joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50067e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x50071b
push ebx
push esi
call fcn.00500647
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004fee57
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5006c8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x50071a
push edi
push eax
call fcn.004f7458
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5006e8
call fcn.004f4e90
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x500719
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004fee57
add esp, 0x20
test eax, eax
jne 0x500707
push edi
call fcn.004f4e90
jmp 0x50070f
push ebx
call fcn.004f4e90
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x50071e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x50072f
pop esi
ret
push ebx
push edi
push esi
call fcn.00500647
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004f7458
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x500757
push ebx
push esi
push edi
call fcn.004db630
add esp, 0xc
push 0
call fcn.004f4e90
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x500eb1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005009cc

Function at 0x502fe8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004f5493
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x503057
cmp esi, dword [ebp - 4]
je 0x503052
cmp dword [ebp + 0xc], 0
je 0x503052
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x50302f
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00502b3a
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x503059
xor eax, eax
inc eax
jmp 0x503059
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5030be
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x56a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004f5493
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004f5493
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x503135
cmp word [ecx], dx
je 0x503135
mov eax, dword [0x543594]
push edi
dec eax
push eax
push 0x543480
call fcn.0050305d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5031a8
cmp word [eax], dx
je 0x5031a8
mov eax, dword [edi]
test eax, eax
je 0x503159
cmp word [eax], dx
je 0x503159
lea eax, [ebp - 0x10]
push eax
call fcn.00502a40
jmp 0x503162
lea eax, [ebp - 0x10]
push eax
call fcn.00502adb
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5031d2
mov eax, dword [0x54347c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x543170
call fcn.0050305d
add esp, 0xc
test al, al
je 0x5031d2
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x50319d
cmp word [eax], di
je 0x50319d
lea eax, [ebp - 0x10]
push eax
call fcn.00502a40
pop ecx
jmp 0x5031d4
lea eax, [ebp - 0x10]
push eax
call fcn.00502adb
jmp 0x50319a
mov eax, dword [edi]
test eax, eax
je 0x5031bf
cmp word [eax], dx
je 0x5031bf
lea eax, [ebp - 0x10]
push eax
call fcn.005029f5
pop ecx
jmp 0x5031d2
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x50329d
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00502ee2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x50329d
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x50329d
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x50329d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x50322a
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004f6f77
test ebx, ebx
je 0x503298
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004f6f77
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50329d
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50329d
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004fc937
add esp, 0x10
xor eax, eax
inc eax
jmp 0x50329f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d7bf5
leave
ret
Function at 0x505ed9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x56a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x505f1c
call fcn.004e4d30
mov dword [eax], 0xf
call fcn.004e4d43
mov dword [eax], 0xd
call fcn.004e35c4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d7bf5
leave
ret
test eax, eax
jne 0x505f23
inc eax
jmp 0x505f10
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x505f0e
xor eax, eax
cmp ecx, 1
setne al
jmp 0x505f10
Function at 0x5070d0
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0050704c
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x50723f
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x50723f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5071f4
jg 0x50712c
test eax, eax
je 0x5071ea
push 1
push 0x1000
call fcn.004f4b18
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x50714f
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5071e1
push 0x8000
push ebx
call fcn.004f0bd1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x507178
jg 0x507173
cmp ecx, 0x1000
jb 0x507178
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004f8d7e
add esp, 0x10
cmp eax, 0xffffffff
je 0x5071bd
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x507173
jl 0x5071a4
test ecx, ecx
jne 0x507165
push dword [ebp - 0xc]
push ebx
call fcn.004f0bd1
push esi
call fcn.004f4e90
add esp, 0xc
xor ebx, ebx
jmp 0x50724d
cmp byte [edi + 0x24], 0
je 0x5071d4
cmp dword [edi + 0x20], 5
jne 0x5071d4
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5071df
mov ebx, dword [edi + 0x18]
jmp 0x5071e1
xor ebx, ebx
push esi
call fcn.004f4e90
pop ecx
jmp 0x50724d
test ecx, ecx
jg 0x5071b6
jl 0x5071f4
test eax, eax
jae 0x5071b6
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004f50f7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x507214
cmp byte [edi + 0x1c], 0
je 0x5071b6
jmp 0x507245
push ebx
call fcn.004fa9e9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5071b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x50724d
cmp byte [edi + 0x1c], 0
je 0x50724a
mov ebx, dword [edi + 0x18]
jmp 0x50724d
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004f50f7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x509a00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x509a2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x509a2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401933
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x42683f
call fcn.004256c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004032ae
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040198c
lea ecx, [esi + 0x30]
call fcn.004032ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405386
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x405512
Capabilities:
Create directory

Disassembly:
mov eax, 0x426bd0
call fcn.004256c0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x405535
mov al, 1
jmp 0x40557b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x405546
xor al, al
jmp 0x40557b
lea ecx, [ebp - 0x44]
call fcn.0040573f
lea ecx, [ebp - 0x1c]
call fcn.004032ae
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040598d
test al, al
je 0x405570
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00403a73
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40597e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40598c
or eax, eax
ret

Function at 0x406d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406d57
pop dword [ebp - 0x1c]
mov eax, 0x406d57
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x37ae6
push 0
mov eax, 0x86dc6b39
add eax, 0x796624f3
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x1f4e9f46
sub ecx, 0x1f4e5c9f
mov esi, eax
mov edi, 0x436e00
add edi, dword [ebp - 0x1c]
mov ebx, 0x99e941d3
add ebx, 0xdb41fc17
mov dword [ebp - 0x14], 0x189cc289
mov edx, dword [edi]
add dword [ebp - 0xc], 0xbf36dc93
xor edx, ebx
xor dword [ebp - 8], 0x4916ef1b
mov dword [esi], edx
xor dword [ebp - 0x18], ebx
add esi, 4
add edi, 4
loop 0x406dab
add eax, 0xfd6f
xor ebx, ebx
add ebx, eax
add eax, 0x9caacbc7
add eax, 0x6355343e
mov ecx, 0x1a3199d7
sub ecx, 0x19f199d7
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4e3910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x89000]
push edi
jmp 0x4e392a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e3931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3920
mov eax, 1
add ebx, ebx
jne 0x4e3943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e3954
jne 0x4e3973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3973
dec eax
add ebx, ebx
jne 0x4e3960
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e3938
add ebx, ebx
jne 0x4e396f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e39c5
xor ecx, ecx
sub eax, 3
jb 0x4e398b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e39fa
sar eax, 1
mov ebp, eax
jmp 0x4e3996
add ebx, ebx
jne 0x4e3996
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3964
inc ecx
add ebx, ebx
jne 0x4e39a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3964
add ebx, ebx
jne 0x4e39b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e39a6
jne 0x4e39c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e39a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e39e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e39d6
jmp 0x4e3926
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e39e4
add edi, ecx
jmp 0x4e3926
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e3a02
cmp byte [edi], 0x11
jne 0x4e3a02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e3a07
lea edi, [esi + 0xdc000]
mov eax, dword [edi]
or eax, eax
je 0x4e3a7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe9724]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe98c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e3a34
mov ecx, edi
jns 0x4e3a63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe98d0]
or eax, eax
je 0x4e3a79
mov dword [ebx], eax
add ebx, 4
jmp 0x4e3a51
call dword [esi + 0xe98cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e3ab0
cmp al, 0xef
ja 0x4e3aa3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e3a85
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e3a92
mov ebp, dword [esi + 0xe98d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e3ae4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x5a5ea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x107000]
push edi
or ebp, 0xffffffff
jmp 0x5a5ec2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5a5ec9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a5eb8
mov eax, 1
add ebx, ebx
jne 0x5a5edb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5a5eec
jne 0x5a5f0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a5f0b
dec eax
add ebx, ebx
jne 0x5a5ef8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5a5ed0
add ebx, ebx
jne 0x5a5f07
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5a5f5d
xor ecx, ecx
sub eax, 3
jb 0x5a5f23
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5a5f92
sar eax, 1
mov ebp, eax
jmp 0x5a5f2e
add ebx, ebx
jne 0x5a5f2e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a5efc
inc ecx
add ebx, ebx
jne 0x5a5f3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a5efc
add ebx, ebx
jne 0x5a5f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5a5f3e
jne 0x5a5f5a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5a5f3e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5a5f7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5a5f6e
jmp 0x5a5ebe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5a5f7c
add edi, ecx
jmp 0x5a5ebe
pop esi
mov edi, esi
mov ecx, 0x9cc7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5a5f9a
cmp byte [edi], 0x21
jne 0x5a5f9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5a5f9f
lea edi, [esi + 0x1a1000]
mov eax, dword [edi]
or eax, eax
je 0x5a6017
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1aed64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1aeecc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5a5fcc
mov ecx, edi
jns 0x5a5ffb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1aeed0]
or eax, eax
je 0x5a6011
mov dword [ebx], eax
add ebx, 4
jmp 0x5a5fe9
call dword [esi + 0x1aeee0]
mov ebp, dword [esi + 0x1aeed4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5a604b
sub esp, 0xffffff80
jmp 0x4bddc0
Function at 0x401720
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x408fd4]
sub esp, 8
cmp eax, 2
jne 0x4017a4
lea eax, [esp + 4]
push edi
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0xf003f
push 0
push str.String
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionDrivers32
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x4017be
mov dword [0x409024], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x407670
push ecx
mov dword [esp + 0x18], eax
call fcn.004023b1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push str.system.ini
push edx
push eax
push str.Drivers32
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 8
ret

Function at 0x401800
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0xa0
push ebx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
mov dword [esp + 0x14], str.open
push eax
mov dword [esp + 0x1c], 0x408dc8
mov dword [esp + 0x28], 1
call ebx
test eax, eax
je 0x401871
mov ecx, dword [esp + 0x40]
push 0x3938700
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop ebx
add esp, 0xa0
ret
push esi
lea edx, [esp + 0x48]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Mplayer.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x10000000
mov ecx, edx
push 3
push eax
and ecx, 3
push 1
lea eax, [esp + 0x5c]
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
pop esi
je 0x4018fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
lea ecx, [esp + 0x44]
push edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x408dc8
call ebx
mov eax, dword [esp + 0x40]
push 0x3938700
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop ebx
add esp, 0xa0
ret
Function at 0x401a80
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, 0x200
push 0
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x401afe
lea eax, [esp + 0x18]
push 0
push eax
push 0x48
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401b17
cmp dword [esp + 0x18], 0x48
jne 0x401b30
mov esi, str.Xvp500_Video_Mail_Launcher
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401aed
test cl, cl
je 0x401ae9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401aed
add eax, 2
add esi, 2
test cl, cl
jne 0x401ac9
xor eax, eax
jmp 0x401af2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401b49
add ebx, 0x200
jmp 0x401a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0x407670
push eax
call fcn.004023b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x14]
push 0x407670
push ecx
mov dword [esp + 0x1c], eax
call fcn.004023b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x14]
push 0x407670
push edx
mov dword [esp + 0x1c], eax
call fcn.004023b1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401b50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
mov dword [esp + 0x18], 0x1000
call 0x401cc0
mov ecx, dword [esp + 0x24]
add esp, 4
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x1c]
push 0x407670
push edx
mov dword [esp + 0x24], eax
call fcn.004023b1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push eax
push ecx
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x401be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x1c]
push 0x407670
push edx
mov dword [esp + 0x24], eax
call fcn.004023b1
push 0
push 0
push 0
push ebp
call esi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], eax
test edi, edi
jle 0x401c40
mov esi, dword [esp + 0x14]
cmp edi, esi
jge 0x401c02
mov esi, edi
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401c58
cmp dword [esp + 0x10], esi
jne 0x401c71
lea edx, [esp + 0x10]
push 0
push edx
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401c8a
cmp dword [esp + 0x10], esi
jne 0x401ca3
sub edi, esi
test edi, edi
jg 0x401bf8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040252a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 0x407670
push eax
call fcn.004023b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
push 0x407670
push ecx
mov dword [esp + 0x24], eax
call fcn.004023b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x1c]
push 0x407670
push edx
mov dword [esp + 0x24], eax
call fcn.004023b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 0x407670
push eax
call fcn.004023b1
nop
nop
nop
nop
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
push esi
call fcn.00402559
add esp, 4
test eax, eax
jne 0x401cff
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x80
jge 0x401cc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 0x407670
push eax
call fcn.004023b1
mov dword [edi], esi
pop edi
pop esi
ret