joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52416c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5242d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00512414
test eax, eax
je 0x5242b6
mov eax, dword [ebp - 4]
call fcn.00512414
test byte [eax + 0x2cc], 8
jne 0x5242b6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6d], 4
je 0x5242ae
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x6d]
mov edx, dword [ebp - 4]
mov byte [edx + 0x6c], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 2
je 0x52420d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 1
je 0x52420d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 3
je 0x52420d
mov eax, dword [ebp - 4]
call fcn.00512414
lea edx, [ebp - 0x14]
call fcn.0043de28
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x14]
lea edi, [eax + 0x5c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x102], 0
je 0x52425d
lea edx, [ebp - 0x18]
mov eax, dword [0x578828]
mov eax, dword [eax]
call fcn.00464048
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x88
mov ecx, 0x3f
call fcn.0040b2a8
mov eax, dword [0x578828]
mov eax, dword [eax]
call fcn.00463de4
push 0
mov eax, dword [0x578828]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
jmp 0x52429e
mov eax, dword [ebp - 4]
call fcn.00512414
test eax, eax
je 0x52428e
mov eax, dword [ebp - 4]
call fcn.00512414
lea edx, [ebp - 0x1c]
call fcn.0043e69c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x88
mov ecx, 0x3f
call fcn.0040b2a8
push 0
mov eax, dword [ebp - 4]
call fcn.005123d0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
add eax, 0x70
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
jmp 0x5242b6
mov eax, dword [ebp - 4]
call fcn.00523ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5242db
lea eax, [ebp - 0x1c]
call fcn.00404894
lea eax, [ebp - 0x18]
call fcn.00404894
ret
Function at 0x5441b8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x54427e
mov word [ebx], 2
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockname
inc eax
je 0x54427e
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1008
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockopt
inc eax
je 0x54427e
cmp dword [ebx + 4], 0
jne 0x544249
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x54428a
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004035bc
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getpeername
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x54428a
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x556e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x556ed9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040492c
mov eax, dword [ebp - 4]
call fcn.00404b3c
mov esi, eax
test esi, esi
jle 0x556eb4
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d0c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x556e97
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004048e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556ee0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret
Function at 0x557bd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x557ddd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x557df4
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x557dab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x557cb7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x557cfe
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x557cc9
mov edx, 0x557e08
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x557d21
mov edx, 0x557e1c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x557e30
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557db2
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret

Function at 0x558108
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a7f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55814d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558154
mov eax, dword [ebp - 8]
call fcn.0040a914
ret
Function at 0x55b6e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x55b8ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x55b904
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55b8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x55b7c7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x55b80e
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x55b7d9
mov edx, 0x55b918
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x55b831
mov edx, 0x55b92c
mov eax, dword [ebp - 0xc]
call fcn.00415cc8
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x55b940
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b8c2
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret
Function at 0x55b948
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x55b950
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x55bb1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x55bb02
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409fe4
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.0055bc14
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404e28
test eax, eax
jle 0x55bafa
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x55ba13
lea ecx, [ebp - 0x14]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x55bb34
call fcn.00404b88
mov edx, dword [ebp - 0x10]
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415cc8
jmp 0x55ba50
lea ecx, [ebp - 0x18]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x18]
mov edx, 0x55bb48
call fcn.00404b44
mov edx, dword [ebp - 0x18]
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415cc8
lea ecx, [ebp - 0x1c]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0040ac34
test al, al
jne 0x55bae6
push 4
lea ecx, [ebp - 0x20]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x20]
mov edx, 0x55bb68
call fcn.00404b44
mov eax, dword [ebp - 0x20]
call fcn.00404d00
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00404d00
push eax
call sub.kernel32.dll_MoveFileExA
lea ecx, [ebp - 0x28]
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.0055b6e8
mov eax, dword [0x5789a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc ebx
dec esi
jne 0x55b988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bb24
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004048b8
ret
Function at 0x55bc14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x55bcbe
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x55bc71
push 0x90
lea eax, [ebp - 0x91]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x91]
call fcn.0040b424
mov eax, dword [ebp - 0x128]
mov edx, ebx
call fcn.00409fe4
jmp 0x55bca0
push 0x90
lea eax, [ebp - 0x122]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x122]
call fcn.0040b424
mov eax, dword [ebp - 0x12c]
mov edx, ebx
call fcn.00409fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bcc5
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.004048b8
ret

Function at 0x55c59c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x55c5a4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x55d175
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x466914]
call fcn.00466ad8
mov ebx, eax
mov edx, 0x80000003
mov eax, ebx
call fcn.00466c08
mov cl, 1
mov edx, 0x55d18c
mov eax, ebx
call fcn.00466dbc
lea ecx, [ebp - 0x10]
mov edx, 0x55d1b8
mov eax, ebx
call fcn.004674a0
mov eax, ebx
call fcn.00403a08
mov eax, dword [ebp - 0x10]
mov edx, 0x55d1c8
call fcn.00404c4c
jne 0x55c62e
mov ecx, 0x55d1d8
mov edx, 0x55d1e4
mov eax, ebx
call fcn.0046746c
mov eax, dword [0x5789d4]
mov byte [eax], 0
mov eax, dword [0x5789d4]
cmp byte [eax], 0
jne 0x55c658
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x55d1f4
call fcn.00415cc8
jmp 0x55d14f
mov edx, dword [ebp - 4]
mov eax, dword [0x590740]
call fcn.004f56d0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55c710
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x55c6f9
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x55c6e4
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x55c6bc
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x55d234
call fcn.00415cc8
jmp 0x55c6d7
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x55d24c
call fcn.00415cc8
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x55c6f9
push 0
mov cx, word [0x55d26c]
mov dl, 1
mov eax, 0x55d278
call fcn.0046ff6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c717
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d17c
lea eax, [ebp - 0x158]
mov edx, 0x53
call fcn.004048b8
lea eax, [ebp - 8]
call fcn.00404894
ret
Function at 0x55d400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x590740]
call fcn.004f56d0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55d4be
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x55d4a7
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x55d492
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x55d46a
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x55d4d4
call fcn.00415cc8
jmp 0x55d485
mov eax, dword [0x590730]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x55d4ec
call fcn.00415cc8
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x55d4a7
push 0
mov cx, word [0x55d50c]
mov dl, 1
mov eax, 0x55d518
call fcn.0046ff6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d4c5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x563b04
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a7f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x563b49
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563b50
mov eax, dword [ebp - 8]
call fcn.0040a914
ret

Function at 0x56509c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x5652a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x5652b8
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56526f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x56517b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5651c2
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x56518d
mov edx, 0x5652cc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5651e5
mov edx, 0x5652e0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x5652f4
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565276
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret
Function at 0x5652fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x56537f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004035bc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x565398
mov edx, ebx
call fcn.00404b88
mov eax, dword [ebp - 0x24]
call fcn.00404d00
mov dword [ebp - 0x16], eax
mov eax, 0x56539c
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565386
lea eax, [ebp - 0x24]
call fcn.00404894
ret
Function at 0x56b4a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x56b52d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040492c
mov eax, dword [ebp - 4]
call fcn.00404b3c
mov esi, eax
test esi, esi
jle 0x56b508
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d0c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x56b4eb
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004048e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b534
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret

Function at 0x572c58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x572de8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x578a20]
cmp dword [eax], 0
je 0x572ccc
lea edx, [ebp - 4]
mov eax, dword [0x578a20]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e4]
call fcn.0043e69c
mov eax, dword [ebp - 4]
mov edx, 0x572dfc
call fcn.00404c4c
je 0x572dc0
lea edx, [ebp - 8]
mov eax, dword [0x578a20]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e4]
call fcn.0043e69c
mov eax, dword [ebp - 8]
mov edx, 0x572e0c
call fcn.00404c4c
je 0x572dc0
mov eax, dword [0x5907c0]
cmp dword [eax + 0x3c], 0x14b
jge 0x572ce9
mov edx, 0x14b
mov eax, dword [0x5907c0]
call fcn.0043dc08
mov edx, dword [0x578524]
mov edx, dword [edx]
mov eax, dword [ebx + 0x2e8]
call fcn.0050de00
mov edx, dword [0x578524]
mov edx, dword [edx]
mov eax, dword [ebx + 0x2e8]
call fcn.0050de00
mov eax, dword [0x578524]
mov eax, dword [eax]
call fcn.0043ee08
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x572d73
mov eax, dword [0x578524]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
cmp byte [eax + 0x24], 0
je 0x572d73
push 0x572e1c
lea eax, [ebp - 0x10]
mov edx, dword [0x578524]
mov edx, dword [edx]
mov edx, dword [edx + 0x2d0]
add edx, 0x24
call fcn.00404ae0
push dword [ebp - 0x10]
push 0x572e44
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bfc
mov eax, dword [ebp - 0xc]
call fcn.00470098
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x572d87
mov eax, 0x572e70
call fcn.00470098
mov eax, dword [0x5789d4]
cmp byte [eax], 0
jne 0x572dc0
mov eax, dword [0x5789b0]
cmp byte [eax], 0
je 0x572dc0
mov eax, 0x572ecc
call fcn.00470098
push 3
push 0
push 0
push 0x572f50
push 0x572fa8
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572def
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret