joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc7b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea ecx, [ebp - 4]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
mov eax, dword [ebx + 0x44]
push eax
call sub.wsock32.dll_send
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
cmp eax, 0xffffffff
je 0x4dc7ed
add dword [ebx + 0x3c], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4dcc04
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4dcce7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406ed0
test ebx, ebx
je 0x4dccc5
movzx eax, byte [ebx]
add al, 0xd0
sub al, 0xa
jae 0x4dcc5b
mov eax, ebx
call fcn.004078d8
push eax
call sub.wsock32.dll_inet_addr
inc eax
je 0x4dccd1
mov eax, esi
mov edx, ebx
call fcn.00407330
jmp 0x4dccd1
mov eax, ebx
call fcn.004078d8
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4dccd1
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov edi, dword [eax]
movzx eax, byte [edi]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
movzx eax, byte [edi + 1]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
movzx eax, byte [edi + 2]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
movzx eax, byte [edi + 3]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x24]
mov ecx, 3
mov eax, 0x4dcd04
call fcn.0041fdb0
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, 0
call fcn.004079f4
jmp 0x4dccd1
mov eax, esi
mov edx, 0x4dcd28
call fcn.00407330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dccee
lea eax, [ebp - 4]
call fcn.00406eac
ret

Function at 0x4dce58
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00406ed0
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jne 0x4dce97
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
push 0
call fcn.00407670
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4ef990
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4efab8
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004ef87c
mov eax, dword [esi]
call fcn.00409170
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4183f0]
call fcn.00409338
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404984
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404984
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00409170
mov dword [ebp - 0xc], eax
mov eax, dword [0x62f288]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004df2e0
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404d08
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00409170
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004df2bc
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004df074
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004df2d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4efabf
lea eax, [ebp - 4]
mov edx, dword [0x4183f0]
call fcn.0040945c
ret
Function at 0x50c930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x50c948
add esp, 0xfffffff0
call fcn.00405890
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x50ca62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404784
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x50ca4c
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004ce078
xor eax, eax
push ebp
push 0x50ca39
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004ce078
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407e7c
jmp 0x50ca0a
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.004081a8
mov eax, dword [ebx + 4]
call fcn.004073a4
dec eax
jle 0x50ca1e
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x50c9f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ca40
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ca69
lea eax, [ebp - 4]
call fcn.00406ef4
ret

Function at 0x513354
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [ebx + 0x3d], 3
push edi
push esi
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_connect_1
mov edx, eax
mov ecx, 0x513394
mov eax, ebx
call fcn.0051323c
cmp byte [ebx + 4], 0
jne 0x513384
mov byte [ebx + 0x3d], 4
pop edi
pop esi
pop ebx
ret
Function at 0x513c64
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor edi, edi
cmp byte [ebx + 4], 1
jne 0x513cad
mov esi, dword [ebx + 0x40]
test esi, esi
jne 0x513c87
or esi, 0xffffffff
push 0
push esi
lea edx, [ebp - 9]
xor ecx, ecx
mov eax, ebx
call fcn.005141c4
cmp al, 1
jne 0x513cb1
mov ecx, 0x513d10
mov edx, 0x274c
mov eax, ebx
call fcn.0051387c
jmp 0x513cb1
mov byte [ebp - 9], 1
cmp byte [ebp - 9], 0
je 0x513cf8
mov byte [ebx + 0x34], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_recv_1
mov edx, eax
mov ecx, 0x513d10
mov eax, ebx
call fcn.0051323c
mov edi, eax
cmp dword [ebp + 8], 2
je 0x513cef
mov eax, edi
cdq
add dword [ebx + 8], eax
adc dword [ebx + 0xc], edx
call fcn.00421658
fstp qword [ebx + 0x20]
wait
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x513d84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp byte [ebx + 4], 1
jne 0x513dcd
mov edi, dword [ebx + 0x40]
test edi, edi
jne 0x513da7
or edi, 0xffffffff
push 0
push edi
lea ecx, [ebp - 9]
xor edx, edx
mov eax, ebx
call fcn.005141c4
cmp al, 1
jne 0x513dd1
mov ecx, 0x513e2c
mov edx, 0x274c
mov eax, ebx
call fcn.0051387c
jmp 0x513dd1
mov byte [ebp - 9], 1
cmp byte [ebp - 9], 0
je 0x513e12
mov byte [ebx + 0x3c], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_send_1
mov edx, eax
mov ecx, 0x513e2c
mov eax, ebx
call fcn.0051323c
mov esi, eax
mov eax, esi
cdq
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], edx
call fcn.00421658
fstp qword [ebx + 0x20]
wait
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5141c4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x5141cd
mov eax, dword [ebp - 4]
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
je 0x514212
lea eax, [ebp - 0x1020]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1020]
call fcn.00511470
lea edx, [ebp - 0x1020]
mov eax, dword [ebx + 0x1c]
call fcn.0051145c
jmp 0x514217
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x514241
lea eax, [ebp - 0x2024]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2024]
call fcn.00511470
lea edx, [ebp - 0x2024]
mov eax, dword [ebx + 0x1c]
call fcn.0051145c
jmp 0x514246
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x514270
lea eax, [ebp - 0x3028]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3028]
call fcn.00511470
lea edx, [ebp - 0x3028]
mov eax, dword [ebx + 0x1c]
call fcn.0051145c
jmp 0x514275
xor eax, eax
mov dword [ebp - 0x14], eax
test esi, esi
jl 0x51429e
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x1c], eax
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
jmp 0x5142a0
xor eax, eax
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.wsock32.dll_select_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x5142c1
mov byte [ebp - 5], 3
jmp 0x5142dc
mov eax, esi
sub eax, 1
jb 0x5142cc
je 0x5142d2
jmp 0x5142d8
mov byte [ebp - 5], 1
jmp 0x5142dc
mov byte [ebp - 5], 0
jmp 0x5142dc
mov byte [ebp - 5], 2
test edi, edi
je 0x5142fe
test esi, esi
jle 0x5142f6
lea edx, [ebp - 0x1020]
mov eax, dword [ebx + 0x1c]
call fcn.00511438
test al, al
jne 0x5142fa
xor eax, eax
jmp 0x5142fc
mov al, 1
mov byte [edi], al
cmp dword [ebp - 4], 0
je 0x514325
test esi, esi
jle 0x51431a
lea edx, [ebp - 0x2024]
mov eax, dword [ebx + 0x1c]
call fcn.00511438
test al, al
jne 0x51431e
xor eax, eax
jmp 0x514320
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx], al
cmp dword [ebp + 0xc], 0
je 0x51434c
test esi, esi
jle 0x514341
lea edx, [ebp - 0x3028]
mov eax, dword [ebx + 0x1c]
call fcn.00511438
test al, al
jne 0x514345
xor eax, eax
jmp 0x514347
mov al, 1
mov edx, dword [ebp + 0xc]
mov byte [edx], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x514728
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x5147e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407e90
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00511478
mov eax, dword [ebp - 4]
call fcn.004078d8
push eax
call sub.wsock32.dll_inet_addr_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5147bd
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00407e90
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.00511478
mov eax, dword [ebp - 8]
call fcn.004078d8
push eax
call sub.wsock32.dll_gethostbyname_1
test eax, eax
jne 0x5147ac
mov ecx, 0x511518
mov dl, 1
mov eax, dword [0x51190c]
call fcn.004240c0
call fcn.004065b0
movsx ecx, word [eax + 0xa]
lea edx, [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5147ec
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406f6c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406f3c
ret

Function at 0x51b284
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x51b324
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.0040797c
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.00407474
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x51b2ae
cmp byte [esp], 0
je 0x51b2f3
mov eax, edi
call fcn.00407474
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x51b330
mov eax, edi
call fcn.00407474
push eax
mov eax, edi
call fcn.00407474
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00404984
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.0040797c
jmp 0x51b330
mov eax, edi
mov edx, 0x51b344
call fcn.00407330
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51c08c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x51c094
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51c2a6
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x51c0d7
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x628dc4]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00407e5c
jmp 0x51c273
test ebx, 0xc0000000
je 0x51c11f
lea edx, [ebp - 0x10]
mov eax, dword [0x628ffc]
call fcn.0051c2c4
mov eax, dword [ebp - 0x10]
call fcn.004078d8
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x628de4]
call fcn.0051c2c4
mov eax, dword [ebp - 0x14]
call fcn.004078d8
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x51c11f
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x51c164
cmp ebx, 0xbb7
ja 0x51c164
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x628ff8]
call fcn.0051c2c4
mov eax, dword [ebp - 0x18]
call fcn.004078d8
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51c169
or edi, 0x800
jmp 0x51c169
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51c26c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x51c20c
xor eax, eax
push ebp
push 0x51c205
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407dec
mov eax, dword [esi]
call fcn.004073a4
mov ebx, eax
test ebx, ebx
jbe 0x51c1ee
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x51c1d5
mov eax, esi
call fcn.0040746c
mov word [eax + ebx*2 - 2], 0x20
jmp 0x51c1e9
cmp di, 0xa
jne 0x51c1e9
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.004081a8
dec ebx
test ebx, ebx
ja 0x51c1b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c24f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x629000]
call fcn.0051c2c4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00407e5c
push dword [ebp - 0x1c]
push 0x51c2c0
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.0051bb68
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.00408078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c273
cmp dword [ebp - 8], 0
je 0x51c26b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c2ad
lea eax, [ebp - 0x24]
call fcn.00406eac
lea eax, [ebp - 0x20]
call fcn.00406ed0
lea eax, [ebp - 0x1c]
call fcn.00406eac
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406f3c
ret
Function at 0x51c2c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00407330
mov eax, ebx
call fcn.00407484
mov eax, dword [ebx]
call fcn.004073b0
test eax, eax
jle 0x51c2f5
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x51c2ea
pop esi
pop ebx
ret
Function at 0x522710
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5227d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
mov eax, ebx
call fcn.004078d8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5227be
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.0040797c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, ebx
call fcn.004078d8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5227be
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x5227e8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5227be
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5227db
lea eax, [ebp - 4]
call fcn.00406ed0
ret

Function at 0x522a30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x522a7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.00523930
test al, al
jne 0x522a72
cmp word [edi], 0x5a4d
jne 0x522a72
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x522a72
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522a88
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x522c34
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x62908c], 0
jne 0x522d15
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x522c87
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x522cb8
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x522d15
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x522ce3
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x522cf5
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x522d0f
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x529640
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x5296bc
cmp dword [esp + 0x10], 0x1000
jne 0x5296bc
cmp dword [esp + 4], 0
je 0x5296bc
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
je 0x5296bc
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x5296bc
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x5296bc
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52b5e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp dword [0x629a70], 0
je 0x52b625
push esp
push 0x40
push 4
mov eax, dword [0x629a70]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x52b625
mov eax, dword [0x629a70]
mov edx, dword [0x629a74]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x629a70]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
mov dword [0x629a70], eax
cmp dword [0x629a78], 0
je 0x52b669
push esp
push 0x40
push 4
mov eax, dword [0x629a78]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x52b669
mov eax, dword [0x629a78]
mov edx, dword [0x629a7c]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x629a78]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
mov dword [0x629a78], eax
xor eax, eax
mov dword [0x6356a0], eax
pop edx
ret
Function at 0x52ceb8
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52d019
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [edi + 0x10], 0
je 0x52cffb
cmp word [edi + 0x1e], 2
jb 0x52cffb
movzx edx, word [edi + 0x1e]
sub edx, 2
sar edx, 1
jns 0x52cf0c
adc edx, 0
mov eax, esi
call fcn.00407f18
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x1e]
sub eax, 2
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edi + 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x52cf41
mov eax, dword [ebp - 8]
add eax, 2
movzx edx, word [edi + 0x1e]
cmp eax, edx
je 0x52cf45
xor ebx, ebx
jmp 0x52cf47
mov bl, 1
test bl, bl
je 0x52cffb
mov eax, dword [esi]
call fcn.00407d8c
mov edx, eax
mov eax, esi
call fcn.00407dec
mov edx, dword [esi]
mov eax, 0x52d038
call fcn.0051adac
test al, al
je 0x52cf82
mov eax, esi
mov ecx, 4
mov edx, 1
call fcn.004081a8
jmp 0x52cffb
mov edx, dword [esi]
mov eax, 0x52d050
call fcn.0051ae1c
test al, al
je 0x52cfe8
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x218]
push eax
mov eax, dword [esi]
mov ecx, 0x7fffffff
mov edx, 0x15
call fcn.00408160
mov eax, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00407e40
mov edx, dword [ebp - 0x21c]
mov eax, esi
pop ecx
call fcn.00407ff0
jmp 0x52cffb
mov eax, dword [esi]
call fcn.00407d8c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d020
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00406f0c
ret