joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5618b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5618b8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x561ad0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.0040507c
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.00404ef0
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.00404ef0
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404c28
lea eax, [ebp - 0x20]
mov edx, 0x561aec
call fcn.00404ac8
mov eax, dword [ebp - 0xc]
call fcn.00404cf0
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
jne 0x56193e
mov eax, dword [ebp - 0xc]
call fcn.00404cf0
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.00404f90
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404d3c
mov eax, dword [ebp - 0x24]
call fcn.00409c9c
test al, al
jne 0x561a00
xor eax, eax
push ebp
push 0x5619d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403bcc
mov dword [ebp - 8], eax
call fcn.0040bba4
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040b4f8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x561b00
call fcn.00404d3c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404d3c
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5619f4
mov dword [ebp - 4], 0x1e
jmp 0x561aa8
xor eax, eax
push ebp
push 0x561a64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403bcc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404d3c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0x10]
mov edx, 0x561b0c
mov eax, dword [ebp - 8]
call fcn.0041f304
mov eax, dword [ebp - 0x10]
call fcn.0040b5b0
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x561a84
call fcn.0040bba4
fsubr qword [ebp - 0x18]
call fcn.00402d8c
add eax, 0x1e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x561aa3
cmp dword [ebp - 4], 0x1e
jle 0x561aa8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561ad7
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404a54
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a54
ret
Function at 0x56b128
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffac
mov esi, eax
test esi, esi
jne 0x56b13f
mov eax, 4
jmp 0x56b331
mov al, byte [esi]
sub al, 1
jb 0x56b151
je 0x56b15d
dec al
je 0x56b185
sub al, 4
je 0x56b169
jmp 0x56b177
mov eax, esi
call fcn.0056b004
jmp 0x56b331
mov eax, esi
call fcn.0056b0f4
jmp 0x56b331
mov byte [esi + 1], 0
mov eax, 4
jmp 0x56b331
mov byte [esi + 1], 4
mov eax, 4
jmp 0x56b331
mov cl, byte [esi + 9]
mov dl, byte [esi + 8]
mov al, byte [esi + 2]
call fcn.0056b09c
mov ebx, eax
test bl, bl
jne 0x56b1a7
mov byte [esi + 1], 0x82
mov eax, 0x82
jmp 0x56b331
cmp byte [esi + 0x30], 0x12
jne 0x56b1f1
mov al, byte [esi + 2]
cmp al, byte [0x5d76e4]
jb 0x56b1c6
mov byte [esi + 1], 0x81
mov eax, 0x81
jmp 0x56b331
mov byte [esi + 1], 1
mov edx, dword [esi + 0x10]
xor eax, eax
mov al, bl
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax*8 + 0x5d76f4]
mov ecx, 0x24
call fcn.00402aec
mov eax, 1
jmp 0x56b331
xor eax, eax
mov al, bl
mov edi, eax
add edi, edi
lea edi, [edi + edi*4]
cmp dword [edi*8 + 0x5d76f0], 0xffffffff
jne 0x56b219
mov al, byte [edi*8 + 0x5d76eb]
call fcn.0056ade8
mov dword [edi*8 + 0x5d76f0], eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x50
call fcn.004033fc
mov al, byte [esi + 3]
test al, 8
je 0x56b237
mov byte [esp + 0xc], 1
jmp 0x56b247
test al, 0x10
je 0x56b242
mov byte [esp + 0xc], 0
jmp 0x56b247
mov byte [esp + 0xc], 2
mov word [esp + 4], 0x2c
mov al, byte [esi + 0x15]
mov byte [esp + 0xa], al
mov dl, byte [esi + 0x14]
mov byte [esp + 0xb], dl
mov edx, dword [esi + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x78
mov edx, dword [esi + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0x30
xor ecx, ecx
mov cl, al
lea edx, [esp + 0x20]
lea eax, [esi + 0x30]
call fcn.00402aec
mov ebp, 0x50
push 0
lea eax, [esp + 4]
push eax
push ebp
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x18]
push eax
push 0x4d014
mov eax, dword [edi*8 + 0x5d76f0]
push eax
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
cmp byte [esp + 6], 0
sete dl
test dl, al
je 0x56b2cc
mov byte [esi + 1], 1
jmp 0x56b2e9
mov byte [esi + 1], 4
xor ecx, ecx
mov cl, byte [esp + 0xb]
lea edx, [esi + 0x40]
lea eax, [esp + 0x34]
call fcn.00402aec
mov al, byte [esp + 6]
mov byte [esi + 0x17], al
cmp byte [0x5d4554], 0
je 0x56b32c
xor eax, eax
mov al, bl
add eax, eax
lea eax, [eax + eax*4]
cmp dword [eax*8 + 0x5d76f0], 0xffffffff
je 0x56b32c
xor eax, eax
mov al, bl
mov edi, eax
add edi, edi
lea edi, [edi + edi*4]
mov eax, dword [edi*8 + 0x5d76f0]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
je 0x56b32c
mov dword [edi*8 + 0x5d76f0], 0xffffffff
xor eax, eax
mov al, byte [esi + 1]
add esp, 0x54
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56b398
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x56b4b3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5d495c], 0
je 0x56b3c1
xor ebx, ebx
jmp 0x56b495
mov byte [ebp - 5], 0
mov byte [0x5d4550], 0
mov eax, 0x5d76e4
xor ecx, ecx
mov edx, 0x874
call fcn.004033fc
mov bl, 0x1b
mov eax, 0x5d76f0
mov dword [eax], 0xffffffff
add eax, 0x50
dec bl
jne 0x56b3e4
mov bl, 2
mov esi, 0x5d7788
lea eax, [ebp - 0xc]
mov edx, ebx
add dl, 0x41
call fcn.00404c18
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x56b4cc
call fcn.00404d3c
lea eax, [ebp - 4]
call fcn.00404f48
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 5
jne 0x56b43b
mov edx, esi
mov eax, ebx
call fcn.0056aeb4
cmp byte [esi + 4], 0
je 0x56b43f
inc byte [ebp - 5]
jmp 0x56b43f
mov byte [esi + 1], 0x78
inc ebx
add esi, 0x50
cmp bl, 0x1b
jne 0x56b3f8
call fcn.0056b374
mov byte [0x5d76e4], al
cmp byte [0x5d4550], 0
je 0x56b48b
mov bl, 0x19
mov eax, 0x5d778c
cmp byte [eax], 0
je 0x56b47a
cmp byte [eax - 2], 0xfa
jne 0x56b47a
mov byte [eax - 2], 0
mov dl, byte [0x5d76e4]
mov byte [eax - 4], dl
add eax, 0x50
dec bl
jne 0x56b462
call fcn.0056b374
mov byte [0x5d76e4], al
mov byte [0x5d495c], 1
mov bl, byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b4ba
lea eax, [ebp - 0xc]
call fcn.00404a30
lea eax, [ebp - 4]
call fcn.00404a30
ret
Function at 0x58b224
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58b44a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x58b427
mov eax, dword [0x5d4cf0]
mov eax, dword [eax]
call fcn.005c1a4c
test al, al
je 0x58b427
mov eax, dword [0x5d560c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a00bc
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x58b31e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov edx, dword [0x5d5508]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x58b464
call fcn.00404d3c
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x41b6b4]
call fcn.004206c8
mov dword [ebp - 0xc], eax
push 0xffff
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34c]
call fcn.00438ca8
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41b6b4]
call fcn.004206c8
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00420234
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0042044c
mov eax, dword [ebp - 0xc]
call fcn.00403bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x58b35a
mov eax, dword [ebp - 8]
call fcn.004201b0
mov dword [ebp - 0x10], eax
mov edx, dword [0x5d5508]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004f92d0
test al, al
jne 0x58b396
mov eax, dword [ebp - 8]
call fcn.00403bfc
mov eax, dword [0x5d560c]
mov eax, dword [eax]
xor edx, edx
call fcn.004a00bc
jmp 0x58b427
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403bfc
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x34c]
call fcn.00438ca8
mov eax, dword [ebp - 0x1c]
mov edx, 0x58b47c
call fcn.004fe090
mov eax, dword [0x5d560c]
mov eax, dword [eax]
xor edx, edx
call fcn.004a00bc
mov byte [ebp - 1], 1
push 0x44
mov ecx, 0x58b48c
mov edx, 0x58b49c
mov eax, dword [0x5d51bc]
mov eax, dword [eax]
call fcn.004a2384
cmp eax, 6
jne 0x58b427
push 5
push 0
push 0
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x34c]
call fcn.00438ca8
mov eax, dword [ebp - 0x20]
call fcn.00404ef0
push eax
push 0x58b4c0
mov eax, ebx
call fcn.00487714
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b451
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404a54
lea eax, [ebp - 0x14]
call fcn.00404a30
ret

Function at 0x58f1c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, 0x600
push ebx
push 0x160
mov eax, dword [ebp + 8]
add eax, 0xfffffea0
push eax
push 0
mov eax, esi
call fcn.00404ef0
push eax
call sub.shell32.dll_SHGetFileInfoA
pop esi
pop ebx
pop ebp
ret
Function at 0x58f744
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x58f868
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
mov eax, dword [0x5d5508]
mov eax, dword [eax]
mov edx, 0x58f880
call fcn.004f9fd4
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x4c0]
add eax, 0x78
call fcn.00404a84
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x58f830
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x4c0]
call fcn.00438ca8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004091f8
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x5d5508]
mov eax, dword [eax]
mov edx, 0x58f880
call fcn.004f9fd4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004091f8
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404e3c
je 0x58f830
push 0
lea ecx, [ebp - 0x18]
mov eax, dword [0x5d5508]
mov eax, dword [eax]
mov edx, 0x58f880
call fcn.004f9fd4
mov eax, dword [ebp - 0x18]
call fcn.00404ef0
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x4c0]
call fcn.00438ca8
mov eax, dword [ebp - 0x1c]
call fcn.00404ef0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x58f82e
mov eax, 0x13ec
call fcn.004fc4cc
jmp 0x58f830
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f86f
lea eax, [ebp - 0x1c]
call fcn.00404a30
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404a54
lea eax, [ebp - 0xc]
call fcn.00404a30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a54
ret
Function at 0x590044
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x59004d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x590291
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.00404ac8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00409448
mov eax, dword [ebp - 0x14]
mov edx, 0x5902ac
call fcn.00404e3c
jne 0x59009d
lea eax, [ebp - 8]
call fcn.00404a30
mov eax, dword [edi + 0x47c]
add eax, 0x60
mov edx, dword [ebp - 4]
call fcn.00404a84
cmp dword [ebp - 8], 0
je 0x5900f2
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
je 0x5900cc
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x5902ac
call fcn.00404d3c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00409448
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x5d5508]
mov edx, dword [edx]
mov eax, dword [edi + 0x47c]
add eax, 0x78
call fcn.00404d3c
jmp 0x590113
mov edx, dword [0x5d5508]
mov edx, dword [edx]
mov eax, dword [edi + 0x47c]
call fcn.00438d10
mov eax, dword [edi + 0x47c]
add eax, 0x78
call fcn.00404a30
mov eax, dword [edi + 0x47c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x590276
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x47c]
call fcn.00438ca8
lea ecx, [ebp - 8]
mov eax, dword [0x5d5508]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.004f9ef4
cmp dword [ebp - 8], 0
jne 0x59026a
push 0x24
mov ecx, 0x5902b0
mov edx, 0x5902bc
mov eax, dword [0x5d51bc]
mov eax, dword [eax]
call fcn.004a2384
cmp eax, 6
jne 0x590276
lea eax, [ebp - 8]
mov edx, 0x590304
call fcn.004f9d7c
test al, al
je 0x590276
mov eax, dword [ebp - 8]
mov edx, 0x5902ac
call fcn.00404e3c
jne 0x59019d
lea eax, [ebp - 8]
call fcn.00404a30
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040a19c
cmp dword [ebp - 0x10], 0
je 0x5901c6
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5c
je 0x5901c6
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x5902ac
call fcn.00404d3c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404cf8
mov edx, dword [0x5d5508]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00404d3c
mov eax, dword [ebp - 0x1c]
call fcn.00409c9c
test al, al
je 0x59022c
push 0x24
push 0x590338
push dword [ebp - 0x10]
push 0x590344
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x20]
call fcn.00404ef0
mov edx, eax
mov ecx, 0x590364
mov eax, dword [0x5d51bc]
mov eax, dword [eax]
call fcn.004a2384
cmp eax, 6
jne 0x590276
push 0
mov edx, dword [0x5d5508]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.00404d3c
mov eax, dword [ebp - 0x24]
call fcn.00404ef0
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ef0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x590276
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404a84
mov bl, 1
jmp 0x590276
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404a84
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590298
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00404a54
ret
Function at 0x5a9da8
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x5a9dc0
push 0x5a9ddc
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x5a9de4
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x5a9dfc
push 0x5a9e24
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x5a9e2c
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x5a9e40
push 0
push eax
call sub.shell32.dll_ShellExecuteA
ret
Function at 0x5c8134
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0x158]
mov edx, dword [0x40850c]
call fcn.00405448
xor eax, eax
push ebp
push 0x5c83c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x15c]
mov ecx, 0x5c83dc
mov edx, esi
call fcn.00404d3c
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.00409ea0
test eax, eax
jne 0x5c8390
mov eax, dword [ebp - 0x14c]
mov edx, 0x5c83ec
call fcn.00404e3c
je 0x5c8372
mov eax, dword [ebp - 0x14c]
mov edx, 0x5c83f8
call fcn.00404e3c
je 0x5c8372
test byte [ebp - 0x150], 0x10
je 0x5c82ec
push esi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x160]
call fcn.00409cac
test al, al
je 0x5c82ec
push edi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x164]
call fcn.00409cac
test al, al
jne 0x5c828f
push edi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x168]
call fcn.0040a3c8
test al, al
je 0x5c8392
mov eax, dword [ebp + 8]
push eax
push edi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x16c]
push eax
push esi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x170]
pop edx
call fcn.005c8134
pop ecx
test al, al
je 0x5c8392
jmp 0x5c8372
push esi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x174]
call fcn.00409c9c
test al, al
je 0x5c8372
push 0
push edi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x178]
call fcn.00404ef0
push eax
push esi
push 0x5c8404
push dword [ebp - 0x14c]
lea eax, [ebp - 0x17c]
mov edx, 3
call fcn.00404db0
mov eax, dword [ebp - 0x17c]
call fcn.00404ef0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x5c8392
lea eax, [ebp - 0x158]
call fcn.00409ef0
test eax, eax
je 0x5c81cd
lea eax, [ebp - 0x158]
call fcn.00409f14
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c83c8
lea eax, [ebp - 0x17c]
mov edx, 9
call fcn.00404a54
lea eax, [ebp - 0x158]
mov edx, dword [0x40850c]
call fcn.00405518
ret

Function at 0x5c97fc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
mov esi, eax
mov ebx, 0x101
push ebx
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, esi
call fcn.00404ef0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x160]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408f6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x408f9e
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408e6c
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00408e6c
jmp 0x40906d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x408fc9
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408e6c
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
call fcn.00408e6c
jmp 0x40906d
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x408fe4
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408e6c
jmp 0x40906d
invalid
movzx edx, word [ebp + 8]
cmp edx, 0x7ff
jg 0x40901d
movzx eax, word [ebp + 8]
sar eax, 6
or eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
jb 0x408fdc
xchg edx, eax
dec ebx
push edx
arpl word [eax - 0x1ab365af], bx
scasb al, byte es:[edi]
in al, 0xab
add byte [ecx - 0xe], bl
dec edx
cmp byte [edx + 0x76], 0x7e
retf 0xa26e
cmp dh, byte [edx + 0x63fd7a48]
and dl, byte [ecx + esi*8 - 0x104eb51e]
and ebx, dword [edx + 0x6a625a82]
cli
inc edx
jp 0x4090a9
retf 0x6efb
stosd dword es:[edi], eax
adc ebx, dword [esi + 0xa93d3d1]
pop ecx
pop ecx
mov bl, 0x78
jmp 0x409094
and ebp, dword [ebp + 0xa]
jle 0x4090fb
cmp ecx, edx
sahf
adc byte [eax - 0x2e87a9fd], ch
Function at 0x40e5d6
Capabilities:
Encode data using xor

Disassembly:
lahf
loop 0x40e4e9
dec eax
cmpsb byte [esi], byte es:[edi]
dec edx
or al, 0x66
mov cl, 0x3f
mov esp, 0xb1d295c1
add ch, 0xb
je 0x40e4c7
test dword [ebp - 0x75], esi
mov esp, esi
das
popfd
sbb eax, 0xaabe3a71
in al, 0xc1
insd dword es:[edi], dx
retf
arpl word [edx + 0x2f022e45], si
inc ebp
add ch, byte cs:[edi]
jecxz 0x40e4a2
rcr dword [edx], cl
dec edi
pop ecx
sbb cl, byte [edi + 0x59]
mov eax, 0xcade6e4d
mov al, byte [0x8325eb6f]
inc byte [ecx + 0x1af08978]
ja 0x40e4f4
jno 0x40e4c9
or byte [ebp - 0x59e2fdec], 0x8b
arpl word [ebp + 0x222578b], dx
pop ss
add bl, byte [0x95638ba6]
mov edx, dword [edi + 0x22]
add dh, bl
pop ss
and dword [ecx + 8], edx
xor edx, dword [0x64b30771]
enter 0xffffffffffff892e, 0xffffffffffffff8f
cmc
shl ch, 0xfb
xchg ecx, eax
add ah, al
invalid
jecxz 0x40e4ce
xor ecx, dword [ebx - 0x218fe189]
sbb esp, dword [edi + 0x6c51057f]
ljmp 0xb646
cmp al, 0xf6
sal ecx, 1
daa
das
pushfd
stosb byte es:[edi], al
xor edi, ebp
add al, 0x73
mov esi, 0xfc61590a
outsb dx, byte [esi]
loope 0x40e5c2
sbb edi, dword [edi]
xor dword [ebp + 0x46], edi
fbld tbyte [eax + 0x75]
hlt
push es
loopne 0x40e515
jno 0x40e59b
cmp dword [0x8929c74], eax
dec esi
jb 0x40e5b5
ljmp 0x2191:0x52986998
push edx
xchg ecx, eax
and dword [edi], ebx
xor ecx, esi
lahf
mov edi, 0x17d0964c
sal byte [esi - 0x1d6ff45d], cl
or ecx, ebp
mov ch, 0xaf
push 0xffffffffffffffc1
movsb byte es:[edi], byte [esi]
jne 0x40e565
shl dword [ebp + esi*2 - 0x8715354], 0xe8
xchg ebx, eax
fdiv st(0)
aad 0x60
lodsb al, byte [esi]
invalid
inc edx
dec ebp
push ecx
lodsd eax, dword [esi]
iretd
sbb byte [edx], al
mov word [esi + 0x3b], fs
jp 0x40e589
aas
cmpsb byte [esi], byte es:[edi]
mov word [ecx + 0x4a1e0fcf], es
ja 0x40e581
wait
pop edx
inc edx
movsd dword es:[edi], dword [esi]
stc
jle 0x40e62c
or eax, 0xcd0d69f6
fdiv dword [ecx - 0x7f432c53]
adc dh, byte ds:[eax - 0x36]
mov esi, 0x604d9910
xor byte [esi], ch
ud1
out 0xdb, al
mov edx, 0x8fd9320c
push 0x17
pop ss
test eax, 0xc3109e55
push ebp
lahf
xor dword [ebp - 0x7c1d7957], edx
das
inc esp
push cs
push es
sbb edx, dword [edx + 0x6be1c20]
jbe 0x40e60e
pop edi
sub dword [ebp - 0x74], edi
into
retf

Function at 0x4205ac
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
sub dword [ecx - 0x35], 0x2ce5ee45
pop edi
xchg esi, eax
nop
invalid