joyce8/EMBER2024-capa huggingface dataset:
Function at 0x526bbc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x5811b8
movzx edx, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x526bca
xor ebx, ebx
mov ecx, 0x580db8
mov eax, ebx
mov edx, 8
test al, 1
je 0x526bf9
shr eax, 1
xor eax, esi
jmp 0x526bfb
shr eax, 1
dec edx
jne 0x526bef
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x526be8
pop esi
pop ebx
ret

Function at 0x526c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x580db8
test esi, esi
je 0x526c25
test edi, edi
jg 0x526c2c
xor eax, eax
jmp 0x526d2b
mov ebx, 0xdbc66688
cmp dword [0x580db4], 0
je 0x526c3f
call fcn.00526bbc
xor ebx, 0xffffffff
cmp edi, 8
jl 0x526d07
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x526c4b
test edi, edi
je 0x526d26
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x526d0b
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5272e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5272e9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x52748f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00527628
xor eax, eax
push ebp
push 0x52746d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x527338
call fcn.00404fc4
jmp 0x527474
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x5273fb
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x527389
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x527389
lea eax, [ebp - 0x10]
call fcn.005270a4
push dword [ebp - 0x10]
push 0x5274a8
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5273be
lea eax, [ebp - 0x18]
call fcn.005270a4
push dword [ebp - 0x18]
push 0x5274a8
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0x14]
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x527457
lea eax, [ebp - 0x20]
call fcn.005270a4
push dword [ebp - 0x20]
push 0x5274a8
push ebx
push 0x5274b4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.005272a8
jmp 0x527457
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x52741e
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x52741e
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x527434
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x527457
lea eax, [ebp - 0x24]
mov ecx, 0x5274b4
mov edx, ebx
call fcn.004058fc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005272a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527474
mov eax, dword [ebp - 4]
call fcn.00527634
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527496
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00405608
ret
Function at 0x529330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x529351
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x529363
cmp byte [esi + edi - 1], 0x20
je 0x529350
mov eax, esi
test eax, eax
je 0x52936e
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x529430
cmp byte [esi + edi - 1], 0x2e
je 0x529454
jmp 0x529430
cmp byte [esi + edi - 1], 0x2e
jne 0x5293d8
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x529454
cmp dword [esp + 8], 0xff
jg 0x529454
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x5293bc
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x5293c4
mov bl, 1
jmp 0x5293d2
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x529454
jmp 0x52942f
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x5293fd
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x52942f
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x52940f
cmp byte [esi + edi - 1], 0x20
je 0x5293fc
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x529427
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x529454
jmp 0x52943f
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jle 0x529386
cmp dword [esp + 4], 3
jne 0x529454
cmp dword [esp + 8], 0xff
jg 0x529454
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x533d18
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x581390
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x533d37
mov esi, 1
mov edx, 0x581498
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x533db0
dec ebx
je 0x533dd2
dec ebx
je 0x533df4
dec ebx
je 0x533e15
jmp 0x533e2f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x533e2f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x533e2f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x533e2f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x533da0
inc esi
add edx, 0x40
cmp esi, 9
jne 0x533d53
mov esi, 0x20
mov eax, 0x5813c0
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x533e54
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x533e90
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x581447]
test bl, bl
jbe 0x533ec1
lea eax, [esi + 0x3e0]
call fcn.00533e6c
lea eax, [esi + 0x3fc]
call fcn.00533e6c
dec bl
jne 0x533ea7
mov cl, 0x30
mov edi, 0x581418
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x533ee2
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x533eef
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x533ecb
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x533efc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00533cb0
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x533f18
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00533cb0
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00533cb0
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x533f34
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.00533e90
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x533f5e
mov bl, 1
mov eax, 0x581310
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x533f97
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x533fa4
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x533f83
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x533fce
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.00533d18
jmp 0x533ff5
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.00533d18
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x533ffd
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x533fb6
mov bl, 0x40
mov esi, 0x581350
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x534063
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x534070
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x53404c
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00533cd8
inc ebx
inc esi
cmp bl, 0x41
jne 0x53407e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5341b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x534261
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x53425c
mov eax, ebp
mov edx, 8
call fcn.00405d04
push 1
mov eax, ebp
call fcn.00405ad4
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.00533efc
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53bc44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push 0x53bcd4
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x53bccf
push 0x53bce4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58c534], eax
push 0x58c54c
push 0x40
push 8
mov eax, dword [0x58c534]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x53bc92
mov eax, 0x58c53c
mov ecx, 5
mov edx, dword [0x58c534]
call fcn.0040895c
push 0x53bcec
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58c538], eax
push 0x58c554
push 0x40
push 8
mov eax, dword [0x58c538]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x53bccf
mov eax, 0x58c544
mov ecx, 5
mov edx, dword [0x58c538]
call fcn.0040895c
pop ebx
ret

Function at 0x53c210
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405a64
mov eax, dword [ebp - 8]
call fcn.00405a64
xor eax, eax
push ebp
push 0x53c35d
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040d9cc
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040d9cc
mov eax, dword [ebp - 0x30]
pop edx
call fcn.0040c79c
test eax, eax
jne 0x53c297
mov dword [ebp - 0x22], 4
jmp 0x53c29e
mov dword [ebp - 0x22], 2
lea eax, [ebp - 0x34]
mov ecx, 0x53c374
mov edx, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 0x34]
call fcn.00405a74
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x38]
mov ecx, 0x53c374
mov edx, dword [ebp - 8]
call fcn.004058fc
mov eax, dword [ebp - 0x38]
call fcn.00405a74
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c364
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00405608
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret
Function at 0x5446f0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004055e4
xor eax, eax
push ebp
push 0x544731
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x544840
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54474e
cmp dword [ebp - 4], 0
je 0x544839
xor eax, eax
push ebp
push 0x54478f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00405a74
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5447ac
cmp dword [ebp - 8], 0
jne 0x5447bd
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x544839
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x1e00000
xor edx, edx
push ebp
push 0x5447f2
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
push edx
push eax
push 0x58c6b4
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x544815
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0xc], 0
jbe 0x544839
mov edx, ebx
mov eax, 0x58c6b4
call fcn.0040df2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54559c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x583144]
cmp dword [eax], 0x1e
jge 0x5455b4
mov eax, dword [0x583144]
mov dword [eax], 0x1e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x50]
xor edx, edx
push edx
push eax
mov eax, dword [0x583144]
imul eax, dword [eax], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x5455db
cmp eax, dword [esp]
pop edx
pop eax
jae 0x5455ee
jmp 0x5455df
pop edx
pop eax
jge 0x5455ee
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x50], eax
mov eax, ebx
call fcn.0054bae0
pop ebx
ret
Function at 0x55ee24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x55f029
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
call sub.ole32.dll_OleInitialize
xor eax, eax
push ebp
push 0x55efec
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
xor ecx, ecx
mov edx, 0x628
call fcn.00403e38
lea edx, [ebp - 8]
mov eax, dword [0x582a40]
call fcn.00493928
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x55f038
call fcn.00407444
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x55f048
call fcn.00407444
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405f60
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405f70
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x154]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
lea eax, [ebx + 0x105]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x310]
push eax
push 0x104
lea eax, [ebx + 0x20a]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
lea eax, [ebx + 0x620]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
lea eax, [ebx + 0x624]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x10]
call fcn.00407400
lea eax, [ebp - 0xc]
call fcn.00407400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55eff3
call sub.ole32.dll_OleUninitialize
ret
Function at 0x569ff0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x56a1fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405638
cmp dword [ebp - 4], 0
je 0x56a1cc
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0040c590
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x56a1cc
mov esi, 3
lea ebx, [esi + 0x41]
mov eax, ebx
add al, 0xbc
sub al, 0x17
jae 0x56a12c
lea eax, [ebp - 0x28]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00403d1c
mov edx, 0x56a20c
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x56a12c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
mov eax, dword [0x582924]
mov eax, dword [eax]
call eax
fild qword [ebp - 0x10]
fdiv dword [0x56a210]
fdiv dword [0x56a210]
fdiv dword [0x56a210]
fcomp dword [0x56a214]
wait
fnstsw ax
sahf
jbe 0x56a12c
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.004057cc
push dword [ebp - 0x30]
push 0x56a220
lea eax, [ebp - 0x34]
mov edx, dword [0x5826f8]
add edx, 0x320
call fcn.00405848
push dword [ebp - 0x34]
push 0x56a22c
mov eax, edi
mov edx, 4
call fcn.00405978
jmp 0x56a1cc
inc esi
cmp esi, 0x1a
jne 0x56a05c
xor esi, esi
lea ebx, [esi + 0x41]
mov eax, ebx
add al, 0xbc
sub al, 0x17
jae 0x56a1c2
lea eax, [ebp - 0x28]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00403d1c
mov edx, 0x56a20c
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x56a1c2
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.004057cc
push dword [ebp - 0x38]
push 0x56a220
lea eax, [ebp - 0x3c]
mov edx, dword [0x5826f8]
add edx, 0x320
call fcn.00405848
push dword [ebp - 0x3c]
push 0x56a22c
mov eax, edi
mov edx, 4
call fcn.00405978
jmp 0x56a1cc
inc esi
cmp esi, 0x1a
jne 0x56a138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56a203
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00405608
lea eax, [ebp - 0x24]
call fcn.004055e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret
Function at 0x4010cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010de
mov eax, dword [0x40f08b]
shl eax, 2
mov dword [0x40f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405214
pop edx
call fcn.004045b0
call fcn.00405218
push 0
call fcn.00406490
pop ecx
push 0x40f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40f093], eax
push 0
jmp fcn.0040a264
Function at 0x402e90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x402ec4
mov edx, dword [eax + 8]
test edx, edx
jne 0x402eb3
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x402ec0
add edx, esi
cmp ebx, edx
jb 0x402ed1
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x402ea9
xor eax, eax
pop esi
pop ebx
pop ebp
ret