joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5318d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x5ad240
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x53194d
lea ecx, [ebp + 0x20]
call fcn.004e92c0
shl eax, 1
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp + 0x20]
call fcn.004e9c70
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c70
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5319a2
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x5319a2
lea ecx, [ebp + 0x20]
call fcn.004e92c0
shl eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x20]
call fcn.004e9c70
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c70
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.004e99d0
lea ecx, [ebp + 0x20]
call fcn.004e99d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret 0x30

Function at 0x531cf0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e97d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004e98a0
mov dword [ebp - 0x34], str.SoftwareMacromediaFlashHelper
lea eax, [ebp - 0x2c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x34]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x531d6a
lea ecx, [ebp + 8]
call fcn.004e9c70
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.004e99d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e99d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret 0x18
Function at 0x534ef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 8]
call fcn.004e92b0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004e1e00
add esp, 8
mov dword [ebp - 0x2c], 0x5ac490
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp - 0x2c]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x534fa7
xor eax, eax
mov word [ebp - 0x23c], ax
push 0x206
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.0055ebc0
add esp, 0xc
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x1c]
call fcn.004e92c0
shl eax, 1
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004e9c70
push eax
push 1
push 0
push 0x5ac5e8
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x534ff8
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x534ff8
lea ecx, [ebp - 0x1c]
call fcn.004e92c0
shl eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004e9c70
push eax
push 1
push 0
push 0x5ac6ac
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.004e99d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret 4
Function at 0x535af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f0e7
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
lea ecx, [ebp - 0x230]
call fcn.004e98a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004e98a0
mov byte [ebp - 4], 1
push 0
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x535b6b
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004e9a20
push str._tencentQQPCMgrAdBlockuserconfig.dat
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x26c]
push eax
call fcn.004ee650
add esp, 0xc
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x230]
call fcn.004e9990
lea ecx, [ebp - 0x26c]
call fcn.004e99d0
lea ecx, [ebp - 0x230]
call fcn.004e9c70
push eax
call fcn.004e4770
add esp, 4
test eax, eax
je 0x535bca
mov byte [ebp - 0x249], 1
jmp 0x535bd1
mov byte [ebp - 0x249], 0
mov dl, byte [ebp - 0x249]
mov byte [ebp - 0x24a], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004e99d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004e99d0
mov al, byte [ebp - 0x24a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret
Function at 0x536080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f1f1
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x288], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
lea ecx, [ebp - 0x280]
push ecx
call fcn.004e3b70
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.004e9c70
push eax
push 0x5a70e8
lea edx, [ebp - 0x250]
push edx
call fcn.004e2580
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x284]
push eax
push 0x2001f
push 0
lea ecx, [ebp - 0x250]
call fcn.004e9c70
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x28c], eax
push 0x5a719c
lea ecx, [ebp - 0x238]
call fcn.004e98c0
mov byte [ebp - 4], 2
cmp dword [ebp + 0xc], 0
jne 0x536152
push 0x5a71d8
lea ecx, [ebp - 0x238]
call fcn.004e9a20
jmp 0x536180
cmp dword [ebp + 0xc], 1
jne 0x53616a
push 0x5a7200
lea ecx, [ebp - 0x238]
call fcn.004e9a20
jmp 0x536180
cmp dword [ebp + 0xc], 2
jne 0x536180
push 0x5a7234
lea ecx, [ebp - 0x238]
call fcn.004e9a20
push 0x5a725c
lea ecx, [ebp - 0x268]
call fcn.004e98c0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x28c], 0
jne 0x536252
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.0055ebc0
add esp, 0xc
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
push eax
push 0
lea ecx, [ebp - 0x21c]
push ecx
push 0
lea ecx, [ebp - 0x238]
call fcn.004e9c70
push eax
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x53623d
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
lea ecx, [ebp - 0x238]
call fcn.004e9c70
push eax
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004e9a20
jmp 0x536243
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x536287
lea ecx, [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x250]
call fcn.004e9c70
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x536287
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x268]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004e9920
mov edx, dword [ebp - 0x288]
or edx, 1
mov dword [ebp - 0x288], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x268]
call fcn.004e99d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.004e99d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.004e99d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.004e99d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53d580
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fccd
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0x384
call fcn.00552260
movzx eax, al
test eax, eax
je 0x53d5c5
jmp 0x53d6ab
lea ecx, [ebp - 0x30]
push ecx
call fcn.004e3fe0
add esp, 4
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x38]
add edx, 0x384
mov dword [ebp - 0x34], edx
push 4
lea ecx, [ebp - 0x14]
call fcn.00559260
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.005596c0
push 4
lea ecx, [ebp - 0x18]
call fcn.00559260
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.005522e0
jmp 0x53d61a
lea ecx, [ebp - 0x14]
call fcn.00550600
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.005503f0
movzx eax, al
test eax, eax
je 0x53d69c
lea ecx, [ebp - 0x14]
call fcn.00558c30
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x18
call fcn.004e92b0
push eax
lea ecx, [ebp - 0x78]
push ecx
call fcn.004e1e00
add esp, 8
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.0054bf10
add esp, 0xc
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.004e9c70
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x60]
call fcn.004e99d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.004e99d0
jmp 0x53d612
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004e99d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret
Function at 0x556280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, dword [ebp + 0x18]
and eax, 1
jne 0x5562b4
push 9
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00554a70
add esp, 0x14
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov byte [ebp - 1], 0x3c
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 2], 0x21
lea edx, [ebp - 2]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 3], 0x5b
lea eax, [ebp - 3]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 5], 0x44
lea edx, [ebp - 5]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 6], 0x41
lea eax, [ebp - 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 7], 0x54
lea ecx, [ebp - 7]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 8], 0x41
lea edx, [ebp - 8]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 9], 0x5b
lea eax, [ebp - 9]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.0055a670
mov esi, eax
mov ecx, dword [ebp + 0x14]
call fcn.0055a6a0
add esi, eax
push esi
mov ecx, dword [ebp + 0x14]
call fcn.0055a670
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00554a20
add esp, 0x14
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov byte [ebp - 0xa], 0x5d
lea eax, [ebp - 0xa]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 0xb], 0x5d
lea ecx, [ebp - 0xb]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 0xc], 0x3e
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x556840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, dword [ebp + 0x18]
and eax, 1
jne 0x556874
push 9
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00554a70
add esp, 0x14
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov byte [ebp - 1], 0x3c
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 2], 0x21
lea edx, [ebp - 2]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 3], 0x44
lea eax, [ebp - 3]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 5], 0x43
lea edx, [ebp - 5]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 6], 0x54
lea eax, [ebp - 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 7], 0x59
lea ecx, [ebp - 7]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 8], 0x50
lea edx, [ebp - 8]
push edx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 9], 0x45
lea eax, [ebp - 9]
push eax
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov byte [ebp - 0xa], 0x20
lea ecx, [ebp - 0xa]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.0055a670
mov esi, eax
mov ecx, dword [ebp + 0x14]
call fcn.0055a6a0
add esi, eax
push esi
mov ecx, dword [ebp + 0x14]
call fcn.0055a670
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00554a20
add esp, 0x14
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov byte [ebp - 0xb], 0x3e
lea ecx, [ebp - 0xb]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov ecx, eax
call fcn.00558bc0
lea ecx, [ebp + 0xc]
call fcn.00558c50
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x568bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x584ed5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x615720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0056927e
mov dword [ebp - 0x14], eax
cmp dword [0x61eb04], esi
jne 0x584fc8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x584f55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5850a8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5850a8
push 0x5f3f34
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5850a8
push eax
call ebx
push 0x5f3f40
push edi
mov dword [0x61eb04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x61eb08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5f3f64
push edi
mov dword [0x61eb0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x61eb14], eax
test eax, eax
je 0x584fc5
push 0x5f3f80
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x61eb10], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x584fed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x584fe0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x585002
push 4
pop eax
jmp 0x5850aa
cmp dword [ebp - 0x14], esi
je 0x585002
push dword [0x61eb04]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x584fe7
mov eax, dword [0x61eb10]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x585060
cmp dword [0x61eb14], edi
je 0x585060
push eax
call ebx
push dword [0x61eb14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x585060
test eax, eax
je 0x585060
call ecx
test eax, eax
je 0x585055
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x585055
test byte [ebp - 8], 1
jne 0x585060
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x585090
mov eax, dword [0x61eb08]
cmp eax, edi
je 0x58508d
push eax
call ebx
test eax, eax
je 0x58508d
call eax
mov esi, eax
test esi, esi
je 0x58508d
mov eax, dword [0x61eb0c]
cmp eax, edi
je 0x58508d
push eax
call ebx
test eax, eax
je 0x58508d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x61eb04]
call ebx
test eax, eax
je 0x5850a8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5850aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055e4ed
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x269a6e93
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x56a26ce1
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219