joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016ad3
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push 0x119
push dword [esi + 4]
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x1016afc
push ebx
push edi
push 0
push 0
push 0x147
mov ebx, 0x120
push ebx
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
cmp eax, 0xffffffff
jne 0x1016afa
mov eax, dword [ebp - 4]
push 0
push 0
push 0x14e
push ebx
push dword [eax + 4]
call esi
push eax
call edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01016313
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x1018f2f
Capabilities:
Set registry value

Disassembly:
mov eax, 0x101e89a
call fcn.0101caf8
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], esp
push 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
call fcn.0101c324
pop ecx
mov ebx, eax
jmp 0x1018f55
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x1019026
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push dword [ebp + 0xc]
lea edi, [eax + eax + 2]
call esi
mov esi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
lea eax, [eax + eax + 2]
push edi
mov dword [ebp - 0x14], eax
call esi
push dword [ebp - 0x14]
mov dword [ebx], eax
call esi
mov edx, dword [ebx]
test edx, edx
mov dword [ebx + 4], eax
je 0x1019011
test eax, eax
je 0x1019011
mov esi, dword [ebp + 8]
mov ecx, edi
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi + 8]
cmp dword [esi + 4], eax
jne 0x1019001
add eax, eax
mov dword [esi + 8], eax
shl eax, 2
push eax
push dword [esi]
call dword [sym.imp.msvcrt.dll_realloc]
test eax, eax
pop ecx
pop ecx
jne 0x1018fff
push dword [ebx]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebx + 4]
call esi
mov dword [ebp - 0x18], 0x8007000e
jmp 0x101900c
mov dword [esi], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], ebx
inc dword [esi + 4]
mov eax, dword [ebp - 0x18]
jmp 0x101902b
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
push edx
call esi
push dword [ebx + 4]
call esi
push ebx
call fcn.0101bef8
pop ecx
mov eax, 0x8007000e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x1019725
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0101cb40
mov eax, dword [0x1023fb4]
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0x3d
push edi
mov dword [ebp - 4], eax
mov edi, ecx
jne 0x101971c
push esi
call fcn.01019316
test eax, eax
jl 0x101971e
mov ecx, edi
call fcn.010192ed
lea eax, [ebp - 0x2004]
push eax
mov ecx, edi
call fcn.01019316
test eax, eax
jl 0x101971e
push esi
mov ecx, edi
call fcn.01019316
test eax, eax
jl 0x101971e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101bddf
leave
ret 4

Function at 0x101a2f0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x101e923
call fcn.0101caf8
sub esp, 0x1c
mov eax, dword [0x1023fb4]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edi
cmp esi, edi
mov dword [ebp - 4], edi
je 0x101a30c
lea eax, [ebp - 0x24]
push eax
push 0x1004d84
push 1
push edi
push 0x1004d74
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x101a310
mov eax, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x101a30c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x101a387
cmp dword [esi], edi
push ebx
mov ebx, esi
je 0x101a373
cmp dword [ebp + 0x10], 0
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x24]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x20]
push edx
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x28]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
je 0x101a35e
cmp dword [ebx], 1
jne 0x101a340
call dword [ecx + 0x14]
jmp 0x101a343
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x101a36b
mov eax, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x101a35a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x101a386
cmp dword [ebx], 1
jne 0x101a368
call dword [ecx + 0x18]
jmp 0x101a36b
call dword [ecx + 0x20]
add ebx, 8
cmp dword [ebx], 0
jne 0x101a317
mov eax, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x101a384
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0101bddf
leave
ret 0xc
Function at 0x101a8f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x101ea31
call fcn.0101caf8
sub esp, 0x224
mov eax, dword [0x1023fb4]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], esi
push 0xf003f
push reloc.MFC42u.DLL_CWinApp::CWinApp
push 0x80000002
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], esi
call fcn.0100985e
test eax, eax
jne 0x101a95c
cmp dword [ebp + 8], esi
je 0x101a94b
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x101a95c
push ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.0101c18c
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 1
call fcn.0101870c
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x220]
inc bl
mov byte [ebp - 4], 0
call fcn.0101c168
test bl, bl
pop ebx
jne 0x101a95c
push edi
push 0x100483c
lea ecx, [ebp - 0x22c]
call fcn.0101c18c
mov esi, eax
push 0x1002c14
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0101c18c
mov edi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.0101c18c
push edi
push eax
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 4
call fcn.0101c3cc
push esi
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 5
call fcn.0101c3cc
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xa
call fcn.0101c168
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 9
call fcn.0101c168
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 8
call fcn.0101c168
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 7
call fcn.0101c168
push 0x1004598
push dword [ebp - 0x224]
lea ecx, [ebp - 0x21c]
call fcn.01006554
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0
call fcn.0101c168
pop edi
jmp 0x101a95c
push 0x1004598
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x21c]
call fcn.0100650c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0101bddf
leave
ret 4
Function at 0x101ad3c
Capabilities:
Shutdown system

Disassembly:
mov eax, 0x101ea4b
call fcn.0101caf8
sub esp, 0xac
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], ecx
jle 0x101ac36
dec eax
jmp 0x101ac38
xor eax, eax
push eax
push edi
push 0x7e
lea ecx, [ebp - 0xb8]
call fcn.0101864b
mov eax, dword [0x1024094]
cmp eax, edi
mov dword [ebp - 4], edi
je 0x101ac5f
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x1024090]
cmp eax, edi
je 0x101ac74
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x102408c]
cmp eax, edi
je 0x101ac89
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x1024088]
cmp eax, edi
je 0x101ac9e
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x1024080]
cmp eax, edi
je 0x101acb3
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x1024084]
cmp eax, edi
je 0x101acc8
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
mov eax, dword [0x1024098]
cmp eax, edi
je 0x101acdd
push eax
lea ecx, [ebp - 0xb8]
call fcn.0101c78c
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0xb8]
mov dword [0x102409c], eax
call fcn.0101c594
mov dword [ebp - 0x14], eax
mov eax, dword [0x1024090]
mov ecx, eax
add eax, 0x90
xor ebx, ebx
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x102408c]
mov dword [ebp - 0x28], ecx
mov ecx, eax
add eax, 0x90
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x1024088]
mov dword [ebp - 0x24], ecx
mov ecx, eax
add eax, 0x90
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x1024080]
mov dword [ebp - 0x20], ecx
mov ecx, eax
add eax, 0x90
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x1024084]
mov dword [ebp - 0x1c], ecx
mov ecx, eax
add eax, 0x90
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x102409c], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp + 8], edi
mov esi, dword [ebp + 8]
lea esi, [ebp + esi*4 - 0x28]
cmp dword [esi], 0
je 0x101ad96
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi]
neg eax
sbb eax, eax
neg eax
or edi, eax
mov eax, dword [ecx]
call dword [eax + 0x10]
or ebx, eax
test edi, edi
je 0x101ad96
test ebx, ebx
jne 0x101ada9
inc dword [ebp + 8]
cmp dword [ebp + 8], 5
jl 0x101ad6a
test ebx, ebx
jne 0x101ada9
cmp dword [ebp - 0x14], 2
je 0x101adb2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0101a7d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.01018680
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x101c9eb
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x14
push 0x1004b28
call fcn.0101cc70
and dword [ebp - 4], 0
dec dword [ebp + 0x10]
js 0x101c9f1
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
call dword [ebp + 0x14]
jmp 0x101c9de
or dword [ebp - 4], 0xffffffff
call fcn.0101ccab
ret 0x10
Function at 0x101c9f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x1004b28
call fcn.0101cc70
and dword [ebp - 4], 0
dec dword [ebp + 0x10]
js 0x101c9f1
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
call dword [ebp + 0x14]
jmp 0x101c9de
or dword [ebp - 4], 0xffffffff
call fcn.0101ccab
ret 0x10
Function at 0x4017b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41e1c2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4b9060]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0xc], ebx
push ecx
mov eax, esp
push dword [esp + 0x28]
mov dword [eax], 0
call dword [0x4222b8]
push 0x2c4
mov dword [esp + 0x20], 0
mov dword [ebx], vtable.MainWindow.0
mov dword [ebx + 8], vtable.MainWindow.1.0
call fcn.0041d4cc
add esp, 4
mov dword [ebx + 0x18], eax
lea ecx, [ebx + 0x20]
mov dword [ebx + 0x1c], 0
push 0
call dword [0x422408]
mov esi, dword [0x4223dc]
lea ecx, [ebx + 0x38]
push ebx
mov byte [esp + 0x20], 1
call esi
push ebx
lea ecx, [ebx + 0x40]
mov byte [esp + 0x20], 2
call esi
push ebx
lea ecx, [ebx + 0x48]
mov byte [esp + 0x20], 3
call esi
lea ecx, [ebx + 0x50]
mov byte [esp + 0x1c], 4
call dword [0x42229c]
lea ecx, [ebx + 0x60]
mov byte [esp + 0x1c], 5
call dword [0x4222a0]
lea ecx, [ebx + 0x90]
call dword [0x422c98]
mov eax, dword [0x422184]
mov dword [ebx + 0x650], eax
mov eax, dword [0x422184]
mov dword [ebx + 0x654], eax
mov eax, dword [0x422184]
mov dword [ebx + 0x658], eax
push 0
lea ecx, [ebx + 0x65c]
mov byte [esp + 0x20], 9
call fcn.0041afc0
push dword [0x42225c]
mov esi, dword [0x422260]
lea eax, [ebx + 0x690]
push esi
push 3
push 4
push eax
mov byte [esp + 0x30], 0xa
call fcn.0041d670
push dword [0x42225c]
lea eax, [ebx + 0x69c]
mov byte [esp + 0x20], 0xb
push esi
push 0xa
push 4
push eax
call fcn.0041d670
mov esi, dword [0x4223a8]
push esi
push dword [0x4223b4]
mov byte [esp + 0x24], 0xc
push 0x200
push 0x18
lea eax, [ebx + 0x6c4]
push eax
call fcn.0041d670
push esi
push dword [0x4223b4]
lea eax, [ebx + 0x36c4]
mov byte [esp + 0x24], 0xd
push 0x20
push 0x18
push eax
call fcn.0041d670
push ecx
mov esi, esp
mov byte [esp + 0x20], 0xe
push 0x18
push str.WMPBOX_DevlistConfig.cfg
call dword [0x4221f4]
add esp, 8
mov dword [esi], eax
lea ecx, [ebx + 0x39c8]
call dword [0x422c90]
mov ecx, dword [ebx + 0x18]
push ebx
mov byte [esp + 0x20], 0xf
call fcn.004082c0
mov ecx, ebx
call fcn.00419460
mov ecx, ebx
call fcn.00405880
mov ecx, ebx
call fcn.00405010
mov ecx, ebx
call fcn.00404880
mov ecx, ebx
call fcn.004056e0
mov ecx, dword [ebx + 0x18]
mov esi, dword [0x422b80]
mov ecx, dword [ecx + 0x74]
call esi
mov ecx, dword [ebx + 0x18]
mov ecx, dword [ecx + 0x44]
call esi
mov ecx, dword [ebx + 0x18]
mov ecx, dword [ecx + 0x4c]
call esi
mov ecx, ebx
call fcn.00404b30
mov ecx, ebx
mov dword [ebx + 0x678], 0
mov dword [ebx + 0x67c], 0
mov dword [ebx + 0x680], 0
mov dword [ebx + 0x684], 0
call fcn.0041a9a0
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x41b960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42194f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
mov eax, dword [0x4b9060]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, ecx
mov ebx, dword [0x4221a4]
lea eax, [esp + 0xc]
push 0xffffffffffffffff
push 0
push 0x423dd8
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x20], 0
call dword [0x422ba4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push 0x424100
lea eax, [esp + 0x30]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp]
push eax
mov dword [esp + 0x20], 1
call dword [0x422338]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push str.ap_ssid_CHD_nap_key__12345678
lea eax, [esp + 0x30]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp + 4]
push eax
mov dword [esp + 0x20], 2
call dword [0x422a90]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push 0x423dd8
lea eax, [esp + 0x30]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
mov dword [esp + 0x20], 3
call dword [0x4223fc]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push 0x428aa0
lea eax, [esp + 0x30]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp + 0xc]
push eax
mov dword [esp + 0x20], 4
call dword [0x4223fc]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push str.192.168.100.254
lea eax, [esp + 0x30]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp + 0x10]
push eax
mov dword [esp + 0x20], 5
call dword [0x4223d8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
push 0xffffffffffffffff
push 0
push 0x428abc
lea eax, [esp + 0x1c]
push 0x428a74
push eax
call ebx
add esp, 0x14
mov ecx, dword [ebp + 0x18]
push eax
mov dword [esp + 0x20], 6
call dword [0x422338]
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x422140]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x41c530
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x421a59
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4b9060]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [0x4b9060]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 2
push 0x4b9024
push ecx
mov dword [esp + 0x14], 0
call dword [0x42211c]
add esp, 0x10
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x38]
call dword [0x422140]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041d5d2
add esp, 0x24
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x56662d2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x56662d3a
pop dword [ebp - 0x40]
mov eax, 0xfc6363bb
sub eax, 0xa5fd3681
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xe5994130
sub dword [ebp - 0x50], 0x9746fbe5
mov dword [ebp - 0x4c], 0x1c41bb6e
add dword [ebp - 0x4c], 0x15f190d7
mov dword [ebp - 0x48], 0x9260abb
sub dword [ebp - 0x48], 0xbcd9c68d
mov dword [ebp - 0x44], 0xbc4f4150
sub dword [ebp - 0x44], 0xbc4f4150
lea eax, [ebp - 0x50]
push eax
mov eax, 0x501213c9
sub eax, 0xf9af0285
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x148a07ab
sub dword [ebp - 0x50], 0xa0179e55
mov dword [ebp - 0x4c], 0x2aa13067
add dword [ebp - 0x4c], 0x16cb310e
mov dword [ebp - 0x48], 0x5c0418f6
add dword [ebp - 0x48], 0x76b5376
mov dword [ebp - 0x44], 0x730007c8
sub dword [ebp - 0x44], 0x730007c8
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3bc9208a
sub eax, 0xe5660f4a
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1e9
push 0
call eax
mov ecx, 0x687f1a6c
sub ecx, 0x687ed76c
xor esi, esi
add esi, eax
mov edx, 0x954820d4
add edx, 0xc1205f2c
add edx, dword [ebp - 0x40]
mov edi, 0xd1d695cf
add edi, 0xbd59ead5
sub dword [ebp - 4], edx
mov ebx, dword [edx]
xor dword [ebp - 8], eax
xor ebx, edi
add dword [ebp - 0x20], edi
mov dword [esi], ebx
sub dword [ebp - 0x2c], edi
add esi, 0xeccf1d2c
add esi, 0x1330e2d8
add edx, 4
loop 0x56662e5e
add eax, 0x4e3dce17
add eax, 0xb1c330bc
xor ebx, ebx
add ebx, eax
add eax, 0x1a16ea99
sub eax, 0x1a16ea94
mov ecx, 0xc2f74a58
add ecx, 0x936bb5a8
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x56666847
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x56670224
call fcn.566541a0
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.oleaut32.dll_SetErrorInfo]
mov esi, dword [ebp + 8]
call fcn.56662d2b
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 0xb4], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x566668af
cmp dword [ebp - 0xb0], 4
jb 0x566668af
mov byte [ebp - 0x14], 1
push ebx
push ebx
push 0x5663742c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x566668c3
mov byte [ebp - 0x14], bl
mov esi, dword [ebp - 0x14]
push esi
call fcn.566686f2
pop ecx
push esi
call fcn.56668446
pop ecx
push esi
call fcn.5666803a
pop ecx
push esi
call fcn.56667fae
pop ecx
push esi
call fcn.5666798f
pop ecx
push esi
call fcn.5666790f
pop ecx
push esi
call fcn.5666788f
pop ecx
push esi
call fcn.566677b6
pop ecx
push esi
call fcn.566672ab
pop ecx
push esi
call fcn.56666967
pop ecx
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
lea ecx, [ebp - 0x18]
call fcn.5665f161
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40119c
Capabilities:
Check if file exists

Disassembly:
push 0x218
mov eax, 0x402602
call fcn.00402549
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x40301c]
lea eax, [ebp - 0x218]
push eax
call dword [0x403130]
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
test eax, 0xffff0000
jne 0x401207
movzx eax, ax
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00401579
jmp 0x40122d
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40120a
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x218]
mov ebx, eax
push ecx
lea eax, [ebp - 0x21c]
call fcn.004016b3
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.004013c3
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov edi, dword [ebp - 0x21c]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x401291
cmp dword [edi + 0xc], 0
jl 0x401282
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x401282
call fcn.00401781
mov ebx, eax
mov eax, edi
call fcn.004010aa
add ebx, 0x10
mov dword [ebp - 0x21c], ebx
jmp 0x401291
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [ebp - 0x21c]
call fcn.004016b3
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.004010aa
push dword [ebp - 0x21c]
call dword [0x40312c]
test eax, eax
jne 0x4012cc
or esi, 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.004010aa
mov eax, esi
call fcn.00402593
ret
cmp dword [ebp + 8], 1
jle 0x4012e3
push str._mdb_type
lea eax, [ebp - 0x21c]
push eax
call fcn.0040142b
call dword [0x403030]
push eax
call dword [0x403134]
mov edi, eax
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push edi
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 3
call fcn.0040142b
push ecx
mov eax, esp
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], esp
push ecx
push eax
lea ebx, [ebp - 0x21c]
call fcn.00401359
pop ecx
pop ecx
call fcn.004010c2
mov esi, eax
mov eax, dword [ebp - 0x220]
pop ecx
add eax, 0xfffffff0
call fcn.004010aa
jmp 0x4012b6
Function at 0xd367c9
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xd37e27
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0xd50b8e
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xeb7edf
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xeb9841
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xed35d8
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x157176f
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1583e3e
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x158a26b
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x15a5e23
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret