joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57660570
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov al, byte [0x576876ec]
push ebx
push ebp
mov ebp, ecx
push edi
mov byte [esp + 0x11c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov edx, dword [esp + 0x228]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x22c]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
push 0x576897b0
lea eax, [esp + 0x128]
push str._s_s_d.tmp
push eax
call sub.MSVCRT.dll_sprintf
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x144]
push 0x40000000
push ecx
call fcn.57661420
mov ebx, eax
add esp, 0x30
cmp ebx, 0xffffffff
je 0x57660699
mov dl, byte [0x576876ec]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], dl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SECUPCL6
push eax
call sub.MSVCRT.dll_sprintf
add esp, 8
lea ecx, [esp + 0x18]
lea edi, [esp + 0x1c]
xor eax, eax
push 0
push ecx
or ecx, 0xffffffff
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [esp + 0x228]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x448]
mov esi, dword [eax + 0x104]
cmp esi, eax
je 0x57660691
push esi
mov ecx, ebp
call fcn.576606b0
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push esi
push ebx
mov ecx, ebp
call fcn.57660450
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 0x448]
inc ecx
mov dword [esp + 0x10], ecx
mov esi, dword [esi + 0x104]
cmp esi, eax
jne 0x5766065e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x214
ret 0xc

Function at 0x57660830
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [esp + 0x410]
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call fcn.57661420
mov ebx, eax
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x5766086e
pop esi
xor eax, eax
pop ebx
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x414]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push ecx
call fcn.57661420
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x576608ab
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x408
ret 8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
push eax
push edx
lea eax, [esp + 0x20]
push 0x400
push eax
push esi
mov dword [esp + 0x24], 0
call ebp
test eax, eax
je 0x576608fd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x576608fd
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x20]
push eax
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x576608b3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x408
ret 8
Function at 0x57660920
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov dl, byte [0x576876ec]
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esp + 0x21c]
mov edx, dword [esp + 0x218]
push ecx
push edx
push 0x576897b0
lea eax, [esp + 0x14]
push str._s_s_d.tmp
push eax
call sub.MSVCRT.dll_sprintf
mov edx, dword [esp + 0x228]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
call fcn.57660830
pop edi
pop esi
add esp, 0x208
ret 0xc

Function at 0x576609c0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x448]
test eax, eax
je 0x57660a20
push esi
mov esi, dword [eax + 0x104]
cmp esi, eax
je 0x57660a06
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov edi, dword [esi + 0x104]
push esi
call ebp
test eax, eax
je 0x576609f8
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebx + 0x448]
mov esi, edi
cmp edi, eax
jne 0x576609e2
pop edi
pop ebp
mov eax, dword [ebx + 0x448]
push eax
call sub.MSVCRT.dll_free
add esp, 4
mov dword [ebx + 0x448], 0
pop esi
pop ebx
ret 4

Function at 0x57660af0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x11c]
mov cl, byte [0x576876ec]
push edi
mov dword [esp + 8], eax
mov byte [esp + 0xc], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x114]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x10]
push 0x5768352c
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push 0x20019
push 0
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
je 0x57660b60
xor eax, eax
add esp, 0x10c
ret
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x57660b9c
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10c
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x10c
ret

Function at 0x57660c00
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
lea edx, [esi + 0x198]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
push ecx
push 1
push 2
mov dword [edx + 0xc], ecx
call sub.WS2_32.dll_socket
mov dword [esi + 0x194], eax
inc eax
neg eax
sbb eax, eax
pop esi
and eax, 2
dec eax
ret
Function at 0x57660c40
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x194]
cmp eax, 0xffffffff
je 0x57660c77
push 0
push 3
push 0x5768718c
push eax
call sub.WS2_32.dll_send
mov eax, dword [esi + 0x194]
push 2
push eax
call sub.WS2_32.dll_shutdown
mov ecx, dword [esi + 0x194]
push ecx
call sub.WS2_32.dll_closesocket
pop esi
ret

Function at 0x57660c90
Capabilities:
Connect socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
push ebp
lea edi, [esi + 0x198]
mov word [edi], 2
call sub.WS2_32.dll_htons
mov ebx, dword [esp + 0x14]
mov word [esi + 0x19a], ax
push ebx
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x19c], eax
jne 0x57660ce3
or ecx, eax
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
push ebx
mov ecx, esi
call fcn.57660d20
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x194]
push 0x10
push edi
push eax
call sub.WS2_32.dll_connect
test eax, eax
jge 0x57660d05
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
neg eax
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x57660d20
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, ecx
push ebp
push eax
lea ebp, [ebx + 0x198]
mov word [ebp], 2
call sub.WS2_32.dll_htons
mov ecx, dword [esp + 0xc]
mov word [ebx + 0x19a], ax
push ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x57660d9a
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push esi
mov eax, ecx
push edi
mov esi, dword [edx]
lea edi, [ebx + 0x19c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x10
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x194]
push ecx
call sub.WS2_32.dll_connect
pop edi
pop esi
test eax, eax
jge 0x57660d90
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop ebx
neg eax
ret 0xc
pop ebp
mov eax, 1
pop ebx
ret 0xc
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc

Function at 0x57660db0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x800
mov al, byte [0x576876ec]
push esi
mov esi, ecx
push edi
mov byte [esp + 8], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x80c]
or ecx, 0xffffffff
xor eax, eax
push edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x10]
push str.S_04d_s
push ecx
call sub.MSVCRT.dll_sprintf
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x194]
push 0
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call sub.WS2_32.dll_send
pop edi
pop esi
test eax, eax
jge 0x57660e28
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
add esp, 0x800
ret 4
Function at 0x57660e40
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x118]
push esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x120]
push edi
xor edi, edi
test eax, eax
mov esi, ecx
jle 0x57660f3d
mov ecx, dword [esi + 0x194]
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0x194]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x20]
push 0
push eax
push ecx
call sub.WS2_32.dll_select
test eax, eax
jge 0x57660ec6
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x57660e88
cmp eax, 0x2714
je 0x57660e88
cmp eax, 0x2734
jne 0x57660f51
jmp 0x57660e88
mov eax, dword [esi + 0x194]
lea edx, [esp + 0x18]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x57660f70
mov edx, dword [esi + 0x194]
push 0
lea ecx, [esp + 0xf]
push 1
push ecx
push edx
call sub.WS2_32.dll_recv
cmp eax, 1
jne 0x57660f0a
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0xb]
mov byte [eax], cl
inc eax
mov dword [esp + 0xc], eax
jmp 0x57660f2d
test eax, eax
je 0x57660f5e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x57660f28
cmp eax, 0x2714
je 0x57660f28
cmp eax, 0x2734
jne 0x57660f70
test edi, edi
jle 0x57660f2d
dec edi
mov eax, dword [esp + 0x124]
inc edi
cmp edi, eax
jl 0x57660e66
mov edx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov byte [edx], 0
add esp, 0x114
ret 8
pop edi
pop esi
neg eax
add esp, 0x114
ret 8
cmp edi, 1
jg 0x57660f3d
pop edi
xor eax, eax
pop esi
add esp, 0x114
ret 8
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x114
ret 8

Function at 0x57661130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x57661159
push edi
push str._s_not_exist
call fcn.57653a20
add esp, 8
mov eax, esi
pop edi
pop esi
ret

Function at 0x57661920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x410
mov dx, word [0x576876e8]
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x20e]
mov word [esp + 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push 0x104
push eax
call fcn.57661e50
add esp, 8
lea ecx, [esp + 4]
lea edx, [esp + 0x20c]
push str.NSCEXT2.DLL
push ecx
push 0x57684570
push edx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
je 0x576619b0
cmp eax, 0x10
je 0x576619b0
xor eax, eax
add esp, 0x410
ret
mov eax, 2
add esp, 0x410
ret
Function at 0x57661f30
Capabilities:
Check os version
Read .ini file

Disassembly:
sub esp, 0x5ec
push ebx
push edi
xor ebx, ebx
push str.korean
push ebx
call dword [sym.imp.MSVCRT.dll__wsetlocale]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1ee]
mov word [esp + 0x1ec], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3f6]
mov word [esp + 0x3f4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x5768c7b8]
add esp, 8
cmp eax, ebx
jne 0x57661fe0
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x57661fe0
cmp dword [esp + 0xe0], 2
jne 0x57661fd6
cmp dword [esp + 0xd4], 6
sbb ecx, ecx
add ecx, 3
mov dword [0x5768c7b8], ecx
jmp 0x57661fe0
mov dword [0x5768c7b8], 1
push esi
lea edx, [esp + 0x1e8]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
jbe 0x57662031
mov esi, dword [sym.imp.MSVCRT.dll_swprintf]
lea eax, [esp + 0x1e8]
push eax
lea ecx, [esp + 0x3f4]
push str._spcdrmpolicypcdrm.ini
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x1e8]
push edx
push str._spcdrmdump
push 0x5768c9cc
call esi
add esp, 0xc
jmp 0x5766206d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [esp + 0x3f4]
push str.policypcdrm.ini
push eax
call esi
mov eax, dword [0x5768c7b8]
push 0x104
cmp eax, 3
jne 0x57662061
push 0x57687540
jmp 0x57662066
push 0x57687538
push 0x5768c9cc
call esi
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3f0]
push ecx
push 0x64
push edx
push 0x57687534
push str.Debug
push str.Root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
pop esi
jbe 0x576620d1
lea eax, [esp + 8]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
xor ecx, ecx
test eax, eax
setg cl
pop edi
mov dword [0x5768c7bc], ecx
mov dword [0x5768c7c0], 1
pop ebx
add esp, 0x5ec
ret
mov dword [0x5768c7bc], ebx
pop edi
mov dword [0x5768c7c0], 1
pop ebx
add esp, 0x5ec
ret
Function at 0x57664820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5768e014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x576648b8
push SysReAllocStringLen
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x57664898
xor eax, eax
push ebp
push 0x57664891
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x576648d4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57664898
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
ret
mov ax, word [0x5768e014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5768e014], ax
mov esp, ebp
pop ebp
ret

Function at 0x5766538c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5769003c], 0
je 0x576653ed
cmp word [0x57690210], 0xd7b2
jne 0x576653b5
cmp dword [0x57690218], 0
jbe 0x576653b5
mov eax, 0x5769020c
call dword [0x57690228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x5768e05c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x57665414
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x5768e020], 0
jne 0x57665409
push 0
push 0x5768e054
push 0x5768e05c
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x576665d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x5766663a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.5766576c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.57664714
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x57666624
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57666641
lea eax, [ebp - 0x10]
call fcn.57665508
ret
Function at 0x576677a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x5766783e
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.57665a80
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.576659f0
mov edx, ebp
add dl, 0x30
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x576677c8
cmp byte [esp], 0
je 0x5766780f
mov eax, edi
call fcn.576659f0
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x5766784a
mov eax, edi
call fcn.576659f0
push eax
mov eax, edi
call fcn.576659f0
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.576645ec
mov edx, ebx
mov eax, edi
call fcn.57665a80
jmp 0x5766784a
mov eax, edi
mov edx, 0x57667858
call fcn.5766555c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x57667e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.5766555c
mov eax, ebx
call fcn.576659e8
mov eax, dword [ebx]
call fcn.57665798
test eax, eax
jle 0x57667ec1
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x57667eb6
pop esi
pop ebx
ret

Function at 0x57668690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x576686d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.KERNEL32.dll_IsBadReadPtr
test eax, eax
jne 0x576686ce
cmp word [edi], 0x5a4d
jne 0x576686ce
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x576686ce
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x576686e4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x57668874
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x576688ba
push 0x10000
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
jmp 0x576688eb
push 0x105
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x104
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
push ebx
call sub.KERNEL32.dll_LocalFree
cmp esi, 0xffffffff
je 0x57668948
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x57668916
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x57668928
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x57668942
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.KERNEL32.dll_CloseHandle
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x5766bc2c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
jne 0x5766bca8
cmp dword [esp + 0x10], 0x1000
jne 0x5766bca8
cmp dword [esp + 4], 0
je 0x5766bca8
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x5766bca8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x5766bca8
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x5766bca8
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5766fa38
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
cmp dword [0x5768ee9c], 0xffffffff
jne 0x5766fa87
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x5766fa80
mov eax, esp
mov edx, 0x114
call fcn.57666dd4
mov dword [esp], 0x114
mov eax, esp
push eax
call sub.KERNEL32.dll_GetVersionExW
cmp dword [esp + 4], 6
setae al
and eax, 0x7f
mov dword [0x5768ee9c], eax
jmp 0x5766fa87
xor eax, eax
mov dword [0x5768ee9c], eax
cmp dword [0x5768ee9c], 1
sete al
add esp, 0x114
ret

Function at 0x57670448
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x576704ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x5768ed98]
call fcn.57667e90
push dword [ebp - 0xc]
push 0x57670518
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, dword [0x5768ed9c]
call fcn.57670338
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.57665858
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.57665998
push eax
call fcn.5767014c
mov esi, eax
test esi, esi
je 0x576704e4
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
test eax, eax
je 0x576704de
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57670506
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.5766552c
ret

Function at 0x57670750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x576707b1
mov ebx, 0x71af0000
jmp 0x5767079f
cmp dword [esp + 0x10], 0x10000
jne 0x5767078d
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
jmp 0x576707b1
mov eax, dword [esp + 4]
cmp ebx, eax
jne 0x5767079d
sub ebx, 0x10000
jmp 0x5767079f
mov ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
je 0x5767076d
push 0x40
push 0x1000
push edi
push esi
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x57670a7c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x5768ee88]
cmp eax, 0x1c
jne 0x57670af7
cmp dword [ebp - 0xc], 0x1000
jne 0x57670af2
cmp dword [ebp - 0x18], 0
je 0x57670af2
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x57670af2
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x57670ad1
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x57670af7
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x5768ee58]
cmp eax, 0
je 0x57670af2
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x5768eeb4]
add ebx, dword [ebp - 0x10]
jmp 0x57670a93
popfd
popal
add esp, 0x20
pop ebp
ret 0xc