joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a5b4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0049fd50
mov dword [edi], vtable.ctrls::TrayIcon.0
mov dword [ebp - 4], 0
mov dword [edi + 0x88], 0
xor eax, eax
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 7
mov word [edi + 0x90], ax
mov dword [edi + 0x294], eax
mov dword [edi + 0x298], eax
mov dword [edi + 0x29c], eax
mov dword [edi + 0x2a0], eax
mov dword [edi + 0x2a4], eax
mov dword [edi + 0x2a8], eax
mov dword [edi + 0x2ac], eax
mov dword [edi + 0x2b0], eax
mov eax, dword [edi + 0x18]
mov esi, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
mov ecx, dword [edi + 0x1c]
push 0
push 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push SysReAllocStringLen
push eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
or byte [edi + 0x10], 1
push 0xc
call fcn.004845cc
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [edi + 0x14], eax
call fcn.004e4350
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
sub edx, esi
mov ecx, dword [ebp - 0x30]
cmp eax, 0x80000000
mov eax, dword [ebp - 0x28]
push edi
push dword [0x5c9134]
push 0
push 0
push edx
jae 0x4cd57a
sub eax, ecx
push eax
push esi
push ecx
push SysReAllocStringLen
push 0x572268
push 0x585790
jmp 0x4cd58e
sub eax, ecx
push eax
push esi
push ecx
push SysReAllocStringLen
push 0x572268
push str.GTK2_A
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [edi + 0x14]
mov dword [ecx], eax
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [edi + 8]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x1c]
call fcn.004a1fe0
mov byte [ebp - 4], 0xc
call fcn.004a1980
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.004cd300
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.004a1cb0
mov eax, dword [edi + 0x14]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x10]
push 0x1e8
lea esi, [edi + 0xa8]
push 0
push esi
call fcn.004f0120
add esp, 0xc
call fcn.004e42b0
test al, al
mov dword [edi + 0xb8], 0x800
mov ecx, 0x58
mov edx, 0x1e8
cmovne ecx, edx
cmp dword [edi + 0x54], 0
mov dword [esi], ecx
jne 0x4cd646
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4cd646
mov eax, dword [eax]
jmp 0x4cd648
xor eax, eax
mov dword [edi + 0xac], eax
mov ecx, edi
mov eax, dword [0x5bee74]
inc eax
mov byte [edi + 0x8c], 1
push 0x1e
push 0
mov dword [0x5bee74], eax
mov dword [edi + 0xb0], eax
call fcn.004ce2e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d3500
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
shr eax, 0xf
test al, 1
jne 0x4d3534
push 2
call esi
shr eax, 0xf
test al, 1
jne 0x4d3534
push 4
call esi
shr eax, 0xf
test al, 1
jne 0x4d3534
call fcn.004d3a40
mov byte [0x5c99da], 0
pop esi
ret

Function at 0x4d3570
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x12
call ebx
movzx esi, ax
shr esi, 0xf
and esi, 1
push 0x11
shl esi, 0x13
call ebx
shr eax, 0xf
mov edi, esi
or edi, 0x20000
and al, 1
push 0x10
cmove edi, esi
call ebx
shr eax, 0xf
mov esi, edi
or esi, 0x40000
and al, 1
push 1
cmove esi, edi
call ebx
shr eax, 0xf
mov edi, esi
or edi, 0x800000
and al, 1
push 2
cmove edi, esi
call ebx
shr eax, 0xf
mov esi, edi
or esi, 0x400000
and al, 1
push 4
cmove esi, edi
call ebx
movzx ecx, ax
mov eax, esi
shr ecx, 0xf
or eax, 0x200000
and cl, 1
pop edi
cmove eax, esi
pop esi
pop ebx
ret

Function at 0x4d53c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ae55
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x90], ebx
call fcn.0049fd50
mov dword [ebx], vtable.ctrls::StaticText.0
xor eax, eax
add ebx, 0x88
mov dword [ebp - 4], 0
mov dword [ebp - 0x8c], ebx
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 7
mov word [ebx + 0x14], ax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
lea edi, [ebx + 0x4c]
mov byte [ebp - 4], 3
mov dword [edi + 4], eax
mov dword [edi], eax
lea eax, [ebp - 0x84]
push eax
mov dword [ebx + 0xc0], 0x333333
call fcn.004af7b0
mov esi, eax
mov ecx, 0x1d
mov eax, dword [ebp - 0x88]
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 0
mov dword [ebx + 4], 0x3e99999a
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov byte [ebx + 8], 0
mov dword [ebx + 0xc8], 1
mov dword [ebx + 0xc4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret

Function at 0x4daf20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
jne 0x4daf5a
cmp dword [ebp + 0xc], 0x464
jne 0x4daf5a
cmp dword [ebp + 0x14], 0
mov eax, dword [ecx + 4]
je 0x4daf3f
push 4
jmp 0x4daf41
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x18
xor eax, eax
pop ebp
ret 0x18
Function at 0x4ddbc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56be66
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004dd380
push 0xc8
lea ecx, [esi + 0x98c]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ctrls::AnimateLayeredWindow.1.0
mov dword [esi + 0x30], vtable.ctrls::AnimateLayeredWindow.2.0
mov dword [esi + 0xe0], vtable.ctrls::AnimateLayeredWindow.0
mov word [esi + 0x988], 0
mov byte [esi + 0x98a], 0
call fcn.004ece60
push 0x64
push 0xc8
lea ecx, [esi + 0x9b4]
mov byte [ebp - 4], 1
call fcn.004ed760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4de1a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bf50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x30]
call fcn.004ccc80
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004cb650
movups xmm0, xmmword [ebp - 0x24]
push 0
push 0x4de730
lea eax, [ebp - 0x10]
push esi
push eax
movups xmmword [esi + 0x91c], xmm0
call fcn.004ddb10
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x4de20e
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x9e4]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x4de239
add eax, 4
push eax
call edi
test eax, eax
jne 0x4de239
mov ecx, dword [esi + 0x9e4]
test ecx, ecx
je 0x4de239
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [esi + 0x9e4], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4de263
add eax, 4
push eax
call edi
test eax, eax
jne 0x4de263
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4de263
mov eax, dword [ecx]
push 1
call dword [eax + 8]
push 0
push 0x4de680
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004dda60
add esp, 0x10
push eax
lea ecx, [esi + 0x9e8]
mov dword [ebp - 4], 0
call fcn.004a5290
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004a5220
push 0
push 0x4de8a0
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004ddb10
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x4de2c0
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x9ec]
test eax, eax
je 0x4de2e5
add eax, 4
push eax
call edi
test eax, eax
jne 0x4de2e5
mov ecx, dword [esi + 0x9ec]
test ecx, ecx
je 0x4de2e5
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [esi + 0x9ec], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4de30f
add eax, 4
push eax
call edi
test eax, eax
jne 0x4de30f
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4de30f
mov eax, dword [ecx]
push 1
call dword [eax + 8]
push dword [ebp + 8]
lea eax, [ebp + 8]
push 0
push 0x4de7f0
push esi
push eax
call fcn.004dd9b0
add esp, 0x14
push eax
lea ecx, [esi + 0x9f0]
mov dword [ebp - 4], 1
call fcn.004a5290
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004a5220
push 0xc8
push 0x64
lea ecx, [esi + 0x9b4]
call fcn.004edc20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4e3980
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c91a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e39d4
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004048f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00499810
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x4e3a42
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4e3a38
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e3b8a
push edx
push ecx
call fcn.004845fc
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push str..png
cmovae ecx, dword [ebp - 0x40]
push ecx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0051f9d9
add esp, 8
test eax, eax
je 0x4e3a7e
mov dword [edi], 0
jmp 0x4e3b62
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocStringLen
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
jne 0x4e3aa2
mov dword [edi], esi
jmp 0x4e3b62
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x4e3aef
push ebx
call fcn.0050d832
mov esi, eax
add esp, 4
test esi, esi
je 0x4e3aef
push 0
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp - 0x58]
jne 0x4e3aef
push ebx
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004e3430
add esp, 0xc
mov byte [ebp - 4], 3
mov ebx, 2
jmp 0x4e3b05
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 4
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x44], ebx
call fcn.004a8580
mov dword [ebp - 4], 5
test bl, 4
je 0x4e3b28
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffb
call fcn.004a8840
mov byte [ebp - 4], 7
test bl, 2
je 0x4e3b39
lea ecx, [ebp - 0x54]
call fcn.004a8840
test esi, esi
je 0x4e3b46
push esi
call fcn.004faf71
add esp, 4
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.004a8580
lea ecx, [ebp - 0x50]
call fcn.004a8840
lea ecx, [ebp - 0x40]
call fcn.004029d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 8
call fcn.004faed4
int3
Function at 0x4e3ea0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi]
test eax, eax
je 0x4e3ed6
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne bl
test eax, eax
je 0x4e3ed1
mov eax, dword [esi]
test eax, eax
je 0x4e3ed1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov al, bl
pop ebx
pop esi
ret
mov al, cl
pop esi
ret

Function at 0x4e3f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c957
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x5c9ff4
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi]
mov byte [0x5c9ff2], 1
test eax, eax
je 0x4e3fa5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
call fcn.004845cc
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4e3fc7
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call fcn.004a51c0
jmp 0x4e3fc9
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push 0x4e4210
push 0
push 0
call fcn.0052ec41
add esp, 0x18
mov dword [esi], eax
test eax, eax
lea ecx, [ebp + 8]
setne bl
call fcn.004a5220
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e42b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
mov ecx, dword [ebp - 4]
setae al
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret

Function at 0x4e4350
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 5
ja 0x4e43a0
jne 0x4e4390
cmp dword [ebp - 0x110], 1
jae 0x4e43a0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
Function at 0x4e7070
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cc8c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x5c8dc0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x5ca8d8]
cmp eax, dword [edx + 4]
jg 0x4e71ba
cmp byte [esi + 0x92], 0
jne 0x4e70ca
push 0x5ca8c4
jmp 0x4e719b
cmp dword [0x5c9130], 0
jl 0x4e70f3
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4e70f3
mov eax, dword [0x5c9130]
lea eax, [eax*4 + 0x5ca8b4]
jmp 0x4e719a
mov ebx, dword [esi + 0x20]
sub ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x24]
sub edi, dword [esi + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
lea eax, [ebx - 0x10]
cmp edx, eax
jl 0x4e7122
cmp edx, ebx
jge 0x4e7122
lea eax, [edi - 0x10]
cmp ecx, eax
jl 0x4e7122
cmp ecx, edi
jge 0x4e7122
mov ecx, 8
jmp 0x4e7182
lea esi, [ebx - 4]
cmp ecx, 4
jge 0x4e7139
xor ecx, ecx
cmp edx, 4
jl 0x4e7182
cmp edx, esi
setge cl
inc ecx
jmp 0x4e7182
lea eax, [edi - 4]
cmp ecx, eax
jge 0x4e716c
cmp edx, 4
jge 0x4e714c
mov ecx, 3
jmp 0x4e7182
cmp edx, esi
mov esi, 4
jge 0x4e7165
lea eax, [ecx - 4]
or edx, 0xffffffff
cmp eax, 0x12
mov ecx, esi
cmovge ecx, edx
jmp 0x4e7187
mov ecx, 5
jmp 0x4e7187
cmp edx, 4
jge 0x4e7178
mov ecx, 6
jmp 0x4e7182
xor ecx, ecx
cmp edx, esi
setge cl
add ecx, 7
mov esi, 4
cmp ecx, 0xffffffff
mov dword [0x5c9130], ecx
cmove ecx, esi
lea eax, [ecx*4 + 0x5ca8b4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004a8580
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x5ca8d8
call fcn.00484496
add esp, 4
cmp dword [0x5ca8d8], 0xffffffff
jne 0x4e70b7
push 0x5ca8b4
mov dword [ebp - 4], 0
call fcn.004ab760
push 0x5ca8b8
mov byte [ebp - 4], 1
call fcn.004ab600
push 0x5ca8bc
mov byte [ebp - 4], 2
call fcn.004ab8c0
push 0x5ca8c0
mov byte [ebp - 4], 3
call fcn.004ab340
push 0x5ca8c4
mov byte [ebp - 4], 4
call fcn.004a8d10
push 0x5ca8c8
mov byte [ebp - 4], 5
call fcn.004ab4a0
push 0x5ca8cc
mov byte [ebp - 4], 6
call fcn.004aaf20
push 0x5ca8d0
mov byte [ebp - 4], 7
call fcn.004aadc0
push 0x5ca8d4
mov byte [ebp - 4], 8
call fcn.004ab080
push 0x5702f0
call fcn.004849f8
push 0x5ca8d8
mov dword [ebp - 4], 0xffffffff
call fcn.0048444c
add esp, 0x2c
jmp 0x4e70b7
Function at 0x53738e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00536f93

Function at 0x537399
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00537114

Function at 0x53cb15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053c2ef

Function at 0x53cb20
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053c52a

Function at 0x53d02d
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053ce21
Function at 0x54e0d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov al, byte [edi + 8]
mov byte [ebp - 0x15], al
cmp al, 3
je 0x54e2b8
movzx edx, byte [edi + 9]
test al, 2
mov eax, dword [ebp + 0x10]
mov ecx, edx
push ebx
mov ebx, dword [edi]
je 0x54e131
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edx
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edx
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, 3
jmp 0x54e13f
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x54e159
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edx, eax
mov dword [ebp + ecx*4 - 0x14], edx
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x54e1a3.3
xor edi, edi
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x54e176
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x54e17b
mov edi, 1
inc eax
cmp eax, ecx
jl 0x54e165
test di, di
mov edi, dword [ebp + 8]
je case.0x54e1a3.3
movzx eax, byte [edi + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x54e1a3.3
movzx eax, byte [eax + 0x54e2dc]
jmp dword [eax*4 + 0x54e2c8]
mov ecx, dword [edi + 4]
test ecx, ecx
je case.0x54e1a3.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x54e1b5
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edi + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x54e1a3.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x54e1f8
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x54e1a3.3
nop word [eax + eax]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x54e230
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x54e1a3.3
mov edi, 0x100
nop dword [eax]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x54e270
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
Function at 0x40a350
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
jmp 0x40a36a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a371
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a360
mov eax, 1
add ebx, ebx
jne 0x40a383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a378
jne 0x40a394
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a378
xor ecx, ecx
sub eax, 3
jb 0x40a3a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a41a
mov ebp, eax
add ebx, ebx
jne 0x40a3b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a3c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a3e4
inc ecx
add ebx, ebx
jne 0x40a3d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a3c5
jne 0x40a3e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a3c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a404
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a3f5
jmp 0x40a366
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a404
add edi, ecx
jmp 0x40a366
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a463
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa534]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a421
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa53c]
or eax, eax
je 0x40a45d
mov dword [ebx], eax
add ebx, 4
jmp 0x40a43e
call dword [esi + 0xa538]
mov ebp, dword [esi + 0xa540]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a497
sub esp, 0xffffff80
jmp 0x401831