joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2c94
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x4f2cb8
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x4f2cbb
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x4f2cce
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4f2cd5
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x5be6e4]
mov ecx, dword [0x5be6e0]
test eax, eax
jne 0x4f2cef
test ecx, ecx
je 0x4f2d04
mov eax, ecx
mov dword [0x5be6e4], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4f2d04
cmp edx, dword [ebp + 8]
jb 0x4f2d04
cmp edx, dword [ebp - 4]
jbe 0x4f2e5d
mov eax, ecx
test ecx, ecx
mov dword [0x5be6e4], eax
je 0x4f2d34
test eax, eax
je 0x4f2d28
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4f2d28
cmp ecx, dword [ebp + 8]
jb 0x4f2d28
cmp ecx, dword [ebp - 4]
jbe 0x4f2e5d
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x5be6e4], eax
jne 0x4f2d13
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x4f2d9c
cmp edi, 0x70000000
jb 0x4f2d59
cmp edi, 0x80000000
ja 0x4f2d59
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f2d9c
cmp dword [ebp - 0x10], ebx
jne 0x4f2d74
cmp dword [ebp - 0x14], ebx
jae 0x4f2d84
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x4f2d44
jmp 0x4f2d9c
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5be6e4], eax
jne 0x4f2e13
cmp esi, dword [ebp - 4]
jae 0x4f2e84
cmp esi, 0x70000000
jb 0x4f2dba
cmp esi, 0x80000000
ja 0x4f2dba
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f2e84
cmp dword [ebp - 0x10], ebx
jne 0x4f2e08
cmp dword [ebp - 0x14], ebx
jb 0x4f2e08
mov ecx, esi
and ecx, 0xffff
je 0x4f2df0
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5be6e4], eax
jne 0x4f2e13
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x4f2d9c
mov dword [eax], 0x52727464
mov eax, dword [0x5be6e4]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x5be6e4]
mov edx, dword [0x5be6e0]
mov dword [eax + 4], edx
mov eax, dword [0x5be6e4]
mov dword [0x5be6e0], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x4f2e45
mov eax, dword [0x5be6e4]
mov dword [eax + 8], ecx
mov eax, dword [0x5be6e4]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x4f2e84
cmp esi, dword [ebp - 4]
ja 0x4f2e84
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.00537010
add esp, 0xc
mov eax, esi
jmp 0x4f2e86
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f2e8b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a9e0
push 0x536eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f2f00
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4f2efc
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x4f2efc
cmp word [eax + 0x14], 0
jne 0x4f2ef1
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4f2f02
mov eax, ecx
jmp 0x4f2eeb
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4fa51a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5be700]
push ebx
push esi
test eax, eax
je 0x4fa554
push eax
push 0x577674
lea eax, [ebp - 0x10c]
push eax
push 0xe6
call fcn.00509ded
add esp, 0x10
jmp 0x4fa5cc
call fcn.004f9d47
mov esi, 0xe6
test eax, eax
je 0x4fa594
lea eax, [ebp - 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x314]
push eax
call fcn.004f9df4
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4fa5b0
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call fcn.004f9f16
jmp 0x4fa57c
push ebx
push 0x577674
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.00509ded
push ebx
call fcn.0052f9c9
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
call fcn.004fad8b
pop ecx
test eax, eax
jbe 0x4fa5ed
lea ecx, [ebp - 0x10c]
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x4fa5ed
dec eax
jne 0x4fa5e4
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
push str._setilqs_
add eax, 0xffffffe2
push edi
push eax
call fcn.00509ded
push edi
call fcn.004fad8b
mov esi, eax
lea eax, [edi + esi]
push eax
push 0x14
call fcn.0050d4c4
add esp, 0x1c
push 0x14
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + 0x5ac770]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x4fa627
mov byte [edi + esi], cl
xor eax, eax
jmp 0x4fa586
Function at 0x4fa8e8
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
lea edx, [ebp - 0x78]
push edx
push 0x104
push ecx
push eax
mov dword [ebp - 0x80], 0x200
call fcn.004fa812
add esp, 0x10
test eax, eax
jne 0x4fa9b7
push ebx
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.004fa507
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x4fa9ae
push edi
call fcn.004f9d47
test eax, eax
mov eax, esi
je 0x4fa97a
cmp word [esi], bx
je 0x4fa964
cmp word [eax], 0x5c
je 0x4fa95f
inc eax
inc eax
cmp word [eax], bx
jne 0x4fa950
jmp 0x4fa964
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x7c]
push eax
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x4fa9a0
cmp byte [esi], bl
je 0x4fa98c
cmp byte [eax], 0x5c
je 0x4fa98a
inc eax
cmp byte [eax], bl
jne 0x4fa97e
jmp 0x4fa98c
mov byte [eax], bl
lea eax, [ebp - 0x7c]
push eax
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.0052f9c9
pop ecx
cmp edi, ebx
pop edi
jne 0x4fa9b5
mov dword [ebp - 0x80], 0x200
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
call fcn.0052f7d0
add ebp, 0x94
leave
ret

Function at 0x50d645
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x50d66e
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x56c648]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x50d64e
pop esi
ret

Function at 0x50e417
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x50eb26
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xa8]
mov dword [ebp - 0x7c], eax
xor eax, eax
mov byte [ebp + eax - 0x74], al
inc eax
cmp eax, 0x100
jl 0x50eb55
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov eax, esi
cdq
idiv dword [ebp + 0x9c]
mov eax, dword [ebp - 0x78]
lea ecx, [ebp + esi - 0x74]
movzx ebx, byte [ecx]
movzx eax, byte [edx + eax]
add eax, ebx
add edi, eax
and edi, 0x800000ff
jns 0x50eb93
dec edi
or edi, 0xffffff00
inc edi
lea eax, [ebp + edi - 0x74]
mov dl, byte [eax]
inc esi
cmp esi, 0x100
mov byte [ecx], dl
mov byte [eax], bl
jl 0x50eb68
mov ecx, dword [ebp + 0xa4]
xor edx, edx
xor esi, esi
test ecx, ecx
jle 0x50ec29
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebp + 0xa0]
sub eax, edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], ecx
jmp 0x50ebca
mov esi, dword [ebp - 0x7c]
inc edx
and edx, 0x800000ff
jns 0x50ebdb
dec edx
or edx, 0xffffff00
inc edx
lea eax, [ebp + edx - 0x74]
movzx ecx, byte [eax]
add esi, ecx
and esi, 0x800000ff
jns 0x50ebf4
dec esi
or esi, 0xffffff00
inc esi
mov dword [ebp - 0x7c], esi
lea esi, [ebp + esi - 0x74]
mov bl, byte [esi]
mov byte [eax], bl
mov byte [esi], cl
movzx eax, byte [eax]
movzx ecx, cl
add eax, ecx
and eax, 0x800000ff
jns 0x50ec17
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax - 0x74]
mov ecx, dword [ebp - 0x80]
xor al, byte [ecx + edi]
mov byte [edi], al
inc edi
dec dword [ebp - 0x78]
jne 0x50ebc7
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
add ebp, 0x90
leave
ret 0x14
Function at 0x50f00a
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xe0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x78]
mov edi, ecx
push dword [ebp + 0x74]
call fcn.0050ecda
lea eax, [ebp - 0x18]
push eax
push 0
push 0x577673
mov ecx, edi
call fcn.0050ecda
lea eax, [ebp - 0x70]
call fcn.0050e417
lea eax, [ebp - 0x18]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0x70]
call fcn.0050edc1
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x70]
call fcn.0050ed25
pop ecx
pop ecx
push 0x32
pop ebx
lea eax, [ebp - 0x70]
call fcn.0050e417
lea eax, [ebp + 0x58]
push eax
push 0x10
pop eax
lea ecx, [ebp - 0x70]
call fcn.0050edc1
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x70]
call fcn.0050ed25
dec ebx
pop ecx
pop ecx
jne 0x50f073
push 0x20
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.00537090
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x58]
xor cl, bl
mov byte [ebp + eax + 0x28], cl
inc eax
cmp eax, 0x10
jl 0x50f0af
lea eax, [ebp + 0x38]
push eax
push 0x20
push eax
push 0x10
lea eax, [ebp + 0x28]
push eax
mov ecx, edi
call fcn.0050eb26
inc ebx
cmp ebx, 0x14
jl 0x50f0ad
lea eax, [ebp - 0x70]
call fcn.0050e417
lea eax, [ebp + 8]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0x70]
call fcn.0050edc1
lea eax, [ebp + 0x38]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0x70]
call fcn.0050edc1
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x70]
call fcn.0050ed25
add esp, 0xc
push 0x32
pop edi
lea eax, [ebp - 0x70]
call fcn.0050e417
lea eax, [ebp + 0x58]
push eax
push 0x10
pop eax
lea ecx, [ebp - 0x70]
call fcn.0050edc1
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x70]
call fcn.0050ed25
dec edi
pop ecx
pop ecx
jne 0x50f111
push 0x10
lea eax, [ebp + 0x58]
push eax
push dword [ebp - 0x74]
call fcn.00537090
mov ecx, dword [ebp + 0x68]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
add ebp, 0x6c
leave
ret 0xc
Function at 0x524e54
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov edx, dword [ebx + 0x1c]
sub edx, 6
xor eax, eax
cmp edx, eax
push esi
push edi
jle 0x524e7f
mov esi, dword [ebp + 8]
mov ecx, edx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
test edx, edx
jle 0x524eca
push 8
pop ecx
cmp esi, dword [ebx + 0x1c]
ja 0x525008
jmp 0x524eaf
cmp dword [ebp - 0x28], 4
jge 0x524eb7
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + eax*4 - 0x24]
add esi, ecx
inc eax
inc dword [ebp - 0x28]
mov dword [ebx + esi*4], edi
cmp eax, edx
jl 0x524e99
cmp dword [ebp - 0x28], 4
jne 0x524ec3
inc dword [ebp - 0x2c]
add ecx, 4
and dword [ebp - 0x28], 0
cmp eax, edx
mov esi, dword [ebp - 0x2c]
jl 0x524e8e
cmp esi, dword [ebx + 0x1c]
ja 0x525008
mov eax, edx
shl eax, 2
lea ecx, [ebp + eax - 0x27]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp + eax - 0x26]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp + eax - 0x25]
lea eax, [ebp + eax - 0x28]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 0x5afbe8
mov eax, dword [ebp - 0x34]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x24]
xor al, byte [ecx + str.cw]
mov ecx, dword [ebp - 0x40]
mov byte [ebp - 0x24], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ecx]
mov cl, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ecx]
mov cl, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
mov ecx, dword [ebp - 0x30]
xor al, byte [ecx]
add dword [ebp - 0x30], 4
xor ecx, ecx
inc ecx
mov byte [ebp - 0x24], al
cmp edx, 8
je 0x524f63
cmp edx, ecx
jle 0x524fba
mov edi, dword [ebp + ecx*4 - 0x28]
lea eax, [ebp + ecx*4 - 0x24]
xor dword [eax], edi
inc ecx
cmp ecx, edx
jl 0x524f52
jmp 0x524fba
mov edi, dword [ebp + ecx*4 - 0x28]
lea eax, [ebp + ecx*4 - 0x24]
xor dword [eax], edi
inc ecx
cmp ecx, 4
jl 0x524f63
movzx eax, byte [ebp - 0x18]
mov al, byte [eax + str.cw]
xor byte [ebp - 0x14], al
movzx eax, byte [ebp - 0x17]
mov al, byte [eax + str.cw]
xor byte [ebp - 0x13], al
movzx eax, byte [ebp - 0x16]
mov al, byte [eax + str.cw]
xor byte [ebp - 0x12], al
movzx eax, byte [ebp - 0x15]
mov al, byte [eax + str.cw]
xor byte [ebp - 0x11], al
push 5
pop ecx
mov edi, dword [ebp + ecx*4 - 0x28]
lea eax, [ebp + ecx*4 - 0x24]
xor dword [eax], edi
inc ecx
cmp ecx, 8
jl 0x524faa
xor eax, eax
test edx, edx
jle 0x524fff
lea ecx, [esi*4 + 8]
cmp esi, dword [ebx + 0x1c]
ja 0x525008
jmp 0x524fe4
cmp dword [ebp - 0x28], 4
jge 0x524fec
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + eax*4 - 0x24]
add esi, ecx
inc eax
inc dword [ebp - 0x28]
mov dword [ebx + esi*4], edi
cmp eax, edx
jl 0x524fce
cmp dword [ebp - 0x28], 4
jne 0x524ff8
inc dword [ebp - 0x2c]
add ecx, 4
and dword [ebp - 0x28], 0
cmp eax, edx
mov esi, dword [ebp - 0x2c]
jl 0x524fc7
cmp esi, dword [ebx + 0x1c]
jbe 0x524efb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret 4
Function at 0x525019
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
inc edx
cmp dword [ecx + 0x1c], edx
jbe 0x5250f4
push esi
lea eax, [ecx + 0x32]
push edi
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x5af7e8]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x5aefe8]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x5af3e8]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x5aebe8]
add eax, 0x10
mov dword [eax - 0x12], esi
movzx esi, byte [eax - 0xb]
mov esi, dword [esi*4 + 0x5af7e8]
movzx edi, byte [eax - 0xc]
xor esi, dword [edi*4 + 0x5af3e8]
movzx edi, byte [eax - 0xd]
xor esi, dword [edi*4 + 0x5aefe8]
movzx edi, byte [eax - 0xe]
xor esi, dword [edi*4 + 0x5aebe8]
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x5af7e8]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x5af3e8]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x5aefe8]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x5aebe8]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x5af7e8]
xor esi, dword [edi*4 + 0x5af3e8]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x5aefe8]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x5aebe8]
inc edx
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x1c]
jb 0x52502a
pop edi
pop esi
ret
Function at 0x52ec0a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x5beb44], 0
push esi
jne 0x52eb7d
call fcn.0052eaa3
test eax, eax
je 0x52ebc0
mov eax, dword [0x5beb44]
cmp eax, 1
jne 0x52eb9e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x52ebc0
pop esi
ret
push eax
call dword [0x5beb4c]
test eax, eax
jne 0x52ec08
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x52ebc4
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x5beb44]
call dword [0x5beb4c]
mov edi, eax
test edi, edi
je 0x52ebe9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x52ec05
mov edi, esi
add esi, 0xff0
push edi
push dword [0x5beb44]
call dword [0x5beb48]
add edi, 0x10
cmp edi, esi
jb 0x52ebf1
mov eax, edi
pop edi
pop esi
ret
jmp 0x52eb6a

Function at 0x52f7d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5afee0]
jne 0x52f7da
repz ret
jmp fcn.0053c6cf

Function at 0x54b99d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00542422
and dword [ebp - 4], 0
cmp dword [0x5bf9bc], 0
mov ebx, eax
jne 0x54ba4e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x54baff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x54baff
push eax
call fcn.005423b0
mov dword [esp], 0x575210
push edi
mov dword [0x5bf9bc], eax
call esi
push eax
call fcn.005423b0
mov dword [esp], 0x5751fc
push edi
mov dword [0x5bf9c0], eax
call esi
push eax
call fcn.005423b0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5bf9c4], eax
call esi
push eax
call fcn.005423b0
pop ecx
mov dword [0x5bf9cc], eax
test eax, eax
je 0x54ba4e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005423b0
pop ecx
mov dword [0x5bf9c8], eax
mov eax, dword [0x5bf9c8]
cmp eax, ebx
je 0x54baa6
cmp dword [0x5bf9cc], ebx
je 0x54baa6
push eax
call fcn.0054242b
push dword [0x5bf9cc]
mov esi, eax
call fcn.0054242b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x54baa6
test edi, edi
je 0x54baa6
call esi
test eax, eax
je 0x54ba9d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x54ba9d
test byte [ebp - 0xc], 1
jne 0x54baa6
or dword [ebp + 0x10], 0x200000
jmp 0x54badf
mov eax, dword [0x5bf9c0]
cmp eax, ebx
je 0x54badf
push eax
call fcn.0054242b
pop ecx
test eax, eax
je 0x54badf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x54badf
mov eax, dword [0x5bf9c4]
cmp eax, ebx
je 0x54badf
push eax
call fcn.0054242b
pop ecx
test eax, eax
je 0x54badf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5bf9bc]
call fcn.0054242b
pop ecx
test eax, eax
je 0x54baff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x54bb01
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x551d75
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x551d86
mov eax, dword [eax + 4]
jmp 0x551d89
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x552b66
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x40], edi
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], 7
call fcn.004056b6
lea ecx, [ebp - 0x3c]
call fcn.00551e77
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call fcn.004050f1
add esp, 0xc
cmp dword [ebp - 0xc], edi
jne 0x552bdb
lea eax, [ebp - 0x3c]
push eax
mov ecx, ebx
call fcn.00551e8d
lea ecx, [ebp - 0x3c]
call fcn.00551e83
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.004053e5
mov eax, ebx
jmp 0x552c8a
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], edi
jae 0x552bea
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x40], edi
mov esi, eax
jle 0x552c1a
push dword [esi]
lea ecx, [ebp - 0x60]
call fcn.0040a8b0
push 3
pop ebx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x98]
call fcn.00551ea2
jmp 0x552c25
push 4
pop ebx
lea ecx, [ebp - 0x7c]
call fcn.00551e77
push eax
lea ecx, [ebp - 0x3c]
call fcn.00551f5b
test bl, 4
je 0x552c3e
lea ecx, [ebp - 0x7c]
and ebx, 0xfffffffb
call fcn.00551e83
test bl, 2
je 0x552c51
lea ecx, [ebp - 0x98]
and ebx, 0xfffffffd
call fcn.00551e83
test bl, 1
je 0x552c61
push edi
push 1
lea ecx, [ebp - 0x60]
call fcn.004053e5
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x3c]
push eax
call fcn.00551e8d
lea ecx, [ebp - 0x3c]
call fcn.00551e83
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.004053e5
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x5536a3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x1008]
push edx
lea edx, [ebp - 0x100c]
push edx
lea edx, [ebp - 0x804]
push edx
push eax
mov dword [ebp - 0x1008], 1
mov dword [ebp - 0x100c], 0x800
call fcn.00553491
test al, al
je 0x553749
cmp dword [ebp - 0x1008], 1
jne 0x553706
lea eax, [ebp - 0x804]
jmp 0x55373d
cmp dword [ebp - 0x1008], 2
jne 0x553749
mov esi, 0x400
push esi
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x553749
cmp eax, esi
ja 0x553749
lea eax, [ebp - 0x1004]
push eax
mov ecx, edi
call fcn.00406430
mov al, 1
jmp 0x55374b
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret 8