joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4faf5c
Capabilities:
Create directory

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x4faf84
test dword [0x7eeab0], 0xffffffff
jne 0x4faf84
call fcn.006a7b4c
jmp fcn.004faf5c
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov edi, edx
mov esi, ecx
mov ecx, esi
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fafa8
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4faf93
dec eax
mov ebp, eax
lea ecx, [ebp + 0xa]
call fcn.004dbe28
mov ebx, eax
cmp byte [esi + ebp - 1], 0x5c
je 0x4fb169
push edi
push 0x5c
push esi
push str._s_c_04.4d
push ebx
call fcn.006974c6
add esp, 0x14
movsx eax, byte [ebx]
test eax, eax
je 0x4fb02b
cmp eax, 0x5c
je 0x4fb12e
mov edi, ebx
mov ecx, ebx
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4faffc
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fafe7
dec eax
lea edx, [ebx + eax + 1]
mov esi, ebx
cmp ebx, edx
je 0x4fb127
xor ebp, ebp
mov dword [esp + 8], ebx
movsx ebx, byte [esi]
test ebx, ebx
je 0x4fb01c
cmp ebx, 0x5c
jne 0x4fb020
cmp esi, edi
ja 0x4fb041
inc esi
cmp esi, edx
jne 0x4fb010
mov ebx, dword [esp + 8]
jmp 0x4fb030
mov ebp, 3
mov ecx, ebx
call fcn.004db4f8
mov eax, ebp
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
movsx eax, byte [esi - 1]
cmp eax, 0x3a
je 0x4fb020
cmp eax, 0x5c
je 0x4fb020
xor eax, eax
mov byte [esi], al
push eax
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 4]
cmp eax, 1
je 0x4fb09b
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 4]
mov ebp, eax
mov byte [esi], bl
cmp ebp, 0x35
je 0x4fb100
cmp ebp, 0x7b
je 0x4fb0d7
cmp ebp, 5
je 0x4fb0a4
test ebp, ebp
je 0x4fb020
cmp ebp, 0xb7
jne 0x4fb025
jmp 0x4fb020
mov byte [esi], bl
xor ebp, ebp
jmp 0x4fb020
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nAccess_denied_
push 3
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fbe20
mov edx, dword [esp + 0x14]
add esp, 0x10
test ebp, ebp
je 0x4fb020
mov ebx, dword [esp + 8]
jmp 0x4fb030
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nInvalid_directory_name_
push 3
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fbe20
mov edx, dword [esp + 0x14]
add esp, 0x10
cmp ebp, 5
je 0x4fb0a4
jmp 0x4fb08d
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nNetwork_path_not_found_
push 7
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fbe20
mov edx, dword [esp + 0x14]
add esp, 0x10
jmp 0x4fb08d
xor ebp, ebp
jmp 0x4fb030
cmp byte [ebx + 1], 0x5c
jne 0x4fafe1
lea eax, [ebx + 2]
push 0x5c
push eax
call fcn.00698330
add esp, 8
test eax, eax
je 0x4fb02b
inc eax
push 0x5c
push eax
call fcn.00698330
add esp, 8
mov edi, eax
test edi, edi
je 0x4fb02b
jmp 0x4fafe3
push edi
push esi
push str._s_04.4d
push ebx
call fcn.006974c6
add esp, 0x10
jmp 0x4fafd1
Function at 0x4fb7f0
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, ecx
test edx, edx
jne 0x4fb8a5
mov edx, 0x700ce0
mov eax, dword [esp + 0x14]
cmp eax, edx
je 0x4fb812
mov ebp, 0x700ce0
jmp 0x4fb817
mov ebp, 0x700de0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4fb858
mov esi, ebp
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fb825
mov ecx, dword [esp + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb84a
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb835
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fb85a
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fb85a
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fb91f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fb91f
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fb91f
mov edx, 0x700ce0
mov eax, dword [esp + 0x14]
cmp eax, edx
je 0x4fb8b9
mov ebp, 0x700ce0
jmp 0x4fb8be
mov ebp, 0x700de0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4fb8ff
mov esi, ebp
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fb8cc
mov ecx, dword [esp + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb8f1
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb8dc
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fb901
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fb901
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
mov ecx, ebp
call fcn.004fa844
mov eax, 1
pop ebx
pop ebp
pop esi
pop edi
ret 4
Function at 0x502498
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x5024c0
test dword [0x7eeab0], 0xffffffff
jne 0x502558
call fcn.006a7b4c
jmp fcn.00502498
push edi
push esi
push ebp
push esi
mov eax, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea edi, [eax - 4]
movzx esi, dx
mov edx, esi
shr edi, 0x1f
lea eax, [edi + eax - 4]
sar eax, 1
test eax, eax
je 0x502537
mov dword [esp], ebx
mov edi, esi
shl edi, 8
movzx ebx, byte [ebp]
and esi, 0xffffff00
shr esi, 8
xor ebx, esi
movzx ebx, bl
movzx esi, word [ebx*2 + 0x6f0140]
xor edi, esi
movzx esi, di
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, edx
shl ebx, 8
and edx, 0xffffff00
shr edx, 8
xor edi, edx
and edi, 0xff
movzx edx, word [edi*2 + 0x6f0140]
xor ebx, edx
movzx edx, bx
dec eax
jne 0x5024e3
mov ebx, dword [esp]
shl esi, 0x10
add esi, edx
cmp esi, dword [ecx]
jne 0x502549
xor eax, eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
mov eax, 1
pop ecx
pop ebp
pop esi
pop edi
ret 4
push edi
push esi
push ebp
push esi
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea esi, [edi - 4]
movzx edx, dx
mov eax, edx
shr esi, 0x1f
lea esi, [esi + edi - 4]
sar esi, 1
test esi, esi
je 0x5025d2
mov dword [esp], ebx
movzx edi, byte [ebp]
mov ebx, edx
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl edx, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor edx, ebx
movzx edx, dx
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, eax
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl eax, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor eax, ebx
movzx eax, ax
dec esi
jne 0x50257b
mov ebx, dword [esp]
shl edx, 0x10
add edx, eax
cmp edx, dword [ecx]
jne 0x5025e4
xor eax, eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
mov eax, 1
pop ecx
pop ebp
pop esi
pop edi
ret 4
Function at 0x5025f0
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x502618
test dword [0x7eeab0], 0xffffffff
jne 0x5026a0
call fcn.006a7b4c
jmp fcn.005025f0
push edi
push esi
push ebp
push esi
mov eax, edx
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea edx, [edi - 4]
movzx eax, ax
mov esi, eax
shr edx, 0x1f
lea edx, [edx + edi - 4]
sar edx, 1
test edx, edx
je 0x502690
mov dword [esp], ebx
mov edi, eax
shl edi, 8
movzx ebx, byte [ebp]
and eax, 0xffffff00
shr eax, 8
xor ebx, eax
movzx ebx, bl
movzx eax, word [ebx*2 + 0x6f0140]
xor edi, eax
movzx eax, di
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, esi
shl ebx, 8
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
movzx esi, word [edi*2 + 0x6f0140]
xor ebx, esi
movzx esi, bx
dec edx
jne 0x50263d
mov ebx, dword [esp]
shl eax, 0x10
add eax, esi
mov dword [ecx], eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
push edi
push esi
push ebp
push esi
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea esi, [edi - 4]
movzx eax, dx
mov edx, eax
shr esi, 0x1f
lea esi, [esi + edi - 4]
sar esi, 1
test esi, esi
je 0x50271a
mov dword [esp], ebx
movzx edi, byte [ebp]
mov ebx, eax
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl eax, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor eax, ebx
movzx eax, ax
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, edx
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl edx, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor edx, ebx
movzx edx, dx
dec esi
jne 0x5026c3
mov ebx, dword [esp]
shl eax, 0x10
add eax, edx
mov dword [ecx], eax
pop ecx
pop ebp
pop esi
pop edi
ret 4

Function at 0x502728
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x502750
test dword [0x7eeab0], 0xffffffff
jne 0x5027cc
call fcn.006a7b4c
jmp fcn.00502728
push esi
push ebx
push esi
movzx eax, dx
mov ebx, eax
mov esi, dword [esp + 0x10]
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
test edx, edx
je 0x5027c1
mov dword [esp], edi
mov edi, eax
shl edi, 8
movzx esi, byte [ecx]
and eax, 0xffffff00
shr eax, 8
xor esi, eax
and esi, 0xff
movzx eax, word [esi*2 + 0x6f0140]
xor edi, eax
movzx eax, di
movzx edi, byte [ecx + 1]
add ecx, 2
mov esi, ebx
shl esi, 8
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
movzx ebx, word [edi*2 + 0x6f0140]
xor esi, ebx
movzx ebx, si
dec edx
jne 0x50276c
mov edi, dword [esp]
shl eax, 0x10
add eax, ebx
pop ecx
pop ebx
pop esi
ret 4
push esi
push ebx
push esi
movzx eax, dx
mov ebx, eax
mov esi, dword [esp + 0x10]
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
test edx, edx
je 0x50283e
mov dword [esp], edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
shl eax, 8
movzx esi, word [edi*2 + 0x6f0140]
xor eax, esi
movzx eax, ax
movzx edi, byte [ecx + 1]
add ecx, 2
mov esi, ebx
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
shl ebx, 8
movzx esi, word [edi*2 + 0x6f0140]
xor ebx, esi
movzx ebx, bx
dec edx
jne 0x5027e8
mov edi, dword [esp]
shl eax, 0x10
add eax, ebx
pop ecx
pop ebx
pop esi
ret 4
Function at 0x52a320
Capabilities:
Terminate process

Disassembly:
push edi
push ebp
push ebx
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x52a39c
push dword [edi + 0x14]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x52a398
mov edx, dword [edi + 0x18]
test edx, edx
je 0x52a355
xor eax, eax
push eax
push eax
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [edi + 0xc]
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x52a36a
mov ebx, 1
jmp 0x52a380
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x52a37e
mov ebx, 1
jmp 0x52a380
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov eax, ebx
pop ebx
pop ebp
pop edi
ret
xor ebx, ebx
jmp 0x52a392
xor eax, eax
pop ebx
pop ebp
pop edi
ret

Function at 0x52a3a4
Capabilities:
Create process on windows

Disassembly:
push esi
push ecx
mov eax, 0x154
call fcn.00697340
mov ecx, dword [esp + 0x154]
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x52a3cb
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
xor eax, eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x100], 0x44
mov dword [esp + 0x104], 0
mov dword [esp + 0x12c], 1
mov eax, dword [esp + 0x168]
test eax, eax
je 0x52a47e
mov eax, dword [esp + 0x168]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x164]
cmp eax, 1
je 0x52a499
mov eax, 5
mov word [esp + 0x130], ax
jmp 0x52a4a3
xor eax, eax
mov word [esp + 0x130], ax
xor eax, eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
lea eax, [esp]
push dword [esp + 0x160]
push dword [esi]
push str.__s___s
push eax
call fcn.006974c6
add esp, 0x10
xor eax, eax
lea ecx, [esp + 0x100]
lea edx, [esp + 0x144]
push edx
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x52a50f
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
push dword [esi + 4]
push dword [esp + 0x148]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [esp + 0x154]
push eax
push dword [esp + 0x148]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x154]
cmp eax, 0x103
je 0x52a568
push dword [esp + 0x144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
mov edx, dword [esp + 0x144]
mov dword [esi + 0x10], edx
mov ecx, dword [esp + 0x14c]
mov dword [esi + 0x14], ecx
mov eax, 1
add esp, 0x158
pop esi
ret 0xc
Function at 0x52c440
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x52c468
test dword [0x7eeab0], 0xffffffff
jne 0x52c468
call fcn.006a7b4c
jmp fcn.0052c440
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov edi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [ecx], eax
mov dword [edx], eax
xor esi, esi
mov dword [esp], eax
mov dword [esp + 0xc], edi
lea edx, [esp + 8]
xor eax, eax
push eax
push eax
push edx
mov ecx, dword [esp + 0x18]
push dword [ecx + 0x10]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x52c58a
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x52c52a
inc ecx
call fcn.004dbe28
mov ebp, eax
lea eax, [esp + 4]
push eax
push dword [esp + 0xc]
push ebp
mov edx, dword [esp + 0x18]
push dword [edx + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x52c54d
cmp dword [esp + 4], 0
je 0x52c52a
mov edi, esi
mov eax, dword [esp]
mov ebx, eax
add eax, dword [esp + 8]
mov dword [esp], eax
lea ecx, [eax + 1]
call fcn.004dbe28
mov esi, eax
test edi, edi
je 0x52c507
push ebx
push edi
push esi
call fcn.006a7d10
add esp, 0xc
add ebx, esi
push dword [esp + 8]
push ebp
push ebx
call fcn.006a7d10
add esp, 0xc
mov ecx, edi
call fcn.004db4f8
mov ecx, ebp
call fcn.004db4f8
jmp 0x52c490
mov eax, dword [esp]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [ecx], esi
mov dword [edx], eax
test esi, esi
je 0x52c541
mov byte [esi + eax], 0
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, ebp
call fcn.004db4f8
mov ecx, esi
call fcn.004db4f8
mov eax, dword [edi + 0x4a]
test eax, eax
je 0x52c5c0
mov edx, dword [eax]
push str.Failed_to_Read_nHTTP_Response_
push eax
call dword [edx + 0x48]
add esp, 8
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, esi
call fcn.004db4f8
mov eax, dword [edi + 0x4a]
test eax, eax
je 0x52c5c0
mov edx, dword [eax]
push str.No_HTTP_Response_
push eax
call dword [edx + 0x48]
add esp, 8
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, 1
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8

Function at 0x52c92c
Capabilities:
Send data

Disassembly:
push ebp
push esi
mov ebp, ecx
lea eax, [esp]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x52c96f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x4a]
test eax, eax
je 0x52c976
mov edx, dword [eax]
push str.HTTP_Data_nPosting_failure_
push eax
call dword [edx + 0x48]
add esp, 8
pop ecx
pop ebp
ret 8
xor eax, eax
pop ecx
pop ebp
ret 8
mov eax, 1
pop ecx
pop ebp
ret 8
Function at 0x5475fc
Capabilities:
Initialize winsock library

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x1c8
call fcn.00697340
mov ecx, dword [esp + 0x1c8]
mov ebx, ecx
mov edi, dword [esp + 0x1e0]
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
lea ebp, [ebx + 0xc]
mov ecx, ebp
mov edx, str._tallydata
call fcn.004f5c14
lea ecx, [esp + 0x190]
call fcn.005266d8
cmp dword [ebx + 0xb7], 0
je 0x547661
lea eax, [esp + 0x190]
push str.author.ini
push eax
call fcn.005248fc
jmp 0x547673
lea eax, [esp + 0x190]
push str.Tally.ini
push eax
call fcn.005248fc
add esp, 8
mov ecx, dword [esp + 0x19c]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x5476b4
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x5476b9
mov eax, dword [ecx]
call dword [eax + 0x64]
test eax, eax
je 0x5476b9
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x5476b9
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
jne 0x5476b9
mov esi, 1
cmp esi, 1
je 0x5477e8
test esi, esi
je 0x5477cf
cmp edi, 1
jle 0x547710
mov ecx, dword [ebx + 0xc]
call fcn.004db4f8
mov ecx, ebp
mov eax, dword [esp + 0x1e4]
mov edx, dword [eax + 4]
call fcn.004f5c14
cmp edi, 2
jle 0x547710
mov esi, 1
mov dword [ebx + 0x54], esi
mov eax, dword [esp + 0x1e4]
push dword [eax + 8]
call fcn.006976ae
pop ecx
mov dword [0x7e7fe0], eax
mov dword [0x7e7fe4], esi
cmp dword [ebx + 0xc], 0
je 0x5477be
cmp dword [ebx + 0x14], 0
je 0x547799
mov ecx, dword [ebx + 0xc]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x54773a
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x547725
dec eax
cmp byte [ecx + eax - 1], 0x5c
jne 0x547746
mov byte [ecx + eax - 1], 0
mov ecx, dword [ebx + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x547760
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x54774b
dec eax
cmp byte [ecx + eax - 1], 0x5c
jne 0x54776c
mov byte [ecx + eax - 1], 0
cmp dword [ebx + 0x48], 0
je 0x547790
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp + 0x190]
call fcn.005249d8
add esp, 0x1cc
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov ecx, ebx
call fcn.00547878
jmp 0x547772
lea ecx, [ebx + 0x14]
mov edx, dword [ebx + 0x10]
call fcn.004f5c14
cmp dword [ebx + 0x14], 0
jne 0x547720
lea ecx, [ebx + 0x14]
mov edx, dword [ebx + 0x10]
call fcn.004f5c14
jmp 0x547720
mov ecx, ebp
mov edx, str._tallydata
call fcn.004f5c14
jmp 0x54771a
push 1
push ebx
push 0x5484c8
lea ecx, [esp + 0x19c]
call fcn.00526d7c
jmp 0x5476ca
cmp dword [ebx + 0xb7], 0
je 0x547808
lea eax, [esp + 0x190]
push str.author.ini
push dword [ebx + 0x10]
push eax
call fcn.00524764
jmp 0x54781d
lea eax, [esp + 0x190]
push str.Tally.ini
push dword [ebx + 0x10]
push eax
call fcn.00524764
add esp, 0xc
mov ecx, dword [esp + 0x19c]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x54786e
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x5476c2
mov eax, dword [ecx]
call dword [eax + 0x64]
test eax, eax
je 0x5476c2
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x5476c2
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
jne 0x5476c2
mov esi, 1
jmp 0x5476c2
Function at 0x54c02c
Capabilities:
Enumerate pe sections

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x54c054
test dword [0x7eeab0], 0xffffffff
jne 0x54c0f8
call fcn.006a7b4c
jmp fcn.0054c02c
push edi
push esi
mov edx, dword [esp + 0xc]
lea eax, [edx + 0x18]
lea edi, [ecx + 0x18]
mov dword [esp], edi
cmp edi, eax
jbe 0x54c06e
sub edi, eax
cmp edi, 0xe
ja 0x54c07d
mov edi, dword [esp]
cmp eax, edi
jbe 0x54c07d
sub eax, dword [esp]
cmp eax, 0xe
ja 0x54c07d
movzx eax, word [edx + 0x18]
mov word [ecx + 0x18], ax
movzx edi, word [edx + 0x1a]
mov word [ecx + 0x1a], di
movzx eax, word [edx + 0x1c]
mov word [ecx + 0x1c], ax
movzx eax, word [edx + 0x1e]
mov word [ecx + 0x1e], ax
movzx eax, word [edx + 0x20]
mov word [ecx + 0x20], ax
movzx eax, word [edx + 0x22]
mov word [ecx + 0x22], ax
movzx eax, word [edx + 0x24]
mov word [ecx + 0x24], ax
mov edi, dword [edx]
mov dword [ecx], edi
xor eax, eax
mov dword [edx], eax
movzx edi, word [edx + 4]
mov word [ecx + 4], di
movzx edi, word [edx + 6]
mov word [ecx + 6], di
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov dword [edx + 8], eax
movzx eax, word [edx + 0xc]
mov word [ecx + 0xc], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 0xe], ax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov edx, dword [edx + 0x14]
mov dword [ecx + 0x14], edx
pop ecx
pop edi
ret 4
push edi
mov edx, dword [esp + 8]
movzx eax, word [edx + 0x18]
mov word [ecx + 0x18], ax
movzx eax, word [edx + 0x1a]
mov word [ecx + 0x1a], ax
movzx eax, word [edx + 0x1c]
mov word [ecx + 0x1c], ax
movzx eax, word [edx + 0x1e]
mov word [ecx + 0x1e], ax
movzx eax, word [edx + 0x20]
mov word [ecx + 0x20], ax
movzx eax, word [edx + 0x22]
mov word [ecx + 0x22], ax
movzx eax, word [edx + 0x24]
mov word [ecx + 0x24], ax
mov eax, dword [edx]
mov dword [ecx], eax
xor eax, eax
mov dword [edx], eax
movzx edi, word [edx + 4]
mov word [ecx + 4], di
movzx edi, word [edx + 6]
mov word [ecx + 6], di
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov dword [edx + 8], eax
movzx eax, word [edx + 0xc]
mov word [ecx + 0xc], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 0xe], ax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
pop edi
ret 4
Function at 0x57da28
Capabilities:
Parse url

Disassembly:
push esi
push ebp
push ebx
sub esp, 8
mov ebp, ecx
mov ebx, dword [esp + 0x18]
mov dword [ebp], 0x7f2058
mov dword [esp], 1
lea esi, [ebp + 4]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ebp + 4], 0x3c
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], eax
mov edx, 1
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x24], edx
mov dword [ebp + 0x2c], edx
mov dword [ebp + 0x34], edx
mov dword [ebp + 0x3c], edx
lea edx, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov dword [ebp + 0x44], 1
mov ecx, dword [esp]
inc ecx
call fcn.004dbe28
mov dword [ebp + 0x40], eax
lea edx, [esp]
push 0
push edx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov edx, dword [esp]
mov eax, dword [ebp + 0x40]
xor ebx, ebx
mov byte [eax + edx], bl
mov ecx, dword [ebp + 0x40]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x57dafc
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x57dae7
dec eax
push esi
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x57db1c
mov dword [ebp + 0x44], 0
mov eax, ebp
add esp, 8
pop ebx
pop ebp
pop esi
ret 4
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov byte [edx + ecx], 0
mov eax, ebp
add esp, 8
pop ebx
pop ebp
pop esi
ret 4
Function at 0x580338
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push ebp
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
call fcn.006972f9
pop ecx
mov ebp, eax
call fcn.006972d6
mov ecx, eax
mov eax, ebp
cdq
mov esi, edx
xor edx, edx
add esi, ecx
mov dword [esp], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], edx
lea ecx, [esp + 8]
push 0xf0000000
push 1
push edx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x5803a9
lea eax, [esp]
push eax
push 8
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x58039d
mov dword [esp], ebp
mov dword [esp + 4], esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop ebp
pop esi
ret