joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b5e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x53b5f9
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x53b601
or eax, 0xffffffff
jmp 0x53b6a7
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x30
jl 0x53b626
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x39
jg 0x53b626
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x4c], eax
jmp 0x53b62d
mov dword [ebp - 0x4c], 0xffffffff
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x53b6a4
mov eax, dword [ebp + 8]
push eax
call fcn.0053bce0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x53b6a4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x53b685
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jb 0x53b685
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x53b685
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x53b6a4
cmp dword [ebp - 8], 0
jne 0x53b6a4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2af9
jne 0x53b6a4
mov eax, dword [ebp + 8]
push eax
call fcn.0053bc80
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53c480
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call fcn.00568bc0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x53c4c3
lea edx, [ebp - 4]
push edx
push 0x8004667e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x53c4c3
mov dword [ebp - 0x48], 1
jmp 0x53c4ca
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53c4e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x53c501
push 0
push 1
push 2
call fcn.005399b0
mov dword [ebp - 0x44], eax
jmp 0x53c510
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53cb90
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
call fcn.0051cc60
movzx eax, al
test eax, eax
je 0x53cbbe
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00539c90
mov dword [ebp - 0x44], eax
jmp 0x53cbd3
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53dcc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jle 0x53dcf4
mov eax, dword [ebp + 0x10]
jmp 0x53dd0c
call fcn.0053cb50
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
sub eax, 0x2733
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53dd20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jle 0x53dd54
mov eax, dword [ebp + 0x10]
jmp 0x53dd82
call fcn.0053cb50
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp dword [ebp + 0x10], 0
je 0x53dd78
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0x2733
jne 0x53dd78
mov dword [ebp - 0x44], 0
jmp 0x53dd7f
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53e290
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0051cc60
movzx eax, al
test eax, eax
je 0x53e2af
mov al, 1
jmp 0x53e2ff
mov ecx, dword [ebp - 4]
call fcn.00511460
movzx eax, al
test eax, eax
jne 0x53e2c2
xor al, al
jmp 0x53e2ff
cmp dword [ebp + 8], 0
jle 0x53e2d1
cmp dword [ebp + 8], 0x100000
jle 0x53e2d8
mov dword [ebp + 8], 0x2000
push 4
lea eax, [ebp + 8]
push eax
push 0x1002
push 0xffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xe0]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
add eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x549530
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x549549
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x54954d
xor al, al
jmp 0x5495b4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x549568
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x54956c
xor al, al
jmp 0x5495b4
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x54958b
mov eax, dword [ebp - 4]
and eax, 1
je 0x549580
mov al, 1
jmp 0x5495b4
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
jmp 0x5495a0
mov eax, dword [ebp - 4]
and eax, 1
jne 0x549597
mov al, 1
jmp 0x5495b4
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54f870
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x54f8b1
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x54f8b1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
jmp 0x54f8bf
mov dword [ebp - 0x50], accept
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x551ac0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x99]
test ecx, ecx
je 0x551b55
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.00511010
movzx eax, al
test eax, eax
jne 0x551b55
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.005055f0
push eax
call fcn.005494e0
add esp, 4
movzx eax, al
test eax, eax
je 0x551b55
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.005055f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.005055f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x551b55
mov eax, dword [ebp - 4]
mov byte [eax + 0x99], 0
mov eax, dword [ebp - 4]
add eax, 0x78
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.005121d0
push 0x60ac7e
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.005102e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x557a20
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1294
call fcn.00583150
mov eax, dword [0x636d78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.00582ec0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.ErrCode_:___lu__Host_:___s_
lea edx, [ebp - 0x1004]
push edx
call fcn.0058307d
add esp, 0x10
mov dword [ebp - 0x1250], 0x248
lea eax, [ebp - 0x1250]
push eax
lea ecx, [ebp - 0x124c]
push ecx
call sub.IPHLPAPI.DLL_GetNetworkParams
test eax, eax
jne 0x557b3b
push 0x60ac7e
lea eax, [ebp - 0x113c]
push eax
call fcn.005832b0
