fcn.00409758
sub eax, dword [esi]
cmp eax, 0x7530
jb 0x53faf1
mov bl, 1
call fcn.00409758
mov dword [esi], eax
jmp 0x53faf3
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x540034
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov eax, edi
call fcn.0040671c
mov esi, eax
push esi
call fcn.004095ec
cmp eax, 3
jne 0x54008c
push esi
call fcn.004095fc
cmp eax, 1
je 0x54008c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [0x54fc40]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jne 0x540088
cmp eax, dword [ebp + 8]
jae 0x54008c
jmp 0x54008a
jge 0x54008c
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8