joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455960
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b49f8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x455999
inc eax
mov dword [esi + 0x10], eax
jmp 0x455aac
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x4559ad
mov eax, 0xffffffc7
jmp 0x455aae
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x4559be
cmp dword [esi + 8], eax
jne 0x4559ad
cmp dword [esi + 8], eax
jne 0x4559d7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4559d7
mov eax, 0xffffffc7
jmp 0x455aae
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4559eb
push eax
mov ecx, ebx
call fcn.00455190
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00423680
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x455a1c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004236a0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00454900
test eax, eax
mov dword [esp + 0x38], eax
je 0x455a4f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5de5b8
call fcn.00423880
mov eax, dword [esp + 0x38]
jmp 0x455aae
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004557c0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x455a93
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004557e0
mov esi, eax
test esi, esi
jne 0x455ac3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004557c0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x455a65
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5de5b8
call fcn.00423880
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5de5b8
call fcn.00423880
mov eax, esi
jmp 0x455aae
Function at 0x45eb40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b5028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4b84b0]
push 0
lea ecx, [esp + 0x20]
call fcn.004ab1d8
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0045e4e0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004ab106
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004a7867
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004a7867
push 1
push 0
push 0
mov ecx, esi
call fcn.004a780f
push 1
push 0
push 1
mov ecx, esi
call fcn.004a780f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ab24a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x45ecc0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b5048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004ab1d8
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0045e4e0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004ab106
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4b84b0]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x45ed84
cmp dword [esp + 0x40], 1
jne 0x45ed82
cmp ecx, eax
jge 0x45ed84
mov eax, ecx
cmp eax, 0xc8
jge 0x45ed90
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0045eb40
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4b84b4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ab24a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x45f500
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b50b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004a5b76
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x5e46a0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x5e1a68
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4b8124]
push eax
mov ecx, edi
call fcn.004ab480
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004ad032
test eax, eax
je 0x45f61c
mov ecx, dword [esp + 0x3c]
call fcn.004ab4ad
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4b8490]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45f5e0
push edi
mov ecx, esi
call fcn.004a89e6
mov ecx, esi
call fcn.0045f780
cmp dword [esp + 0x38], 1
jne 0x45f615
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004a8b50
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x462040
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x462073
push esi
call fcn.00465140
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46206c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4620f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4620e2
mov eax, dword [esi + 8]
test eax, eax
je 0x462097
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4620de
cmp eax, 2
je 0x4620e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46208a
cmp eax, 3
je 0x4620bd
cmp eax, 1
jne 0x46208a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46208a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46208a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00462120
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x462108
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00462120
add esp, 4
pop esi
ret
Function at 0x471927
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5956
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.004a3137
mov eax, dword [0x601860]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0x5e2a3c
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
je 0x471984
push ebx
call dword [0x4b836c]
inc eax
push eax
call fcn.004a4281
add esp, 4
mov dword [esi + 4], eax
push ebx
push eax
call dword [0x4b8340]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x47cb44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x47ccfd
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp

Function at 0x4871e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b6c57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x5e3a5c
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004a2549
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004a2549
mov edi, dword [0x4b86f0]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x5e3a48
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x4b8548]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x4b8128]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.00487d00
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x403990
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, str.checked
mov eax, 0x4150f8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4039c6
test cl, cl
je 0x4039c2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4039c6
add eax, 2
add esi, 2
test cl, cl
jne 0x40399e
xor eax, eax
jmp 0x4039cb
sbb eax, eax
sbb eax, 0xffffffff
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x403a2e
push 0x1f3
push str.Trying_to_restart_shell...
push 0x41a698
call fcn.0040a320
add esp, 0xc
push 0
push esi
call ebx
push 5
push esi
call ebx
push esi
mov dword [0x4150b4], 0
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x403a38
mov dword [0x4150b4], 1
push str.explorer.exe
call fcn.00407f60
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0xc8
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.explorer
call ebp
push 0xbb8
call edi
push 0
push esi
call ebx
push 0
push str.explorer
mov dword [0x4150b4], 1
call ebp
push 0x1388
call edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403a90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, str.checked
mov eax, 0x4150f8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403ac4
test cl, cl
je 0x403ac0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403ac4
add eax, 2
add esi, 2
test cl, cl
jne 0x403a9c
xor eax, eax
jmp 0x403ac9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403b17
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push esi
call edi
push 5
push esi
call edi
push esi
mov dword [0x4150b4], 0
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
ret
pop esi
mov dword [0x4150b4], 1
pop ebx
ret
Function at 0x405730
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0xc
xor eax, eax
lea edx, [esp]
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
push ecx
push eax
mov eax, dword [esp + 0x20]
push 0xc
push edx
push 0x2d1400
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add esp, 0xc
ret

Function at 0x405790
Capabilities:
Get disk information

Disassembly:
sub esp, 0x13c
mov ecx, 6
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, 0x419030
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 6
xor eax, eax
mov edi, 0x41a480
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x1a
dec eax
mov byte [0x41ad40], 0
jne 0x4057bf
mov eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov eax, dword [esp + 0x1c]
mov ebp, 1
mov ecx, ebx
shl ebp, cl
test eax, ebp
je case.0x405825.0
lea esi, [ebx + 0x41]
push esi
push str._c:_
push 0x418fd0
call fcn.0040ad23
add esp, 0xc
push 0x418fd0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.0x405825.0
jmp dword [eax*4 + 0x405934]
push ebp
call fcn.00405770
mov ecx, dword [esp + 0x1c]
add esp, 4
mov byte [ecx + 0x419030], al
mov byte [0x419030], cl
inc ecx
mov dword [esp + 0x18], ecx
jmp case.0x405825.0
push esi
lea ecx, [esp + 0x24]
push str.__c:
push ecx
call fcn.0040ad23
add esp, 0xc
lea edx, [esp + 0x20]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x405825.0
push 0x227
call fcn.0040a584
mov edi, eax
push edi
push esi
mov dword [edi + 4], 0x227
call fcn.00405730
add esp, 0xc
test eax, eax
je 0x4058ed
mov eax, dword [edi + 0x1c]
push ebp
cmp eax, 7
jne 0x4058d0
call fcn.00405770
mov ecx, dword [esp + 0x14]
add esp, 4
mov byte [ecx + 0x41a480], al
mov byte [0x41a480], cl
inc ecx
mov dword [esp + 0x10], ecx
jmp 0x4058ed
call fcn.00405770
mov ecx, dword [esp + 0x18]
add esp, 4
mov byte [ecx + 0x41ad40], al
mov byte [0x41ad40], cl
inc ecx
mov dword [esp + 0x14], ecx
push edi
call fcn.0040a312
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x405825.0
push ebp
call fcn.00405770
mov ecx, dword [esp + 0x14]
add esp, 4
mov byte [ecx + 0x41a480], al
mov byte [0x41a480], cl
inc ecx
mov dword [esp + 0x10], ecx
inc ebx
cmp ebx, 0x20
jb 0x4057e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13c
ret
Function at 0x409400
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x411fd6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410714
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x412017
test byte [esp + 8], 2
je 0x412017
mov dword [0x41c710], 0xd
mov dword [0x41c714], 5
jmp 0x411ff2
xor eax, eax
ret
Function at 0x58c944
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push edi
sub edi, 4
stc
jmp 0x631a66
mov byte [esp], bl
cmp edi, ebx
jmp 0x5f517e
call 0x58de50
add byte [eax], al
inc ebx
jb 0x5f51ed
popal
je 0x5f51f0
push esp
push 0x64616572
add byte [ebp + 0x680a494c], cl
loop 0x5f5208
aas
int3
jmp 0x5f51f4
xchg ecx, eax
invalid
jae 0x5f51bf
lodsb al, byte [esi]
in al, dx
add byte [eax], al
dec edi
insd dword es:[edi], dx
push esp
outsd dx, dword [esi]
inc ebx
push 0x417261
add byte [eax], al
dec ecx
insd dword es:[edi], dx
popal
dec esp
dec esp
imul esi, dword [ebx + 0x74], 0x7465475f
inc edx
imul eax, dword [ebx + 0x6f], 0x6c
outsd dx, dword [esi]
jb 0x5f5218
add byte [eax], al
inc edi
je 0x5f5261
jne 0x5f5292
jb 0x5f5287
outsb dx, byte [esi]
je 0x5f5275
outsd dx, dword [esi]
jae 0x5f5291
je 0x5f5293
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ebp
js 0x5f522f
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x5f52a0
jo 0x5f52b4
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x5f524a
add byte [eax], al
inc edi
je 0x5f5294
jae 0x5f52be
je 0x5f52c4
jo 0x5f52ae
imul ebp, dword [esi + 0x64], 0x9c00776f
push ebp
push dword [eax]
pop dword [esp + 0x44]
pushfd
push dword [esp + 0x48]
ret 0x4c
adc edi, edi
adc bh, byte [edi + 0x7f103f0f]
adc dword [edi + 0x3f117f0e], edi
invalid
adc edi, dword [edi - 2]
push cs
call dword [ecx]
call dword [ebx]
jg 0x5f52a3
adc dword [edi], edi
aas
invalid
aas
invalid
mov edi, 0x3efe7f0f
adc dword [edi], edi
adc edi, edi
push cs
dec dword [esi]
jg 0x5f52c1
invalid
aas
movq qword [edi], mm1
aas
invalid
adc byte ds:[edi + 0x11], bh
mov edi, 0x3f133efe
adc byte [edi], bh
aas
movq mm6, mm7
invalid
invalid
aas
adc al, 0x7f
adc dword [edi + 0x7f117f0e], edi
adc byte [edi + 0xe], bh
invalid
push dword [edi]
pop dword [esp + 4]
jmp 0x58eb10

Function at 0x5f5a47
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushfd
lea esp, [esp + 0x28]
call fcn.005f876f
push eax
lea esp, [esp + 4]
jb 0x58bc45
xadd ax, dx
sar ah, 1
sar dl, 1
push eax
movzx eax, byte [ebp - 2]
mov byte [esp], bh
setno dl
inc dl
shr eax, 5
rol dh, cl
rcl dx, cl
pushal
imul eax, eax, 0x300
sar dl, cl
adc dx, dx
lea eax, [ebx + eax*4 + 0x94d8]
sbb dl, 0xcb
pop edx
mov dword [esp + 0x1c], ecx
xor dx, sp
test bl, dh
test dl, dl
xchg dword [esp + 0x18], ebx
push 0xe116df34
and edx, 0x8c60e14a
bt dx, 0xe
mov ebx, eax
call fcn.0058ca4c
iretd
jmp 0x58c0be
mov edx, edi
aaa
sub edx, dword [ebp + 0xc]
clc
btc ax, di
and edx, 3
bsf ax, cx
mov eax, ecx
clc
test eax, 0xa821113f
pushal
mov word [esp + 4], dx
shl eax, 4
stc
stc
add eax, edx
mov dword [esp + 4], edx
lea esp, [esp + 0x24]
jge 0x631a90
push 0x7add8ff
lea eax, [ebx + eax*4]
jmp 0x5f5bdc
pushfd
jmp 0x631090
lea esp, [esp + 8]
pushfd
mov word [esp], 0xb9af
lea eax, [ebx + eax*4]
pushal
jmp 0x58e881
Function at 0x631060
Capabilities:
Check for vm using instruction vpcext

Disassembly:
shld bx, cx, 7
movzx dx, cl
bts dx, sp
cmc
mov ebx, eax
mov dx, 0x8d74
bsf edx, edi
movsx dx, dl
mov edx, 1
call fcn.0061f531
add byte [eax], al
push esp
jb 0x58c999
arpl word [ebx + 0x50], bp
outsd dx, dword [esi]
jo 0x58c9b3
jo 0x58c98d
outsb dx, byte gs:[esi]
jne fcn.0058c944
add edi, ecx
stc
cmp ecx, 7
pushfd
pushfd
pushfd
mov byte [esp + 8], 0x8a
lea esp, [esp + 0xc]
jb 0x630bc0
xchg cl, al
dec ax
bsr ax, di
mov eax, dword [ebp - 0x20]
clc
cmp ch, al
and dh, dl
not eax
test ebp, 0x43c377ff
cmp cl, al
mov cl, byte [eax + edi]
sub edi, 4
call fcn.005f535c
add byte [eax], al
inc edi
je 0x6310b9
jns 0x6310d3
outsd dx, dword [esi]
popal
jb 0x6310d9
dec esp
popal
jns 0x6310e8
jne 0x6310ef
add byte [eax], al
add byte [ebx + 0x79], dl
jae 0x6310c3
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x74], dx
jb 0x6310f3
outsb dx, byte [esi]
dec esp
outsb dx, byte gs:[esi]
add byte [ebp - 0x17f7db9c], cl
salc
jbe 0x631094
call fcn.005f876f
pushfd
pushal
pushfd
mov byte [esp], ch
call [eax + 0x242c889c]
lea esp, [esp + 0x28]
jb 0x58bc45
daa
stc
movzx eax, byte [ebp - 2]
pushfd
shr eax, 5
clc
imul eax, eax, 0x300
lea edx, [esi + 0x3b81a1c9]
sar dx, 5
bsr dx, di
add byte [ebp - 0x7e5e366a], cl
cmp esp, dword [esi - 0x3f]
cli
add eax, 0xd7bd0f66
stc
lea eax, [ebx + eax*4 + 0x94d8]
pushal
mov dword [esp + 0x20], ecx
and al, 0x20
bsr dx, ax
stc
movsx dx, bl
xchg dword [esp + 0x1c], ebx
bt dx, 0xd
sub esp, 0xffffffe4
ja 0x58c90e
in al, dx
in al, 0xf
xchg dword [esi], ebx
mov eax, 0xf66fff5
mov esp, 0x66c389d6
bt ebp, ebx
jmp dword [esi + 0xf]
bsf dx, si
salc
mov ebx, eax
bt bp, bx
rcr dx, cl
sar dx, cl
btr dx, 0xa
mov edx, 1
jmp 0x5f5ad8

Function at 0x401500
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401526
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4015ba
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401575
cmp eax, 0x40
je 0x401575
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401519
cmp eax, 0x40
je 0x401519
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401519
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]