add esp, 8
test eax, eax
je 0x557b1e
lea eax, [ebp - 0x113c]
push eax
lea ecx, [ebp - 0x1004]
push ecx
push str._s__DNS_:___s_
lea edx, [ebp - 0x1004]
push edx
call fcn.0058307d
add esp, 0x10
mov eax, dword [ebp - 0x1140]
mov dword [ebp - 0x1254], eax
cmp dword [ebp - 0x1254], 0
je 0x557b1c
mov eax, dword [ebp - 0x1254]
add eax, 4
push eax
lea ecx, [ebp - 0x1004]
push ecx
push 0x606d78
lea edx, [ebp - 0x1004]
push edx
call fcn.0058307d
add esp, 0x10
mov eax, dword [ebp - 0x1254]
mov ecx, dword [eax]
mov dword [ebp - 0x1254], ecx
jmp 0x557ade
jmp 0x557b39
lea eax, [ebp - 0x1004]
push eax
push str._s__no_DNS
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0058307d
add esp, 0xc
jmp 0x557b56
lea eax, [ebp - 0x1004]
push eax
push str._s__no_DNS
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0058307d
add esp, 0xc
push 0
lea eax, [ebp - 0x1004]
push eax
push str.11500106
call fcn.00505040
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005824ce
mov esp, ebp
pop ebp
ret
Function at 0x568cb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae032
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x636d78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00574110
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0052bb70
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0056b850
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00568ee0
push 0x10
call fcn.0044d121
add esp, 4
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x70], 0
je 0x568d36
mov ecx, dword [ebp - 0x70]
call fcn.00508310
mov dword [ebp - 0x78], eax
jmp 0x568d3d
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x74]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00574320
push 0xac
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0056b510
push 0x48
call fcn.0044d121
add esp, 4
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x64], 0
je 0x568d8e
mov ecx, dword [ebp - 0x64]
call fcn.00568e60
mov dword [ebp - 0x78], eax
jmp 0x568d95
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0056b6f0
push 0x68
call fcn.0044d121
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x5c], 0
je 0x568dd8
mov ecx, dword [ebp - 0x5c]
call fcn.00568f10
mov dword [ebp - 0x78], eax
jmp 0x568ddf
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x60]
mov dword [ecx + 0x68], edx
push 0x68
call fcn.0044d121
add esp, 4
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x54], 0
je 0x568e16
mov ecx, dword [ebp - 0x54]
call fcn.00568f10
mov dword [ebp - 0x78], eax
jmp 0x568e1d
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x58]
mov dword [ecx + 0x6c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x70], 0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.0056ae60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57cf70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5824ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x636d78]
jne 0x5824d8
repz ret
jmp fcn.0058ef4c

Function at 0x5846f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x584728
call fcn.00587a10
mov dword [eax], esi
call fcn.005879fd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00584aac
add esp, 0x14
push 0x16
pop eax
jmp 0x58477d
test dword [ebp + 0xc], 0xfffffff9
jne 0x584704
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x584755
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00587a23
pop ecx
call fcn.005879fd
mov eax, dword [eax]
jmp 0x58477d
test al, 0x10
jne 0x58477b
test al, 1
je 0x58477b
test byte [ebp + 0xc], 2
je 0x58477b
call fcn.00587a10
mov dword [eax], 5
call fcn.005879fd
mov dword [eax], 0xd
jmp 0x58474c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x59f05a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0058e893
and dword [ebp - 4], 0
cmp dword [0x63ffb8], 0
mov ebx, eax
jne 0x59f10b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x59f1bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x609b00
push edi
call esi
test eax, eax
je 0x59f1bc
push eax
call fcn.0058e821
mov dword [esp], 0x609af0
push edi
mov dword [0x63ffb8], eax
call esi
push eax
call fcn.0058e821
mov dword [esp], 0x609adc
push edi
mov dword [0x63ffbc], eax
call esi
push eax
call fcn.0058e821
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x63ffc0], eax
call esi
push eax
call fcn.0058e821
pop ecx
mov dword [0x63ffc8], eax
test eax, eax
je 0x59f10b
push 0x609aa8
push edi
call esi
push eax
call fcn.0058e821
pop ecx
mov dword [0x63ffc4], eax
mov eax, dword [0x63ffc4]
cmp eax, ebx
je 0x59f163
cmp dword [0x63ffc8], ebx
je 0x59f163
push eax
call fcn.0058e89c
push dword [0x63ffc8]
mov esi, eax
call fcn.0058e89c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x59f163
test edi, edi
je 0x59f163
call esi
test eax, eax
je 0x59f15a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x59f15a
test byte [ebp - 0xc], 1
jne 0x59f163
or dword [ebp + 0x10], 0x200000
jmp 0x59f19c
mov eax, dword [0x63ffbc]
cmp eax, ebx
je 0x59f19c
push eax
call fcn.0058e89c
pop ecx
test eax, eax
je 0x59f19c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x59f19c
mov eax, dword [0x63ffc0]
cmp eax, ebx
je 0x59f19c
push eax
call fcn.0058e89c
pop ecx
test eax, eax
je 0x59f19c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x63ffb8]
call fcn.0058e89c
pop ecx
test eax, eax
je 0x59f1bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x59f1be
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a40e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5a4119
call fcn.00587a10
mov dword [eax], esi
call fcn.005879fd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00584aac
add esp, 0x14
push 0x16
pop eax
jmp 0x5a416e
test dword [ebp + 0xc], 0xfffffff9
jne 0x5a40f5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a4146
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00587a23
pop ecx
call fcn.005879fd
mov eax, dword [eax]
jmp 0x5a416e
test al, 0x10
jne 0x5a416c
test al, 1
je 0x5a416c
test byte [ebp + 0xc], 2
je 0x5a416c
call fcn.00587a10
mov dword [eax], 5
call fcn.005879fd
mov dword [eax], 0xd
jmp 0x5a413d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a5c20
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x5af15d
call fcn.005877df
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x5a5d32
cmp byte [esi + 0x42], bl
je 0x5a5d32
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x5a5c5c
xor al, al
jmp 0x5a5d34
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0042bff0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cef0
mov ecx, eax
call fcn.00525880
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cef0
mov ecx, eax
call fcn.00525880
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x5a5ccc
dec eax
je 0x5a5cd0
dec eax
dec eax
je 0x5a5d2e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00411690
mov al, bl
jmp 0x5a5d34
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cef0
mov ecx, eax
call fcn.00525880
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x5a5d10
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cef0
mov ecx, eax
call fcn.00525880
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00589a50
add esp, 0x10
cmp edi, eax
jne 0x5a5cba
cmp byte [esi + 0x42], 0
je 0x5a5d2e
test edi, edi
jne 0x5a5c6a
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00423080
jmp 0x5a5c6a
mov bl, 1
jmp 0x5a5cbc
mov al, 1
call fcn.00587862
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10005879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10005888
pop dword [ebp - 0x34]
mov eax, 0x10005888
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xeee0db1b
add dword [ebp - 0x44], 0x5f716a30
mov dword [ebp - 0x40], 0x3ecb1942
add dword [ebp - 0x40], 0xf3683303
mov dword [ebp - 0x3c], 0xfe601acd
sub dword [ebp - 0x3c], 0xb213d69f
mov dword [ebp - 0x38], 0xec455e3d
add dword [ebp - 0x38], 0x13baa1c3
lea eax, [ebp - 0x44]
push eax
mov eax, 0x6ab81c4a
sub eax, 0x5ab4cb32
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9dd9e803
sub dword [ebp - 0x44], 0x29677ead
mov dword [ebp - 0x40], 0x530a97a1
sub dword [ebp - 0x40], 0x119e362c
mov dword [ebp - 0x3c], 0x1576355b
sub dword [ebp - 0x3c], 0xb206c8ef
mov dword [ebp - 0x38], 0x6b2294a8
sub dword [ebp - 0x38], 0x6b2294a8
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x47cb1c0
sub eax, 0xf479605c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38c69
push 0
call eax
mov ecx, 0x3ed4
mov ebx, eax
mov edi, 0xd0fb81f2
sub edi, 0xc0f2fdf2
add edi, dword [ebp - 0x34]
mov edx, 0x123e64e
mov esi, dword [edi]
add dword [ebp - 0x30], 0x4fe20dcc
xor esi, edx
mov dword [ebp - 0x1c], 0x4ff423d9
mov dword [ebx], esi
sub dword [ebp - 8], ecx
add ebx, 0x9795d6ae
sub ebx, 0x9795d6aa
add edi, 0x26dbb307
sub edi, 0x26dbb303
loop 0x10005999
add eax, 0x89b7c273
add eax, 0x76492bb0
xor ebx, ebx
add ebx, eax
add eax, 0x6c129df8
sub eax, 0x6c129df3
mov ecx, 0x25cb5b02
sub ecx, 0x15cb5b02
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10005a23
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x401799
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4130a0]
jne 0x4017a3
repz ret
jmp fcn.004022c8

Function at 0x4086bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040452c
and dword [ebp - 4], 0
cmp dword [0x46b958], 0
mov ebx, eax
jne 0x40876d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40881e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40881e
push eax
call fcn.004044ba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46b958], eax
call esi
push eax
call fcn.004044ba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46b95c], eax
call esi
push eax
call fcn.004044ba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46b960], eax
call esi
push eax
call fcn.004044ba
pop ecx
mov dword [0x46b968], eax
test eax, eax
je 0x40876d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004044ba
pop ecx
mov dword [0x46b964], eax
mov eax, dword [0x46b964]
cmp eax, ebx
je 0x4087c5
cmp dword [0x46b968], ebx
je 0x4087c5
push eax
call fcn.00404535
push dword [0x46b968]
mov esi, eax
call fcn.00404535
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087c5
test edi, edi
je 0x4087c5
call esi
test eax, eax
je 0x4087bc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087bc
test byte [ebp - 0xc], 1
jne 0x4087c5
or dword [ebp + 0x10], 0x200000
jmp 0x4087fe
mov eax, dword [0x46b95c]
cmp eax, ebx
je 0x4087fe
push eax
call fcn.00404535
pop ecx
test eax, eax
je 0x4087fe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087fe
mov eax, dword [0x46b960]
cmp eax, ebx
je 0x4087fe
push eax
call fcn.00404535
pop ecx
test eax, eax
je 0x4087fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46b958]
call fcn.00404535
pop ecx
test eax, eax
je 0x40881e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408820
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret