joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a9d0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x6473c6
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb4]
mov edi, ecx
cmp byte [edi + 0x511], 0
je 0x54aa40
cmp byte [edi + 0x512], 0
jne 0x54ac36
call fcn.0054ecf0
push 0
push 1
lea esi, [edi + 0x54c]
mov byte [edi + 0x57c], 1
call fcn.005d66e0
test eax, eax
setne al
jmp 0x54ac38
mov eax, ebx
lea esi, [esp + 0x14]
call fcn.005b09d0
push eax
mov dword [esp + 0xac], 0
call fcn.005b0890
mov esi, 0x10
add esp, 4
mov dword [esp + 0xa8], 0xffffffff
cmp dword [esp + 0x2c], esi
jb 0x54aa82
mov eax, dword [esp + 0x18]
push eax
call fcn.0061c19a
add esp, 4
cmp dword [ebx + 0x18], esi
jb 0x54aa8c
mov eax, dword [ebx + 4]
jmp 0x54aa8f
lea eax, [ebx + 4]
push 0x670908
push eax
call fcn.0061ceb1
mov esi, eax
add esp, 8
test esi, esi
jne 0x54aad8
cmp byte [edi + 0x510], al
je 0x54aad1
call fcn.0054ec60
push 1
lea esi, [edi + 0x54c]
push 0
call fcn.005d62e0
push 5
push 0x10
call fcn.005d62e0
push 1
push 0
call fcn.005d62e0
xor al, al
jmp 0x54ac38
mov ecx, dword [esp + 0xb0]
push esi
push ebp
push 1
push ecx
call fcn.0061d3c8
push esi
call fcn.0061cf36
add esp, 0x14
cmp byte [edi + 0x510], 0
je 0x54ab21
call fcn.0054ec60
push 1
lea esi, [edi + 0x54c]
push 0
call fcn.005d62e0
push 5
push 0x10
call fcn.005d62e0
push 1
push 1
call fcn.005d62e0
cmp byte [edi + 0x505], 0
je 0x54ac36
cmp byte [edi + 0x504], 0
je 0x54ac36
push str.Buffer
lea ecx, [esp + 0x18]
call fcn.00404450
push ebx
lea edi, [esp + 0x50]
mov dword [esp + 0xac], 1
call fcn.005b04b0
add esp, 4
lea edx, [ebp + 1]
push edx
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
mov byte [esp + 0xb0], 2
call fcn.005baca0
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.00404420
lea ecx, [esp + 0x14]
mov dword [esp + 0xa8], 0xffffffff
call fcn.00404420
test esi, esi
je 0x54ac36
mov edx, dword [esp + 0xb0]
push ebp
push edx
lea eax, [esi + 1]
push eax
mov byte [esi], 1
call fcn.00624510
add esp, 0xc
push esi
call fcn.005baef0
push esi
call fcn.005bae00
push str.Buffer
lea ecx, [esp + 0x34]
call fcn.00404450
push ebx
lea edi, [esp + 0x88]
mov dword [esp + 0xac], 3
call fcn.005b04b0
add esp, 4
mov esi, eax
push ebx
lea edi, [esp + 0x6c]
mov byte [esp + 0xac], 4
call fcn.005b04b0
add esp, 4
mov ecx, eax
lea edx, [esp + 0x30]
push edx
mov eax, esi
mov byte [esp + 0xac], 5
call fcn.005bac30
mov ecx, edi
call fcn.00404420
lea ecx, [esp + 0x84]
call fcn.00404420
lea ecx, [esp + 0x30]
call fcn.00404420
mov al, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x9c
ret 8
Function at 0x5513c0
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4f9], 0
jne 0x5513f6
push 1
mov byte [esi + 0x4fc], 1
call dword [0x6520cc]
push eax
call dword [0x6520c4]
push esi
push 0
push 0x551350
mov byte [esi + 0x4f9], 1
call fcn.0061f90f
add esp, 0xc
ret

Function at 0x551540
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4fe], 0
jne 0x55156f
push 1
mov byte [esi + 0x4fe], 1
call dword [0x6520cc]
push eax
call dword [0x6520c4]
push esi
push 0
push 0x551520
call fcn.0061f90f
add esp, 0xc
ret

Function at 0x551560
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4fe], 0
jne 0x55156f
push 1
mov byte [esi + 0x4fe], 1
call dword [0x6520cc]
push eax
call dword [0x6520c4]
push esi
push 0
push 0x551520
call fcn.0061f90f
add esp, 0xc
ret

Function at 0x5527b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64a8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x634]
lea esi, [esp + 0xc]
call fcn.005b3f20
mov dword [esp + 0x30], 0
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x80]
mov ecx, edi
call eax
cmp dword [esp + 0x24], 0x10
jb 0x55280f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0061c19a
add esp, 4
cmp byte [esp + 0x38], 0
je 0x55281d
push 0
call fcn.0054b970
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x5a1310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640213
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.0060af6a
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x5a1361
mov eax, dword [esi + 0x1c]
push eax
call fcn.0061c19a
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5a9150
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [0x6520cc]
push edi
call esi
push eax
call dword [0x652138]
push 2
mov ebp, eax
call esi
push eax
call dword [0x6520c4]
lea eax, [esp + 0x30]
push eax
call dword [0x652084]
test eax, eax
jne 0x5a918c
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [0x652088]
lea ecx, [esp + 0x18]
push ecx
call edi
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push 0
push 0x64
push edx
push eax
call fcn.0062e060
add dword [esp + 0x18], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ecx
adc dword [esp + 0x1c], edx
mov ebx, dword [esp + 0x14]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea edx, [esp + 0x28]
push edx
call edi
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x1c]
jl 0x5a91c7
jg 0x5a91e4
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x18]
jb 0x5a91c7
lea edx, [esp + 0x20]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 0x14]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push ebp
call esi
push eax
call dword [0x6520c4]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0
push 0x64
push eax
push ecx
call fcn.00630410
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x5a9480
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x18
push ebx
push esi
lea eax, [esp + 0x18]
push edi
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor esi, esi
cmp dword [0x6a9fdc], esi
jle 0x5a94f1
xor ebx, ebx
mov edi, dword [0x75a8c4]
test edi, edi
je 0x5a94cc
mov ecx, dword [0x75a8c8]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x5a94d7
call fcn.0061c63f
mov edi, dword [0x75a8c4]
lea ecx, [ebx + edi]
push ecx
call fcn.005a9330
add esi, 1
add esp, 4
add ebx, 0x18
cmp esi, dword [0x6a9fdc]
jl 0x5a94a5
lea edx, [esp + 0x14]
mov dword [0x6a9fdc], 0
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x10]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sbb ecx, dword [esp + 0x20]
add dword [0x6a95a0], eax
pop edi
pop esi
adc dword [0x6a95a4], ecx
pop ebx
add esp, 0x18
ret
Function at 0x5acb20
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x6a9f38]
test ecx, ecx
mov dl, 1
mov byte [eax + 0xf4], dl
je 0x5acb3b
cmp byte [ecx + 0x511], 0
jne 0x5acb51
push eax
push 0
push 0x5ac890
mov byte [eax + 0xf5], dl
call fcn.0061f90f
add esp, 0xc
ret

Function at 0x5ad570
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x641560
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x188], 2
jne 0x5ad5d1
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x65540c
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00404330
jmp 0x5ad6e5
mov ebp, 0xf
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x3c], ebx
cmp byte [edi + 0x15c], bl
je 0x5ad6a6
lea eax, [edi + 0x18c]
push eax
mov dword [esp + 0x14], eax
call dword [0x6520f8]
mov byte [esp + 0x3c], 1
mov eax, dword [edi + 0x158]
push eax
call fcn.0061d948
mov ebp, eax
mov eax, dword [esp + 0x2c]
add esp, 4
cmp ebp, eax
ja 0x5ad62f
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x1c]
call fcn.00403f00
jmp 0x5ad63e
mov ecx, ebp
sub ecx, eax
push ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.00441d20
mov edx, dword [edi + 0x158]
push ebx
push ebx
push edx
call fcn.0061d72b
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [esp + 0x2c], 0x10
jae 0x5ad65e
lea eax, [esp + 0x18]
mov ecx, dword [edi + 0x158]
push ecx
push ebp
push 1
push eax
call fcn.0061d24e
add esp, 0x10
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00403e20
mov eax, dword [esp + 0x10]
push eax
call dword [0x6520ec]
cmp dword [esp + 0x2c], 0x10
jb 0x5ad6e5
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x5ad6dd
push 0xffffffffffffffff
push ebx
add edi, 0x160
push edi
lea ecx, [esp + 0x20]
call fcn.00403e20
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00403e20
cmp dword [esp + 0x2c], 0x10
jb 0x5ad6e5
mov eax, dword [esp + 0x18]
push eax
call fcn.0061c19a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0061efd1
add esp, 0x30
ret

Function at 0x5af3f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, 0x75a910
jmp fcn.005a9940
jmp 0x5a9930

Function at 0x5af420
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x75a910
jmp fcn.005a98d0
Function at 0x5b18b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6411b3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
lea esi, [edi + 0x28]
mov dword [edi], vtable.Sexy::BetaSupport.0
call fcn.005ad110
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, 0xf
mov dword [edi + 0x1e8], eax
mov dword [edi + 0x1e4], ebx
mov byte [edi + 0x1d4], bl
mov dword [edi + 0x204], eax
mov dword [edi + 0x200], ebx
mov byte [edi + 0x1f0], bl
mov dword [edi + 0x220], eax
mov dword [edi + 0x21c], ebx
mov byte [edi + 0x20c], bl
mov dword [edi + 0x23c], eax
mov dword [edi + 0x238], ebx
mov byte [edi + 0x228], bl
mov byte [esp + 0x1c], 4
call fcn.005c2930
mov dword [edi + 0x248], eax
mov cl, 1
mov byte [eax + 0x49], cl
mov eax, dword [edi + 0x248]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x248]
mov dword [eax], eax
mov eax, dword [edi + 0x248]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x24c], ebx
mov dword [edi + 4], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov byte [edi + 0x1cc], bl
mov byte [edi + 0x1cd], cl
mov dword [edi + 0x18], ebx
call dword [0x6523ac]
mov esi, eax
push esi
call dword [0x6522c0]
mov ebp, dword [0x652118]
push 0x48
push 0x60
push 8
mov dword [esp + 0x30], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
neg eax
push ebx
push eax
call dword [0x652058]
push 0x48
push 0x60
push 8
mov dword [edi + 8], eax
call ebp
push str.Arial
push ebx
push ebx
push ebx
push ebx
push ebx
neg eax
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push eax
call dword [0x652058]
push 0x48
push 0x60
push 0xa
mov dword [edi + 0xc], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
neg eax
push ebx
push eax
call dword [0x652058]
mov ecx, dword [esp + 0x24]
push ecx
push esi
mov dword [edi + 0x10], eax
call dword [0x652320]
mov byte [edi + 0x240], bl
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x5c4cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640038
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x24], eax
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x40]
push eax
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.005c5030
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.005c4fa0
cmp dword [esp + 0x28], 0x10
jb 0x5c4d82
mov eax, dword [esp + 0x14]
push eax
call fcn.0061c19a
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0061efd1
add esp, 0x34
ret 0x18

