joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5acc80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
mov esi, ecx
cmp ebx, dword [ecx + 4]
je 0x5accef
xor edi, edi
jmp 0x5accd0
mov edx, ebx
cmove edx, edi
push eax
push ecx
push dword [ebx + 0x18]
push 0
push edx
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x5acd8a
add ebx, 0x1c
cmp ebx, dword [esi + 4]
mov edi, 0
je 0x5accef
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
sub eax, ecx
cmove ecx, edi
cmp byte [ebx + 0xb], 0
jns 0x5acca3
cmp dword [ebx + 4], 0
je 0x5acceb
mov edx, dword [ebx]
jmp 0x5acca8
xor edx, edx
jmp 0x5acca8
xor eax, eax
dec eax
lea ecx, [ebp - 0xbc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.00482ed0
mov edi, dword [esi + 0xc]
add esi, 0x10
mov bl, 1
mov dword [ebp - 0xc4], esi
cmp edi, esi
jne 0x5acd34
jmp 0x5ace65
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x5acd1c
mov edi, eax
cmp eax, dword [ebp - 0xc4]
mov bl, 1
je 0x5ace65
lea ecx, [edi + 0x10]
cmp byte [edi + 0x1b], 0
mov eax, ecx
jns 0x5acd41
mov eax, dword [ecx]
mov dword [ebp - 0xc0], ecx
lea esi, [ebp - 0xbc]
mov ecx, esi
push 0x20006
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00482fa0
test eax, eax
jne 0x5acdf6
lea ecx, [edi + 0x1c]
push esi
call fcn.005acc80
test al, al
je 0x5ace89
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x5acd1c
mov eax, dword [edi + 8]
cmp dword [eax], edi
mov edi, eax
jne 0x5acd7f
jmp 0x5acd24
mov edi, eax
push 2
call fcn.005079c0
add esp, 4
test al, al
je 0x5acdf2
lea esi, [ebp - 0xb0]
mov ecx, esi
push 2
push 0xfa
push 0x6d968b
call fcn.004904a0
lea eax, [ebp - 0xa8]
push 0x16
push 0x6d9790
push eax
call fcn.004e58e0
add esp, 0xc
push ebx
push eax
call fcn.0048e940
add esp, 8
push 0xb
push 0x6d97a7
push eax
call fcn.004e58e0
add esp, 0xc
mov ecx, eax
push edi
call fcn.00411270
mov ecx, esi
call fcn.00490980
xor ebx, ebx
jmp 0x5ace70
mov ebx, eax
push 2
call fcn.005079c0
add esp, 4
test al, al
je 0x5ace63
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x108
push 0x6d968b
call fcn.004904a0
lea eax, [ebp - 0xa8]
push 0x18
push 0x6d97b3
push eax
call fcn.004e58e0
add esp, 0xc
push dword [ebp - 0xc0]
push eax
call fcn.0048e940
add esp, 8
push 0xb
push 0x6d97a7
push eax
call fcn.004e58e0
add esp, 0xc
mov ecx, eax
push ebx
call fcn.00411270
mov ecx, edi
call fcn.00490980
xor ebx, ebx
lea ecx, [ebp - 0xbc]
call fcn.004830c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 2
call fcn.005079c0
add esp, 4
test al, al
je 0x5ace63
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x10d
push 0x6d968b
call fcn.004904a0
lea eax, [ebp - 0xa8]
push 0x17
push 0x6d97cc
push eax
call fcn.004e58e0
add esp, 0xc
push dword [ebp - 0xc0]
push eax
call fcn.0048e940
add esp, 8
push 0xb
push 0x6d97a7
push eax
call fcn.004e58e0
add esp, 0xc
mov ecx, eax
push 0
jmp 0x5ace57
Function at 0x5c8b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 1
je 0x5c8b32
mov eax, dword [esi]
jmp 0x5c8b38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x5c8b7e
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x5c8b68
cmp byte [esi + 4], 1
je 0x5c8b56
mov eax, dword [esi]
jmp 0x5c8b5c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 1
je 0x5c8b8e
mov eax, dword [esi]
jmp 0x5c8b94
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5c8ba8
xor ebx, ebx
jmp 0x5c8b68
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 1
je 0x5c8bb9
mov eax, dword [esi]
jmp 0x5c8bbf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
jmp 0x5c8b68

Function at 0x5c8ce0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.00553af0
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
jne 0x5c8d19
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x5c8d22
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
Function at 0x5c8da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xb
mov eax, dword [0x6de3f4]
mov al, byte [eax + 0xb]
test al, al
jne 0x5c8fc9
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.004930c0
cmp byte [esi + 0xb], 0
mov dword [esp + 8], ebx
js 0x5c8e8f
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.00508510
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov edi, ebx
mov ecx, dword [esp + 8]
push esi
call fcn.005ce770
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x6d7a42
cmp byte [esp + 0xa3], 0
js 0x5c8ea5
lea ecx, [esp + 0x98]
jmp 0x5c8eac
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.004f8850
jmp 0x5c8e27
mov ecx, dword [esp + 0x98]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x5c8ec4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5c8f45
cmp byte [ebp + 0xc], 0
je 0x5c8f3e
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9e
push 0x6e08c4
push 0x6e08f6
push esi
call fcn.005080c0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.004fdc20
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
call fcn.004fdc90
mov esi, dword [esp + 0x88]
mov ecx, dword [esp + 0xc]
push esi
call fcn.00484970
cmp byte [esp + 0x97], 0
jns 0x5c8f68
push dword [esp + 0x8c]
call fcn.0054fc10
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x5c8f81
push dword [esp + 0x98]
call fcn.0054fc10
add esp, 4
mov dword [esp + 0x20], 0xb
mov eax, dword [0x6de3f4]
mov al, byte [eax + 0xb]
test al, al
jne 0x5c8fab
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00550b46
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push edi
push ecx
push eax
call fcn.004f2710
add esp, 0x10
jmp 0x5c8f95
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], 0x6e08f6
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004f2710
add esp, 0x10
jmp 0x5c8ddb
Function at 0x5c9d60
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x8a
push 0x6e0b70
push 0x6e0d34
push edi
call fcn.005080c0
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.004fdc20
mov ecx, esi
call fcn.0050aa00
test al, al
jne 0x5c9de4
mov esi, dword [esp]
mov ecx, esi
call fcn.0050aa00
test al, al
jne 0x5c9de4
cmp byte [edi + 0xb], 0
jns 0x5c9e11
cmp dword [edi + 4], 0x103
jbe 0x5c9e11
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.004a7410
jmp 0x5c9de6
cmp byte [esi + 0xb], 0
jns 0x5c9e20
cmp dword [esi + 4], 0x103
ja 0x5c9de4
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0x97
push 0x6e0b70
push 0x6e0d34
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x75ab28
push ebx
call fcn.004a7300
cmp byte [esi + 0xb], 0
jns 0x5c9e5f
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x5c9e6b
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x5c9e04
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x5c9e06
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x5c9e06

Function at 0x5ca480
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0050aa00
test al, al
jne 0x5ca49e
mov ecx, esi
call fcn.0050aa00
test al, al
je 0x5ca4a3
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.005c9eb0
Function at 0x5cc650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x75abd4], 0
je 0x5cc688
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x75abd8]
test esi, esi
jne 0x5cc728
push 0xc
call fcn.0054fbd9
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00553af0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.004f1b80
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x5cc6eb
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
je 0x5cc714
add eax, eax
test eax, eax
je 0x5cc714
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x5cc6f1
cmp edx, 0xfffffffe
je 0x5cc714
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.004f1f70
mov ecx, esi
push 9
push 0x6e17a4
call fcn.004f88d0
mov dword [0x75abd8], esi
test byte [0x7561b4], 1
je 0x5cc671
cmp byte [esi + 0xb], 0
jns 0x5cc73d
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x6e16b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x75abd4], eax
inc eax
cmp eax, 1
ja 0x5cc671
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.00553af0
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x5cc851
mov ecx, dword [0x75abd8]
push esi
call fcn.004811b0
mov ecx, dword [0x75abd8]
movsx eax, byte [ecx + 0xb]
test eax, eax
js 0x5cc858
test al, al
je 0x5cc866
mov edx, ecx
cmp word [edx + eax*2 - 2], 0x5c
je 0x5cc7f7
push 1
push 0x6d194c
call fcn.004f88d0
mov ecx, dword [0x75abd8]
push 9
push 0x6e17a4
call fcn.004f88d0
mov eax, dword [0x75abd8]
cmp byte [eax + 0xb], 0
jns 0x5cc810
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x6e16b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x75abd4], eax
inc eax
cmp eax, 1
ja 0x5cc671
mov dword [0x75abd4], 0
xor ebx, ebx
jmp 0x5cc671
mov eax, dword [ecx + 4]
test eax, eax
je 0x5cc866
mov edx, dword [ecx]
jmp 0x5cc7dd
ud2
Function at 0x5d1420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x5d1485
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x5d144a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x5d1499
ja 0x5d14b3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x5d149b
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x5d1491
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x5d14b7
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x5d1491

Function at 0x5d1560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x5d1586
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x5d157e
cmp esi, edi
jge 0x5d1596
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x5d158e
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x5d15b5
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x5d15a8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d55d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x5d56e6
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor esi, esi
xor eax, eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov ecx, edx
shl ecx, 0x10
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0x24], ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, ecx
xor eax, edx
mov esi, eax
shl esi, 0x18
mov ecx, esi
dec esi
not ecx
and esi, ecx
mov ecx, eax
shr ecx, 8
sar esi, 0x1f
mov dword [ebp - 0x20], esi
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, ecx
shl eax, 0x1c
mov esi, eax
not esi
dec eax
and eax, esi
sar eax, 0x1f
mov edi, ecx
shr edi, 4
mov esi, eax
xor edi, ecx
and edi, eax
xor edi, ecx
mov ecx, edi
shl ecx, 0x1e
mov eax, ecx
dec ecx
not eax
and ecx, eax
mov eax, edi
shr eax, 2
sar ecx, 0x1f
mov ebx, ecx
xor eax, edi
and eax, ecx
lea ecx, [edx - 1]
not edx
and ecx, edx
xor eax, edi
shl eax, 0x1f
mov edx, eax
not edx
dec eax
and eax, edx
mov edx, dword [ebp - 0x24]
and edx, 0x10
shr eax, 0x1f
or eax, edx
mov edx, dword [ebp - 0x20]
and edx, 8
or eax, edx
and esi, 4
or eax, esi
mov esi, dword [ebp - 0x28]
sar ecx, 0x1f
and ebx, 2
or eax, ebx
mov edx, ecx
not edx
mov edi, dword [ebp - 0x1c]
or ecx, edi
or edx, edi
add eax, esi
not ecx
and ecx, eax
mov eax, dword [ebp - 0x2c]
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x10]
add esi, 0x20
mov edi, edx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jne 0x5d55f7
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5d56de
Function at 0x5de7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050e5a0
Function at 0x5eadc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor eax, eax
mov ecx, 0xedb88320
mov esi, eax
shr esi, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, esi
mov edi, edx
shr edi, 1
mov esi, eax
shl esi, 0x1e
sar esi, 0x1f
and esi, ecx
xor esi, edi
mov ebx, eax
shl ebx, 0x1d
sar ebx, 0x1f
and ebx, 0x76dc419
mov edi, eax
shl edi, 0x1c
sar edi, 0x1f
and edi, 0xedb8832
xor edi, ebx
mov ebx, eax
shl ebx, 0x1b
sar ebx, 0x1f
and ebx, 0x1db71064
xor ebx, edi
mov edi, eax
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebx
mov ebx, esi
shr ebx, 6
xor edi, ebx
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl esi, 0x1a
sar esi, 0x1f
and esi, ecx
xor esi, edx
mov dword [eax*4 + 0x765db4], esi
inc eax
cmp eax, 0x100
jne 0x5eadcd
mov eax, 0xffffe400
mov ecx, dword [eax + 0x7679b4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [edx*4 + 0x765db4]
mov dword [eax + 0x767db4], ecx
add eax, 4
jne 0x5eae61
mov eax, 0x6472e0
mov dword [0x767db4], eax
mov dword [0x765db0], eax
mov dword [0x767db8], 0x6473a0
call fcn.006475c0
test eax, eax
jne 0x5eaeab
mov dword [0x765db0], 0x6473a0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ee170
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.005ca880
add esp, 4
test al, al
je 0x5ee188
pop ebp
jmp fcn.00487070
mov al, 1
pop ebp
ret
Function at 0x63a010
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
mov edx, dword [0x754040]
xor edx, ebp
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x63a034
mov ecx, dword [ebp + 0x20]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x63a044
mov eax, dword [ebp + 0x18]
xor ebx, ebx
dec ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
push 0x10000000
push ecx
push eax
push edi
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], 0x6ccc24
mov dword [esi + 4], eax
mov byte [esi + 8], 0
mov dword [ebp - 0x130], eax
test eax, eax
je 0x63a176
lea ebx, [ebp - 0x120]
push 0x110
push 0
push ebx
call fcn.00553af0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x6e8bb0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call edi
mov esi, 3
xor ecx, ecx
inc ecx
push esi
push ecx
push edx
push eax
call edi
push esi
mov esi, dword [ebp + 8]
push 0x20
push edx
push eax
call edi
mov dword [ebx - 8], 6
xor ecx, ecx
inc ecx
mov dword [ebx - 4], ecx
mov word [ebx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x63a176
push 0x110
push 0
push ebx
call fcn.00553af0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x6e8bb0]
movups xmmword [esp], xmm0
call edi
mov ebx, 3
push ebx
push 1
push edx
push eax
call edi
push ebx
push 0x20
push edx
push eax
call edi
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x124], ebx
mov word [ebp - 0x18], 0
push edx
push eax
push 0x23
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x63a176
mov dword [ebp - 0x12c], 0xa80
push 4
push edi
push 0x54
push dword [ebp - 0x130]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x63bc90
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx ebx, byte [ecx + 0x88]
movsx eax, byte [ecx + 0xa7]
test eax, eax
js 0x63bd40
lea ecx, [esi + 0x9c]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x63bd55
shl ebx, 0x17
or ebx, 0x100
lea edi, [ebp - 0x1c]
push eax
push ecx
push edi
call fcn.004844c0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x63bcf3
mov edi, dword [ebp - 0x1c]
xor eax, eax
push ebx
push eax
push eax
push eax
push edi
push dword [esi + 0xa8]
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, dword [ebp + 8]
mov dword [esi], 0x6ccc24
mov dword [esi + 4], eax
mov byte [esi + 8], 0
cmp byte [ebp - 0x11], 0
jns 0x63bd2a
push dword [ebp - 0x1c]
call fcn.0054fc10
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0xa0]
test eax, eax
js 0x63bd55
mov ecx, dword [esi + 0x9c]
jmp 0x63bcc1
ud2

Function at 0x63c180
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [ecx + 0x20], 0
je 0x63c206
mov esi, ecx
mov eax, dword [ecx + 0xd0]
mov ecx, dword [ecx + 0xd4]
mov edx, ecx
sub edx, eax
cmp edx, 0x3fff
jbe 0x63c1c5
cmp edx, 0x4000
je 0x63c1e4
add edx, 0xffffc000
dec ecx
cmp edx, ecx
ja 0x63c20e
lea ecx, [eax + 0x4000]
mov dword [esi + 0xd4], ecx
jmp 0x63c1e8
lea ecx, [esi + 0xd0]
mov eax, 0x4000
sub eax, edx
push eax
call fcn.004f1c20
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi + 0xd4]
cmp eax, ecx
je 0x63c20e
sub ecx, eax
push 0
push ecx
push eax
push dword [esi + 0x20]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x63c20b
pop esi
pop ebp
jmp fcn.005991c0
mov eax, 0x800704c7
pop esi
pop ebp
ret
ud2