joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6420
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543f48
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4c6459
xor al, al
jmp 0x4c6645
mov ecx, edx
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c6472
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.0040f770
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
push 0x54c8b4
lea ecx, [ebp - 0x40]
call fcn.004c66e0
test eax, eax
je 0x4c64dc
lea eax, [ebp - 0x4c]
push eax
push 0x557870
lea ecx, [ebp - 0x40]
call fcn.004c66e0
test eax, eax
je 0x4c64dc
xor bl, bl
jmp 0x4c6605
mov ecx, dword [ebp - 0x48]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x4c]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jne 0x4c6501
mov bl, al
jmp 0x4c6605
push esi
lea ecx, [ebp - 0x28]
call fcn.004c16f0
mov ecx, dword [ebp - 0x48]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x4c]
mov edi, 1
imul ecx
mov byte [ebp - 4], 2
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jbe 0x4c65af
lea esi, [edi + 0x17]
push 1
push 0x54c8b4
lea ecx, [ebp - 0x28]
call fcn.0040f500
mov eax, dword [ebp - 0x4c]
add eax, esi
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4c6554
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f500
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c6020
add esp, 4
cmp eax, 2
je 0x4c6590
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005224b6
add esp, 4
cmp eax, 0xffffffff
je 0x4c65e3
mov ecx, dword [ebp - 0x48]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x4c]
inc edi
imul ecx
add esi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4c6535
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4c65f1
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c65e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c6661
jmp 0x4c65e7
xor bl, bl
jmp 0x4c65b1
push edx
push ecx
call fcn.004c6c76
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x4c]
call fcn.00448cc0
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4c6643
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c6639
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c6666
push edx
push ecx
call fcn.004c6c76
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
call fcn.0050d599
call fcn.0050d599
int3
Function at 0x4ca101
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4e0740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545191
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x4e08d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e0895
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e0887
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4e0895
add eax, 0x10
push 0x596688
push eax
mov dword [ebp - 0x20], eax
call fcn.004c7002
mov esi, eax
add esp, 8
test esi, esi
je 0x4e0895
push dword [ebp - 0x20]
push 0
push esi
call fcn.00509f10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4e084a
push esi
call fcn.004c6ffd
add esp, 4
jmp 0x4e0895
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e0850
sub ecx, edx
sar ecx, 1
je 0x4e087e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e0866
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00412300
push esi
call fcn.004c6ffd
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4e0895
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4e08b4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00409540
int3
Function at 0x4e08e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4e0904
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x4e0966
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x4e0966
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4e0981
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4e23a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e1f80
Function at 0x4e35d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545473
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0044ea30
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x4e37e3
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x4e37e3
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4e37e3
push eax
call esi
test eax, eax
je 0x4e37e3
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0044e110
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x4e37d4
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00509f10
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e37d4
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x4e36fb
cmp eax, 2
jne 0x4e37d4
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4e371c
test cl, 1
jne 0x4e37d4
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x4e3722
jmp 0x4e37d4
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x4e37d4
lea ecx, [ebp - 0x78]
call fcn.0042aed0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.004e1ac0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x5634ac
push eax
call fcn.004e3be0
push 0x2a
push dword [ebp - 0x78]
call fcn.004e1f80
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x4e37cc
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4e3782
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.004e1880
push dword [0x58f670]
lea eax, [ebp - 0x74]
push dword [0x58f66c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4e37bd
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.00407860
mov edi, 1
jmp 0x4e37d6
lea ecx, [ebp - 0x78]
call fcn.00407860
xor edi, edi
test esi, esi
je 0x4e37e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e37e5
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
Function at 0x4e3820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4e3835
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e3840
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4e6a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e6af1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4e6abf
cmp eax, 2
jne 0x4e6adb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4e6aeb
test ecx, ecx
je 0x4e6ae6
test cl, 1
jne 0x4e6adb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4e6aeb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x52cbf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x59c798]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x52cc34
cmp byte [edx], 0xa
jne 0x52cc34
or byte [eax + edi + 0x28], 4
jmp 0x52cc39
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x52cd2a
mov al, byte [ebx]
cmp al, 0x1a
je 0x52cd0b
cmp al, 0xd
je 0x52cc62
mov byte [esi], al
inc esi
inc ebx
jmp 0x52cd00
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x52cc82
cmp byte [eax], 0xa
jne 0x52cc77
push 2
mov byte [esi], 0xa
pop eax
jmp 0x52cc7d
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x52cd00
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52ccf9
cmp dword [ebp - 0x14], 0
je 0x52ccf9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x59c798]
test byte [eax + edi + 0x28], 0x48
je 0x52ccd0
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x52ccc0
mov byte [esi], dl
jmp 0x52ccfc
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x59c798]
mov byte [eax + edi + 0x2a], dl
jmp 0x52ccfc
cmp byte [ebp - 1], 0xa
jne 0x52cce2
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x52cce2
mov byte [esi], 0xa
jmp 0x52cc7f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0051e297
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x52ccfd
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x52cc4b
jmp 0x52cd2a
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x59c798]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x52cd25
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x52cd2a
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52cd35
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x59c798]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x52cd79
cmp word [edx], bx
jne 0x52cd79
or byte [edi + eax + 0x28], 4
jmp 0x52cd7e
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x52ced2
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x52ceb2
cmp ax, word [ebp - 0x10]
je 0x52cdb7
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x52cea7
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x52cddd
push 0xa
pop ecx
cmp word [eax], cx
jne 0x52cdcd
push ecx
pop eax
push 4
jmp 0x52cdd2
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x52cea1
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52ce98
cmp dword [ebp - 0x18], 0
je 0x52ce98
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x59c798]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x52ce64
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x52ce28
mov word [esi], ax
jmp 0x52ce5c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x59c798]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x59c798]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x59c798]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x52cea7
cmp word [ebp - 4], ax
jne 0x52ce79
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x52ce79
mov word [esi], ax
add esi, 2
jmp 0x52cea7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0051e297
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x52cea4
jmp 0x52ce9b
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x52cd97
jmp 0x52ced2
mov ecx, dword [ecx*4 + 0x59c798]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x52cec9
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x52ced2
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x530075
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052fef2

Function at 0x5311a0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00530e42

Function at 0x536d10
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547640
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x58f574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x536e59
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x536e59
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x536e59
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x536e59
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocStringLen
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x536e45
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x536e3e
cmp dword [ebp - 0x1c], ebx
jne 0x536e3e
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x536ddd
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x536dd7
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x536de9
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040f090
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0043455f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x536e3e
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x58ae5575
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..didat
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x32776603
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0xa79058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a791a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa7907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7906a
add dl, dl
jne 0xa79089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa790dc
xor eax, eax
add dl, dl
jne 0xa79096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7917d
add dl, dl
jne 0xa790a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa790b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa790bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa790c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa790d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa79075
mov eax, 1
add dl, dl
jne 0xa790ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa790f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa790e1
sub eax, ebx
mov ebx, 1
jne 0xa79128
mov ecx, 1
add dl, dl
jne 0xa7910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa79119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa79105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa79075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa7913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa79136
cmp eax, 0x7d00
jae 0xa7916d
cmp eax, 0x500
jb 0xa79168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa79075
cmp eax, 0x7f
ja 0xa79170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa79075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa7919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa79075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4059a6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov esi, eax
jbe 0x4059d1
mov eax, dword [esp + 0xc]
push ebx
mov ecx, esi
sub eax, esi
mov edx, edi
mov bl, byte [eax + ecx]
xor bl, 0x42
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4059c4
pop ebx
push 0x408230
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push esi
call fcn.00404b97
push esi
mov edi, eax
call fcn.00405a0a
add esp, 0x18
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x8ddfac
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddfb2
pop ebp
sub ebp, 6
sub ebp, 0x4ddfac
jmp 0x8de010
jmp 0x8de019
mov eax, 0x4ddfac
add eax, ebp
add eax, 0x93
mov ecx, 0x63c
mov edx, 0x501e2a6c
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de030
jmp 0x8de043
push es
sub al, 4
insb byte es:[edi], dx
jl 0x8de0b5
insb byte es:[edi], dx
add al, 0x6c
mov al, byte [0xac5f6c40]
cmp al, 0x93
stc
push eax
dec ebp
sub byte [esp + edi - 0x19], ch
mov eax, dword [0x6c50e5e7]
insb byte es:[edi], dx
insb byte es:[edi], dx
in eax, dx
lodsd eax, dword [esi]
xchg esp, eax
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
mov eax, dword [0x6c6c6ad4]
insb byte es:[edi], dx
salc
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
wait
mov gs, word [edi - 0x5c]
out 0xed, eax
pushal
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
test eax, 0x59c6043c
insb byte es:[edi], dx
add al, 0x6e
invalid
outsb dx, byte [esi]
pop ebp
outsb dx, byte [esi]
out dx, eax
scasb al, byte es:[edi]
push 0x98e96325
xchg ebx, eax
xchg ebx, eax
xchg ebx, eax
xor dword [esi - 0x1f1893a0], ebp
dec eax
push 0x46c6c6c
invalid
Function at 0x408966
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
mov esi, dword [esp]
add esp, 4
or edi, ecx
call fcn.0040899a
xor dword [ebx], esi
sub ecx, ecx
sub ecx, edi
add ebx, 1
add ecx, 0x2a2dd1c9
sub ecx, ecx
cmp ebx, edx
jne fcn.00408966
add ecx, edi
or edi, edi
ret