Function at 0x5c5510
Capabilities:
Read file on windows

Disassembly:
call fcn.005c5370
test eax, eax
je 0x5c553c
mov eax, dword [0x6a9fec]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
call edx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
jmp fcn.0061d24e
Function at 0x5c7b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x63f998
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.Sexy::DSoundInstance.0
mov dword [esi + 4], eax
mov byte [esi + 0x12], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 8], ecx
mov dword [edi], ebx
fld qword [0x65b8f8]
lea ebp, [esi + 0x30]
fst qword [esi + 0x18]
fstp qword [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp], 0xac44
je 0x5c7c41
mov eax, dword [eax + 0x3094]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
je 0x5c7c36
cmp eax, 0x8878000a
jg 0x5c7c00
je 0x5c7bec
cmp eax, 0x8007000e
je 0x5c7bd8
cmp eax, 0x80070057
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDPARAM
push ebx
call dword [0x6523cc]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_OUTOFMEMORY
push ebx
call dword [0x6523cc]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_ALLOCATED
push ebx
call dword [0x6523cc]
jmp 0x5c7c48
cmp eax, 0x88780032
je 0x5c7c22
cmp eax, 0x887800aa
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_UNINITIALIZED
push ebx
call dword [0x6523cc]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDCALL
push ebx
call dword [0x6523cc]
jmp 0x5c7c48
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push ebp
push edi
call edx
mov eax, esi
call fcn.005c7ce0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x5c9980
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [esp + 0x408], 0
mov eax, dword [esp + 0x40c]
jne 0x5c99d3
push eax
lea eax, [esp + 4]
push str._s_function_not_found_in_fmod.dll
push eax
call fcn.0061d4e6
add esp, 0xc
push 0x10
push str.Error
lea ecx, [esp + 8]
push ecx
push 0
call dword [0x6523cc]
push 0
call fcn.0061dd92
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0061efd1
add esp, 0x404
ret

Function at 0x5c9da0
Capabilities:
Terminate process

Disassembly:
push 0x6a9ffc
call dword [0x652148]
cmp dword [0x6a9ff8], 0
jne 0x5c9df8
push 0x80
call fcn.0061c130
add esp, 4
test eax, eax
je 0x5c9dd0
push esi
mov esi, eax
call fcn.005c99f0
pop esi
jmp 0x5c9dd2
xor eax, eax
cmp dword [eax + 4], 0
mov dword [0x6a9ff8], eax
jne 0x5c9df8
push 0x10
push str.Error
push str.Cant_find_fmod.dll.
push 0
call dword [0x6523cc]
push 0
call fcn.0061dd92
ret
Function at 0x5cc210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
call fcn.005cc070
test eax, eax
je 0x5cc232
mov eax, dword [0x6aa004]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push ebx
push ebp
call eax
pop ebp
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push ebx
push ebp
call fcn.0061d24e
add esp, 0x10
pop ebp
ret
Function at 0x5d59a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0054b980
mov ecx, dword [esi + 0x640]
pop esi
jmp fcn.005ab200
Function at 0x115a692
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], ebx
bswap ax
movzx ax, bl
jmp 0x13d0a6b
mov al, 0xe9
jp 0x13d0a66
jecxz 0x13d0a4d
mov ch, byte [ebx - 0x3bd27c]
clc
mov dl, 0x14
stc
or dword [edx - 0xb], ebx
pop eax
invalid
pop ebx
push edi
movsd dword es:[edi], dword [esi]
xor byte cs:[ecx + 0x29853031], 0xf8
sti
cmp eax, ecx
xor ch, byte [ebx + 0x61e1b5b0]
mov esp, 0xf297862c
arpl word [0xf348ff9d], sp
pushal
adc dword [ecx], esp
clc
rol dword [edi - 0x5db9c621], cl
cmp dword [esi - 0x5e], eax
jge 0x13d0a11
inc ebx
push ebx
cmp al, 0x44
pop es
out dx, al
jno 0x13d09e4
mov ebx, dword [ebx + 0x304f3d74]
js 0x13d0a8c
jae 0x13d0a91
inc ebx
sub eax, 0x3380f005
mov eax, 0xae98d86e
cmpsd dword [esi], dword es:[edi]
das
nop
enter 0x1b83, 0xffffffffffffff8f
inc ecx
push 0xffffffffffffffab
out 0x49, al
salc
xchg edx, eax
ret 0xd1f3
pop eax
lea eax, sym.imp.KERNEL32.dll_LocalFree
push ebx
pushal
mov dword [esp + 8], 0x9c62e6a4
mov byte [esp], al
mov dword [esp + 0x24], 0x13c40ec
pushal
call fcn.01163a46
scasd eax, dword es:[edi]
sub dword [eax + 0xb], esp
jne 0x13d0a37
jmp [edi + 0xba06429]
or esi, dword [ebp - 0x5d]
stosb byte es:[edi], al
mov dword [ebx], ebx
jae 0x13d0a99
test dword [esi - 0x38245760], 0x37380b0b
int 0x2b
invalid

Function at 0x115d2c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap eax
push ebp
bsr bp, sp
sal ax, 1
rcr eax, 0x14
mov ebp, esp
shld ax, ax, 5
jbe 0x13cb41c
xor al, dl
pushal
sub esp, 0xfffffff8
ror ax, cl
add eax, 0x4d17ebc5
push esi
lea eax, [ebx - 0x4e81918a]
lahf
push edi
das
push ebx
pushfd
stc
cmc
mov dword [esp], edx
sub ah, ah
mov eax, dword [ebp + 8]
push 0x5075cd8f
and al, 0x28
in al, 0x8b
inc ebp
or byte [eax - 0x71], ch
int 0x75
push eax
test eax, eax
pushfd
lea esp, [esp + 8]
je 0x115a3a5
movzx dx, bl
mov esi, dword [eax + 0x3c]
cmp bh, cl
inc dl
inc dl
lea edx, [eax - 0x239edea1]
add esi, eax
shr dx, 2
rol dl, 2
mov edx, dword [esi + 0x78]
test ah, bl
test edx, edx
call fcn.01162a26
mov byte [0xd4380cd1], al
dec ebp
mov dword [0xe4badd42], eax
les edx, [ebp + 0x693fa092]
inc esi
jns 0x115d392
jae 0x115d2de
jns 0x115d2fc
pop ebp
cmp eax, dword [esi - 0x20]
inc ecx
mov esi, 0xae11781e
adc dword [ecx - 0x40], ebp
and cl, 0xa2
and ebx, dword [ecx - 0x2661a7c9]
mov bh, byte [edx + 0x52fc9466]
xchg dword [esi], esi
invalid
invalid
bts ax, bp
movzx ax, cl
shl ah, 5
sub esp, 0x18
add eax, eax
test bl, al
btr ax, dx
push esi
sub ax, ax
push edi
das
shr al, cl
push ebx
daa
sar al, cl
push edx
clc
sbb ax, dx
not al
neg ah
mov eax, dword [ebp + 8]
bt bp, 5
pushfd
clc
test eax, eax
pushfd
pushal
call fcn.0115def4
Function at 0x115def4
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
je 0x115a3a5
xchg edx, esi
lea edx, [ebx*8 + 0x75261700]
rcr esi, cl
push ebp
mov esi, dword [eax + 0x3c]
pushfd
pushal
rcr dh, cl
sbb dh, 0x7e
add esi, eax
movzx edx, bl
shrd dx, si, 3
mov edx, dword [esi + 0x78]
call fcn.01164a17
push es
pop edi
out dx, eax
sbb ecx, esp
dec ebp
mov dword [0x7cbf47e2], eax
pushfd
jne 0x115df46
aaa
jno 0x115df9c
invalid
inc eax
mov edx, 0x8f73f4b0
into
invalid
test byte [ebx - 0x7e920813], al
sbb al, byte [edx - 0x2c]
clc
test al, 0xaf
mov bh, 0x88
xor byte [edi - 0x182ad3b9], dh
invalid

Function at 0x13c8c8b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13cab51
lea esp, [esp + 0x2c]
je 0x1159d41
jmp 0x13c9110
movsx edx, al
jno 0x13d1d6f
pushal
lea edx, [ebx + 4]
lea esp, [esp + 0x20]
pushal
not dh
push dword [esp]
lea edx, [ebx + 4]
pushal
lea edi, [ebx - 0x43acd431]
movsx di, al
pushfd
movzx esi, word [edx + 0x1a]
pushfd
not edi
movsx di, cl
lea esi, [esi + edx + 0x1c]
pop edi
push dword [esp]
mov edi, dword [ebp + 8]
push ebx
jmp 0x115afbe
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x67083df5
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x212c7528
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40149a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x124]
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [0x452a68]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
or eax, 8
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4015be
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x11d]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
jne 0x401558
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x124]
je 0x40153d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, 1
jmp 0x4015be
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0040149a
sub esp, 0xc
test eax, eax
je 0x4014f3
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 2
call fcn.00407e2f
test eax, eax
push edi
je 0x401599
mov edx, dword [0x452a68]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x4015be
cmp dword [0x452a68], 0
mov eax, 1
jne 0x4015be
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push edx
push edx
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc