joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5144b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
xor al, al
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [ebx + 0xfc], 0
mov byte [esp + 0x13], al
je 0x51457e
cmp dword [edi + 0x14], 8
lea eax, [ebx + 0xf4]
mov ebp, dword [edi + 0x10]
mov esi, edi
jb 0x5144e1
mov esi, dword [edi]
xor edx, edx
mov ecx, 0x811c9dc5
add ebp, ebp
je 0x514507
nop dword [eax]
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebp
jb 0x5144f0
lea eax, [ebx + 0xf4]
push ecx
push edi
mov ecx, eax
call fcn.00515b50
mov esi, eax
cmp esi, dword [ebx + 0xf8]
je 0x51457e
mov ebp, dword [esp + 0x24]
nop
cmp dword [edi + 0x14], 8
lea ecx, [esi + 8]
mov edx, edi
jb 0x51452d
mov edx, dword [edi]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x514538
mov ecx, dword [ecx]
cmp eax, dword [edi + 0x10]
jne 0x514573
push eax
call fcn.00407970
add esp, 4
test eax, eax
jne 0x514573
push ebp
push dword [esp + 0x24]
lea eax, [esi + 0x20]
push ecx
push eax
push edi
mov ecx, ebx
call fcn.00512c80
mov esi, dword [esi]
mov byte [esp + 0x13], 1
cmp esi, dword [ebx + 0xf8]
jne 0x514520
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
cmp byte [esp + 0x13], 0
jne 0x514681
cmp dword [ebx + 0x11c], 0
je 0x51463d
cmp dword [edi + 0x14], 8
lea eax, [ebx + 0x114]
mov ebp, dword [edi + 0x10]
mov esi, edi
jb 0x51459e
mov esi, dword [edi]
xor edx, edx
mov ecx, 0x811c9dc5
add ebp, ebp
je 0x5145c7
nop dword [eax]
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebp
jb 0x5145b0
lea eax, [ebx + 0x114]
push ecx
push edi
mov ecx, eax
call fcn.00515b50
mov esi, eax
cmp esi, dword [ebx + 0x118]
je 0x51463d
nop word [eax + eax]
cmp dword [edi + 0x14], 8
lea ecx, [esi + 8]
mov edx, edi
jb 0x5145ed
mov edx, dword [edi]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x5145f8
mov ecx, dword [ecx]
cmp eax, dword [edi + 0x10]
jne 0x514636
push eax
call fcn.00407970
add esp, 4
test eax, eax
jne 0x514636
push dword [esp + 0x24]
lea eax, [esi + 0x20]
push dword [esp + 0x24]
push ecx
push eax
push edi
mov ecx, ebx
call fcn.00512c80
mov esi, dword [esi]
mov byte [esp + 0x13], 1
cmp esi, dword [ebx + 0x118]
jne 0x5145e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
cmp byte [esp + 0x13], 0
jne 0x514681
cmp byte [esp + 0x24], 0
jne 0x514681
mov eax, dword [edi + 0x10]
test eax, eax
je 0x514681
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x514655
mov ecx, dword [edi]
cmp eax, 0xd
jne 0x51466c
push eax
mov edx, str.ExecuteAction
call fcn.00407970
add esp, 4
test eax, eax
je 0x514681
push 1
push dword [ebx + 0xc4]
mov ecx, edi
push dword [ebx + 0xc0]
call fcn.00510f50
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x514a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp dword [ebx + 8], 0
je 0x514b47
mov edx, dword [esp + 0x10]
mov edi, edx
push ebp
cmp dword [edx + 0x14], 8
mov ebp, dword [edx + 0x10]
jb 0x514a53
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebp, ebp
je 0x514a71
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x514a60
push esi
push edx
mov ecx, ebx
call fcn.00515b50
pop ebp
cmp eax, dword [ebx + 4]
je 0x514b47
mov edi, dword [esp + 0x14]
lea esi, [eax + 0x20]
cmp edi, esi
je 0x514aa4
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x514a99
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.004082a0
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
cmp ecx, eax
je 0x514ac0
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x514ab9
mov eax, dword [eax]
push edx
push eax
call fcn.004082a0
lea eax, [esi + 0x30]
lea ecx, [edi + 0x30]
cmp ecx, eax
je 0x514adc
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x514ad5
mov eax, dword [eax]
push edx
push eax
call fcn.004082a0
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [edi + 0x48], eax
lea eax, [esi + 0x50]
mov dword [edi + 0x4c], ecx
lea ecx, [edi + 0x50]
cmp ecx, eax
je 0x514b04
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x514afd
mov eax, dword [eax]
push edx
push eax
call fcn.004082a0
lea eax, [esi + 0x68]
lea ecx, [edi + 0x68]
cmp ecx, eax
je 0x514b20
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x514b19
mov eax, dword [eax]
push edx
push eax
call fcn.004082a0
sub esi, 0xffffff80
lea ecx, [edi + 0x80]
cmp ecx, esi
je 0x514b3f
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x514b38
mov esi, dword [esi]
push eax
push esi
call fcn.004082a0
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
Function at 0x515980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582390
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5e8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebx + 8], 0x1642c85
je 0x515b43
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0xb8
mov dword [ebp - 0x1c], 0
call fcn.0052df96
mov esi, dword [ebp + 0xc]
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
lea eax, [edi + 8]
push esi
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.00407250
mov byte [ebp - 4], 1
lea eax, [esi + 0x18]
lea ecx, [edi + 0x20]
push eax
call fcn.00515190
mov dword [ebp - 4], 3
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
mov dword [ebp + 0xc], eax
jb 0x515a23
mov ecx, dword [eax]
mov dword [ebp + 0xc], ecx
xor ecx, ecx
mov esi, 0x811c9dc5
add edx, edx
je 0x515a45
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x515a31
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
movss xmm3, dword [ebx]
inc eax
mov ebx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x5ad9e0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5ad9e0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x515ac8
divss xmm0, xmm3
call fcn.0040b890
call fcn.0054dc30
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x515abb
cmp ebx, 0x200
jae 0x515ab9
shl ebx, 3
cmp ebx, ecx
jae 0x515abb
mov ebx, ecx
push ebx
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.00515d50
jmp 0x515acb
mov ebx, dword [ebp - 0x10]
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b800
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov ecx, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x515b0d
mov dword [ecx + eax*8], edi
jmp 0x515b1f
cmp esi, edx
jne 0x515b16
mov dword [ecx + eax*8], edi
jmp 0x515b23
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x515b23
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0052c2c5
int3
Function at 0x523d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584af5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5e8024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4c], ebx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
cmp dword [ecx + 0x14], 8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 0x596fc0
mov dword [ebp - 0x38], eax
jb 0x523da0
mov ecx, dword [ecx]
cmp dword [edx + 0x10], 0
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x58], 0
mov eax, dword [ecx]
jne 0x523db9
xor edx, edx
jmp 0x523dc1
cmp dword [edx + 0x14], 8
jb 0x523dc1
mov edx, dword [edx]
lea edi, [ebp - 0x54]
push edi
push edx
push 0
lea edx, [ebp - 0x5c]
push edx
push esi
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x44], edi
cmp esi, edi
je 0x523ea1
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x523e96
cmp dword [edx + 0x14], 8
lea eax, [ebx + 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], edx
jb 0x523e02
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
lea eax, [ecx + ecx]
mov ebx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x523e2e
mov edx, dword [ebp - 0x30]
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x523e18
mov edi, dword [ebp - 0x44]
mov edx, dword [esi]
push ebx
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x64]
push edx
push eax
mov ecx, ebx
call fcn.0040b800
mov eax, dword [eax + 4]
test eax, eax
jne 0x523e48
mov eax, dword [ebx + 4]
mov ebx, dword [ebp - 0x4c]
cmp eax, dword [ebx + 0x38]
jne 0x523e96
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
push dword [esi]
mov ecx, ebx
call fcn.005253c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00408570
add esi, 0xc
cmp esi, edi
jne 0x523de1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0042fa50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052df57
mov esp, ebp
pop ebp
ret 0xc
Function at 0x524720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584c46
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
lea edi, [ecx + 2]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x524790
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004082a0
mov dword [ebp - 4], 1
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmp dword [ebp - 0x14], 8
cmovae edi, dword [ebp - 0x28]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x5247e1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x5247d0
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebx + 0x34]
call fcn.0040b800
mov edi, dword [eax + 4]
test edi, edi
jne 0x5247ff
mov edi, dword [ebx + 0x38]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00408570
mov eax, ebx
cmp edi, dword [eax + 0x38]
jne 0x52482d
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x524838
lea eax, [edi + 0x20]
mov ecx, esi
push eax
call fcn.00407250
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052df57
mov esp, ebp
pop ebp
ret 8
Function at 0x5255b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584eed
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5e8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x5255ea
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x52560b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x5255f7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.0040b800
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x52563c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x525787
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x10], 0
call fcn.0052df96
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00429320
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x5ad9e0]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5ad9e0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x525717
divss xmm0, xmm3
call fcn.0040b890
call fcn.0054dc30
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x5256fb
cmp eax, 0x200
jae 0x5256f9
shl eax, 3
cmp eax, ecx
jae 0x5256fb
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00428740
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040b800
mov edx, dword [eax]
jmp 0x52571a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x52574d
mov dword [ecx + eax*8], edi
jmp 0x52575f
cmp esi, edx
jne 0x525756
mov dword [ecx + eax*8], edi
jmp 0x525763
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x525763
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0052c2c5
int3
Function at 0x525980
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569e5d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5e8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00409d30
mov ecx, eax
test ecx, ecx
je 0x525ad5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x525a2c
lea ecx, [eax - 1]
test ecx, ecx
js 0x525adf
cmp ecx, eax
jg 0x525adf
cmp word [edx + ecx*2], 0x5c
jne 0x525a2c
push ecx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040df00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.0047f480
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x525a35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x525a35
push ebx
lea ecx, [ebp - 0x10]
call fcn.0047f480
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x525aa4
push 0x5c
push ecx
call fcn.0052f997
add esp, 8
test eax, eax
jne 0x525a56
or eax, 0xffffffff
jmp 0x525a5a
sub eax, dword [edi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0040df00
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x525a86
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00525980
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x525aa4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x525ac3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409a00
push 0x80070057
call fcn.00409a00
int3
Function at 0x52d329
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5e8024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x52d34e
xor eax, eax
jmp 0x52d3aa
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x52d37b
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x52d37b
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x52d431
cmp dword [edi + 0x4c], 0
je 0x52d3a4
mov ecx, edi
call fcn.0052d00c
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x52d3ba
push dword [edi + 0x4c]
push ebx
call fcn.0052cc3a
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x52d3a9
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0052df57
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x5882c0]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x52d404
sub eax, 1
je 0x52d404
dec eax
sub eax, 1
jne 0x52d3a4
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x52d396
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x52d421
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0053ce65
add esp, 0x10
cmp esi, eax
jne 0x52d3a4
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x52d3a4
mov ax, bx
jmp 0x52d3a9

Function at 0x54717d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00546e2e

Function at 0x547188
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00546fb8

Function at 0x548cca
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548947

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403e60
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x575e00]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00403e50
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0xe], 0x55
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x55
mov eax, dword [str.ivGVPmQDOS]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x507238]
mov dword [ebp - 0x24], ecx
mov edx, dword [0x50723c]
mov dword [ebp - 0x20], edx
mov eax, dword [0x507240]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x507244]
mov dword [ebp - 0x18], ecx
mov dx, word [0x507248]
mov word [ebp - 0x14], dx
lea eax, [ebp - 0x230]
push eax
push 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x43c], 0
jmp 0x403f0f
mov eax, dword [ebp - 0x43c]
add eax, 1
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xb
jae 0x403f2f
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp - 0x43c]
mov al, byte [ebp + ecx - 0x10]
mov byte [ebp + edx - 0x10], al
jmp 0x403f00
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f80d2
mov esp, ebp
pop ebp
ret
Function at 0x4f8c36
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4f8c75
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4f8c75
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4f8c75
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4f8c75
cmp dword [ecx + 0x74], 0xe
jbe 0x4f8c75
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x500abe
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x500b5b
push ebx
push esi
call fcn.00500a87
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00500a1b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x500b08
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x500b5a
push edi
push eax
call fcn.004ff2c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x500b28
call fcn.004ff5fe
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x500b59
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00500a1b
add esp, 0x20
test eax, eax
jne 0x500b47
push edi
call fcn.004ff5fe
jmp 0x500b4f
push ebx
call fcn.004ff5fe
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x501d6a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5093e0
push 0x5093d8
push str.FlsAlloc
push 0x1f
call fcn.00501c29
mov esi, eax
add esp, 0x10
test esi, esi
je 0x501d9e
push dword [ebp + 8]
mov ecx, esi
call dword [0x50714c]
call esi
jmp 0x501da4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x501de8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5093f0
push 0x5093e8
push str.FlsGetValue
push 0x21
call fcn.00501c29
mov esi, eax
add esp, 0x10
test esi, esi
je 0x501e1f
push dword [ebp + 8]
mov ecx, esi
call dword [0x50714c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x501e27
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5093f8
push 0x5093f0
push str.FlsSetValue
push 0x22
call fcn.00501c29
mov esi, eax
add esp, 0x10
test esi, esi
je 0x501e61
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x50714c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x506740
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50676d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50676d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret