joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x496538
mov dword [ebp - 8], 1
jmp 0x49653f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x496545
cmp dword [ebp - 0x14], 0
jne 0x496559
push 0x80004005
call fcn.0047ba00
xor edx, edx
jne 0x496529
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4966a0
cmp dword [ebp + 8], 0
je 0x4966a0
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x49668f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x496675
cmp dword [ebp - 4], 2
jbe 0x4965c6
cmp dword [ebp - 4], 7
je 0x49660b
jmp 0x496675
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4965eb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x496606
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x4966a3
jmp 0x49668d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x49665b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x49665b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x49665b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x496673
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x496673
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax], cx
mov eax, 0xd
jmp 0x4966a3
jmp 0x49668d
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x4966a3
jmp 0x4966a0
mov ecx, 2
imul edx, ecx, 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + edx], ax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4974e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555358
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5ac7dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0047ad50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004994a0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4977a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ecx + 8]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.00499620
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5409
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4a542d
cmp dword [esi + 8], edi
jge 0x4a5425
push esi
call fcn.004a1f8c
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4a5456
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4a5439
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4a5470
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4a5461
xor dl, dl
jmp 0x4a5466
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4a5458
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4a54a4
mov dword [0x5b4400], str.zlib_corrupt
xor eax, eax
jmp 0x4a54e6
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4a54b9
mov dword [0x5b4400], str.read_past_buffer
jmp 0x4a54a0
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4a54d0
push edi
push esi
call fcn.004a7d6a
pop ecx
pop ecx
test eax, eax
je 0x4a54a0
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004d2440
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4b25d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x514661
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00514266

Function at 0x51466c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005143e7

Function at 0x51a748
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051a4cf

Function at 0x51c696
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051be7a

Function at 0x51c6a1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051c0b5

Function at 0x526e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + 0xc]
call fcn.0052c265
lea edx, [eax - 1]
cmp edx, 4
ja 0x526fc4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 1
jle 0x526f60
push edi
lea ecx, [ebp + 0xc]
call fcn.005292c2
push eax
push ebx
call fcn.0052706c
add esp, 0xc
lea ecx, [ebp + 0xc]
push edi
call fcn.0052c28b
push eax
push ebx
call fcn.0052706c
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp + 0xc]
push eax
call fcn.00527692
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call fcn.005263e4
test al, al
je 0x526f54
and dword [ebp - 8], 0
mov esi, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x14]
call fcn.005292af
push eax
push ebx
call fcn.0052706c
add esp, 0xc
lea ecx, [ebp - 0x14]
push edi
call fcn.0052c278
push eax
push ebx
call fcn.0052706c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov esi, dword [esi + 0x14]
add esp, 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], esi
push eax
call fcn.005263e4
test al, al
jne 0x526f12
push edi
push 0
push ebx
call fcn.0052706c
add esp, 0xc
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x526f6c
mov esi, dword [esi + 0x10]
jmp 0x526fa5
xor esi, esi
jmp 0x526fa5
lea ecx, [ebp - 4]
call fcn.0052c265
push edi
push 1
mov byte [ebp + 0x13], al
lea eax, [ebp + 0x13]
push 1
push eax
call fcn.00503573
mov ecx, dword [ebp - 0xc]
add esp, 0x10
push edi
push esi
push ebx
call fcn.00526e90
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.00529368
mov esi, dword [eax]
mov dword [ebp - 4], esi
test esi, esi
jne 0x526f70
push edi
push 1
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push 1
push eax
call fcn.00503573
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x526fca
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x55795a
call fcn.004ae565
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x50]
push 0xa
sub esp, 0xc
mov dword [esp + 8], 0x40100000
mov dword [esp + 4], 0x3e800000
mov dword [esp], 0x3f400000
push 0x11
call fcn.00525fac
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push eax
push dword [edi]
mov ecx, edi
call fcn.00526be1
lea eax, [ebp - 0x50]
push eax
call fcn.00526d34
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push esi
inc ebx
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x6c6d7873
push ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
call fcn.00503573
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.005270da
add esp, 0x1c
lea eax, [ebp - 0x50]
mov ecx, edi
push esi
push dword [edi]
push eax
call fcn.00526e90
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00526a73
call fcn.004ae50f
ret 4

Function at 0x52706c
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x557985
call fcn.004ae531
mov edi, dword [ebp + 8]
push dword [edi + 4]
call fcn.005288fc
and dword [ebp + 8], 0
mov ebx, eax
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00407390
mov esi, dword [ebp - 0x10]
cmp dword [esi - 8], 0
je 0x5270ae
push dword [ebp + 0xc]
mov ecx, edi
call fcn.005268a3
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push ebx
push 1
push eax
call fcn.00503573
add esp, 0x10
and dword [ebp - 4], 0
lea ecx, [esi - 0xc]
cmp ecx, dword [section..data]
je 0x5270d4
call fcn.00401bf0
call fcn.004ae4fa
ret

Function at 0x5270da
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00526804
mov edi, eax
test edi, edi
je 0x527117
push esi
mov ecx, dword [ebp + 0xc]
mov esi, edi
push edi
call fcn.005266dc
push dword [esi]
mov edi, eax
call fcn.004efd63
push dword [ebp + 8]
inc eax
push eax
push 2
push dword [esi]
call fcn.00503573
add esp, 0x14
test edi, edi
jne 0x5270ed
pop esi
pop edi
pop ebp
ret
Function at 0x52918f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x5291b2
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x52924f
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.00528647
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5291d5
push ebx
call fcn.005020e0
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x52922b
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x5ad200]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x529200
call fcn.005020e0
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x52922b
push esi
push 1
push eax
call fcn.005023c4
push ebx
mov esi, eax
call fcn.005020e0
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x529234
push dword [ebp - 4]
call dword [0x5ad204]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x52924e
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00529107
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52d98d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.0053d305
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x52d9ba
xor eax, eax
jmp 0x52dab6
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4d6636
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.0052f44d
push esi
push eax
call fcn.004d6650
add esp, 0x14
test eax, eax
je 0x52d9f5
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0053d4c4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0052f42f
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00531375
add esp, 0x28
test eax, eax
jne 0x52da2c
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x52da6d
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0053d495
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x52da68
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x52da9d
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0053d3d6
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.0053d38e
add esp, 0x14
jmp 0x52d9b3
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.0053d254
push dword [ebp - 4]
call fcn.0052ddb1
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x531012
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x531048
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x53103b
push eax
call fcn.0053d37a
push 2
call fcn.0053d2f1
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004d3150
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x532d39
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.0053d305
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x532d66
xor eax, eax
jmp 0x532f0a
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4d6636
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.0052f44d
push esi
push eax
call fcn.004d6650
add esp, 0x14
test eax, eax
je 0x532db3
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0053d4c4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0052f42f
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00531375
add esp, 0x28
test eax, eax
jne 0x532dea
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x532e26
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0053d495
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x532e26
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x53157a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.005315c9
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x532ea6
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.0054638d
add esp, 0xc
cmp eax, 0xfffffffa
je 0x532e8f
cmp eax, 0xfffffffc
je 0x532e88
cmp eax, 0xfffffffe
je 0x532e81
test eax, eax
je 0x532ea1
push str.Unknown_zlib_error
jmp 0x532e94
push str.zlib_stream_error
jmp 0x532e94
push str.zlib_memory_error
jmp 0x532e94
push str.zlib_version_error
push dword [ebp - 4]
call fcn.0052f469
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x532ed6
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0053d3d6
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.0053d38e
add esp, 0x14
jmp 0x532d5f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.00538e52
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54483b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x5448d7
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004d2440
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x54488c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x5448b3
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x5449fc
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x544904
xor eax, eax
jmp 0x544950
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x544921
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.005484cb
jmp 0x544931
cmp eax, 2
jne 0x54493a
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.0054680b
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.004d2440
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x544978
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x54498d
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x544849
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x5449fc
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x5449cc
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.004d3150
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x5449fc
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x5449fc
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.004d3150
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54680b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x546818
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00546911

Function at 0x401084
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor edi, edi
mov eax, 0x80000000
push edi
push esi
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.entersessioneclass
push 0x402218
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4010ca
push 0
push eax
mov dword [0x402040], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402040]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, 0x3fffff
inc esi
mov dword [0x402ab4], esi
push 0
push 0x401023
push 0
push 0x402138
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop esi
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4f690acc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x185b64b4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x158d69f7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xccb67d7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x412596
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x1711ee8]
test eax, eax
je 0x4125d5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4125d5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4125d5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4125d5
cmp dword [ecx + 0x74], 0xe
jbe 0x4125d5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x415ef7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x1711ee8]
test eax, eax
je 0x415f36
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415f36
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415f36
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415f36
cmp dword [ecx + 0x74], 0xe
jbe 0x415f36
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret