joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492657
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0x54b93c
mov dword [ebp - 0x14], str.0000000000000000000000000000000
mov eax, dword [ebp + 0x10]
sar eax, 1
mov edx, eax
mov eax, dword [ebp + 0xc]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
jle 0x4926a5
mov eax, dword [ebp + 0xc]
inc eax
sar eax, 2
inc eax
shl eax, 2
sub esp, eax
and esp, 0xfffffffc
mov eax, esp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x27
je 0x4926fa
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x2c
jne 0x4926ea
mov eax, 0x2e
and eax, 0xff
mov dword [ebp - 0xc], 0x2e
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x4926ab
mov al, 0
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
add eax, edx
push eax
push dword [ebp - 0x18]
call fcn.0048e32b
xor al, 1
cmp eax, 0
je 0x492751
mov eax, 0xffffffff
xchg edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
push 0x7ff80000
push 0
fld qword [esp]
add esp, 8
jmp 0x49275f
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00441fb4
leave
ret 0x10

Function at 0x492e0f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov edx, eax
mov eax, 0xffffffff
cmp eax, edx
setne al
xor ah, ah
cwde
leave
ret 4

Function at 0x492e4d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x492e8e
mov eax, 0xffffffff
jmp 0x492e91
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x492e9b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x492edc
mov eax, 0xffffffff
jmp 0x492edf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x49352a
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00451332
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.004933e9
cmp eax, 0
je 0x493559
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x493562
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne al
xor ah, ah
cwde
leave
ret 4
Function at 0x4946b3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00451332
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call fcn.00451332
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL__wrename]
add esp, 8
mov edx, eax
mov eax, 0
cmp eax, edx
sete al
xor ah, ah
cwde
leave
ret 8
Function at 0x49a180
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
cmp eax, 0
je 0x49a2c4
push 0x64
call fcn.0043e590
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x49a2a7
mov eax, dword [ebp - 0x1c]
cmp eax, 0
je 0x49a1f6
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0x3d
jne 0x49a1f6
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 1]
cmp al, 0
jne 0x49a1f6
jmp 0x49a1fa
xor eax, eax
jmp 0x49a1fd
xor eax, eax
inc eax
cmp eax, 0
je 0x49a295
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00444295
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00444295
mov eax, dword [ebp - 0x1c]
shl eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 2]
cmp al, 0
jne 0x49a26b
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 3]
cmp al, 0
jne 0x49a26b
jmp 0x49a26f
xor eax, eax
jmp 0x49a272
xor eax, eax
inc eax
cmp eax, 0
je 0x49a27e
jmp 0x49a2b0
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
mov eax, 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
jne 0x49a1d4
push dword [ebp - 0x18]
call fcn.0043d912
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.0045e7d2
leave
ret
Function at 0x49a31d
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.00487578
push eax
call fcn.004543d2
mov dword [ebp - 0xc], eax
call fcn.00487578
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.004441d1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49a468
cmp eax, 6
je 0x49a4c3
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a435
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49a405
mov eax, str.Server_2022
jmp 0x49a433
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49a419
mov eax, str.Server_2019
jmp 0x49a433
xor eax, eax
inc eax
je 0x49a425
mov eax, str.Server_2016
jmp 0x49a433
call fcn.0049a42a
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49a449
mov eax, 0x54bbbc
jmp 0x49a463
xor eax, eax
inc eax
je 0x49a455
mov eax, 0x54bbbf
jmp 0x49a463
call fcn.0049a45a
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a497
cmp eax, 1
je 0x49a49e
cmp eax, 2
je 0x49a4a5
call fcn.0049a48e
mov eax, 0x54bb36
jmp 0x49a4be
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a4b9
mov eax, str.Server_2003_R2
jmp 0x49a4be
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a4f9
cmp eax, 1
je 0x49a514
cmp eax, 2
je 0x49a52f
cmp eax, 3
je 0x49a54a
call fcn.0049a4f0
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a528
mov eax, str.Server_2008_R1
jmp 0x49a52d
mov eax, 0x54bb75
jmp 0x49a563
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a543
mov eax, str.Server_2012
jmp 0x49a548
mov eax, 0x54bb83
jmp 0x49a563
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a55e
mov eax, str.Server_2012_R2
jmp 0x49a563
mov eax, 0x54bb94
Function at 0x49a912
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49a9b6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49a9b6
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49a934
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x5008f4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x501d18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x501d46
cmp eax, 5
je 0x501d7d
mov dword [ebp - 0x20], 0
jmp 0x501e32
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x501e32
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.0043da1c
mov dword [ebp - 0x14], eax
jmp 0x501e08
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x501dc1
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x501dc1
xor eax, eax
jmp 0x501dc4
xor eax, eax
inc eax
cmp eax, 0
je 0x501dfd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x501e20
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x501e20
jmp 0x501e24
xor eax, eax
jmp 0x501e27
xor eax, eax
inc eax
cmp eax, 0
jne 0x501d9c
mov eax, dword [0x53ee24]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x502825
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x502853
cmp eax, 0xf
je 0x502881
mov eax, 0
jmp 0x502ac8
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0043d912
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x50287f
mov eax, 0
jmp 0x502ac8
jmp 0x502893
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x502ac5
Function at 0x504b69
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov eax, 1
mov dword [ebp - 0x28], 1
mov eax, 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [0x549b10]
dec eax
mov edx, eax
mov eax, dword [0x549b0c]
add eax, edx
mov dword [ebp - 0x30], eax
jmp 0x504d27
call fcn.005046cd
xor al, 1
cmp eax, 0
je 0x504bc9
jmp 0x504d30
mov eax, dword [0x549b0c]
mov edi, dword [0x549b10]
dec edi
mov al, byte [eax + edi]
mov byte [ebp - 0x2c], al
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
jne 0x504bee
mov dword [ebp - 0xc], 1
jmp 0x504d27
mov al, byte [ebp - 0x2c]
cmp al, 0x30
jb 0x504bfe
mov al, byte [ebp - 0x2c]
cmp al, 0x39
ja 0x504bfe
jmp 0x504c02
xor eax, eax
jmp 0x504c05
xor eax, eax
inc eax
cmp eax, 0
je 0x504c37
mov eax, dword [ebp - 0x10]
push edx
mov edx, 0xa
mov ecx, edx
imul ecx
pop edx
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x2c]
sub al, 0x30
mov edx, eax
mov eax, dword [ebp - 0x10]
and edx, 0xff
add eax, edx
mov dword [ebp - 0x10], eax
jmp 0x504d27
mov al, byte [ebp - 0x2c]
cmp al, 0x3b
jne 0x504c5f
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x2c]
cmp al, 0x40
jb 0x504c7d
mov al, byte [ebp - 0x2c]
cmp al, 0x7e
ja 0x504c7d
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
je 0x504c7d
mov al, byte [ebp - 0x2c]
cmp al, 0x5b
je 0x504c7d
jmp 0x504c81
xor eax, eax
jmp 0x504c84
xor eax, eax
inc eax
cmp eax, 0
je 0x504d1b
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x2c]
cmp al, 0x4d
je 0x504cd2
cmp al, 0x6d
je 0x504ceb
cmp al, 0x52
je 0x504d04
mov eax, dword [0x549b10]
dec eax
mov edx, eax
mov eax, dword [0x549b0c]
add eax, edx
push eax
push dword [ebp - 0x30]
call fcn.00504908
jmp 0x504d16
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x504ce9
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc]
call fcn.005046fe
jmp 0x504d16
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x504d02
push dword [ebp - 0x24]
push 1
push dword [ebp - 0xc]
call fcn.005046fe
jmp 0x504d16
mov eax, dword [ebp - 0x28]
cmp eax, 2
jne 0x504d16
push dword [ebp - 0x24]
call fcn.005048e3
jmp 0x504d30
mov al, byte [ebp - 0x2c]
cmp al, 0x1b
jne 0x504d27
jmp 0x504d30
xor eax, eax
inc eax
jne 0x504bb6
leave
ret
Function at 0x508104
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x24
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x5b
je 0x508141
mov eax, 0
jmp 0x508a34
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x14], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
Function at 0x513533
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [0x549f50]
push dword [0x516008]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x513578
mov eax, 0xffffffff
jmp 0x5136ba
mov eax, dword [0x549f50]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0
jne 0x5135a4
mov eax, 1
mov dword [ebp - 0x14], 1
jmp 0x513609
mov eax, dword [ebp - 0x10]
and eax, 0xe0
cmp eax, 0xc0
jne 0x5135c1
mov eax, 2
mov dword [ebp - 0x14], 2
jmp 0x513609
mov eax, dword [ebp - 0x10]
and eax, 0xf0
cmp eax, 0xe0
jne 0x5135de
mov eax, 3
mov dword [ebp - 0x14], 3
jmp 0x513609
mov eax, dword [ebp - 0x10]
and eax, 0xf8
cmp eax, 0xf0
jne 0x5135fb
mov eax, 4
mov dword [ebp - 0x14], 4
jmp 0x513609
call fcn.00513600
Function at 0x513ae4
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
push 0
call dword [sym.imp.MSVCRT.DLL_fflush]
add esp, 4
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x549fa8]
mov ecx, edx
cdq
idiv ecx
pop edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x549fa8]
mov ecx, edx
cdq
idiv ecx
mov eax, edx
bt eax, 0x1f
jae 0x513b2d
bt ecx, 0x1f
jae 0x513b2b
neg ecx
add eax, ecx
pop edx
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00513dc3
cmp eax, 0
je 0x513b53
mov eax, dword [0x549fa8]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp eax, 1
jne 0x513b53
jmp 0x513b57
xor eax, eax
jmp 0x513b5a
xor eax, eax
inc eax
cmp eax, 0
je 0x513b74
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x513b8c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cmp eax, edx
jne 0x513b8c
jmp 0x513b90
xor eax, eax
jmp 0x513b93
xor eax, eax
inc eax
cmp eax, 0
je 0x513bbf
mov eax, 0
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 1
push 0x54c000
push dword [0x516004]
call dword [sym.imp.KERNEL32.DLL_WriteConsoleW]
mov eax, dword [0x549fc0]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
mov eax, dword [0x549fc0]
shr eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
add eax, edx
shl eax, 0x10
mov edx, dword [ebp - 0xc]
or eax, edx
push eax
push dword [0x516004]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x549fa8]
mov ecx, edx
cdq
idiv ecx
pop edx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [0x549fac]
mov edx, dword [ebp - 0x18]
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0
jle 0x513c57
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jge 0x513c47
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
shl eax, 0x10
mov edx, dword [ebp - 0x1c]
or eax, edx
mov dword [0x549fc0], eax
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x549fa8]
mov ecx, edx
cdq
idiv ecx
pop edx
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [0x549f54], eax
leave
ret 0xc
Function at 0x514140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
jge 0x51417b
mov eax, 2
mov dword [ebp - 0xc], 2
push dword [ebp + 8]
call fcn.004425f7
push eax
push dword [ebp + 0xc]
call fcn.004425f7
pop edx
xchg edx, eax
add eax, edx
push eax
push dword [ebp - 0xc]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
shl eax, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x549fa4]
cmp eax, edx
jle 0x51421d
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [0x549fa4], eax
push dword [0x549f5c]
call dword [sym.imp.MSVCRT.DLL_free]
add esp, 4
push dword [0x549fa4]
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x549f5c], eax
mov eax, 0
mov edx, dword [0x549f5c]
cmp eax, edx
jne 0x51421d
push 0
push dword [ebp - 0x14]
push 2
push 0
push str.Cannot_allocate_memory:_init_buffer:
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [0x549f5c]
mov dword [0x549f60], eax
leave
ret 8

Function at 0x5150fb
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00442639
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x515145
push 0
push str.SetConsoleTitle_failed_
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
call fcn.00513cdf
call fcn.00513da2
push 5
push dword [0x548aa4]
call fcn.0044c49f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x51518b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x51518b
xor eax, eax
jmp 0x51518e
xor eax, eax
inc eax
cmp eax, 0
je 0x5151b3
mov eax, 0x50
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, 0x32
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
leave
ret 4
Function at 0x408130
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa1960b21
mov ecx, 0x18b71962
rorx edx, eax, 0xb
sarx ecx, ecx, ecx
mulx eax, edx, ecx
xor eax, edx
mov ecx, 0xf5f7ffbe
pext eax, eax, ecx
cmp eax, 0x22f270c
sete al
ret

Function at 0x4092a3
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40922f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40924d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4092ab
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x409292
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40929b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4092a5
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x409287
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x409211
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4092f8
dec eax
je 0x4092ef
sub eax, 3
je 0x4092e6
mov dword [ebp - 4], 0x40
jmp 0x409315
mov dword [ebp - 4], 4
jmp 0x4092fb
mov dword [ebp - 4], 0x20
jmp 0x4092fb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
invalid
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x409347
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4092c7
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00408b58
std
mov dword [ecx - 0xe], ecx
push dword [ebp + 0x14]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax

Function at 0x409379
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
test dword [esi + 0x25fffffc], edi