joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10029eb0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40309f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, ecx
cmp esi, 0xffffffff
jg 0x403212
je 0x40320b
lea eax, [esi + 0x2710]
cmp eax, 0x23
ja case.default.0x4030c9
jmp dword [eax*4 + 0x40324b]
mov eax, 0x5fb904
jmp 0x403222
mov eax, 0x5fb8e8
jmp 0x403222
mov eax, 0x5fb8d0
jmp 0x403222
mov eax, 0x5fb8b4
jmp 0x403222
mov eax, 0x5fb8a4
jmp 0x403222
mov eax, 0x5fb894
jmp 0x403222
mov eax, 0x5fb880
jmp 0x403222
mov eax, 0x5fb870
jmp 0x403222
mov eax, 0x5fb85c
jmp 0x403222
mov eax, 0x5fb848
jmp 0x403222
mov eax, 0x5fb830
jmp 0x403222
mov eax, 0x5fb814
jmp 0x403222
mov eax, 0x5fb7f8
jmp 0x403222
mov eax, 0x5fb7d4
jmp 0x403222
mov eax, 0x5fb7b0
jmp 0x403222
mov eax, 0x5fb784
jmp 0x403222
mov eax, 0x5fb76c
jmp 0x403222
mov eax, 0x5fb74c
jmp 0x403222
mov eax, 0x5fb734
jmp 0x403222
mov eax, 0x5fb71c
jmp 0x403222
mov eax, 0x5fb704
jmp 0x403222
mov eax, 0x5fb6ec
jmp 0x403222
mov eax, 0x5fb6cc
jmp 0x403222
mov eax, 0x5fb6b8
jmp 0x403222
mov eax, 0x5fb6a8
jmp 0x403222
mov eax, 0x5fb690
jmp 0x403222
mov eax, 0x5fb674
jmp 0x403222
mov eax, 0x5fb664
jmp 0x403222
mov eax, 0x5fb64c
jmp 0x403222
mov eax, 0x5fb63c
jmp 0x403222
mov eax, 0x5fb620
jmp 0x403222
mov eax, 0x5fb600
jmp 0x403222
mov eax, 0x5fb5e4
jmp 0x403222
mov eax, 0x5fb5c4
jmp 0x403222
mov eax, 0x5fb5b0
jmp 0x403222
mov eax, 0x5fb5a0
jmp 0x403222
mov eax, 0x5fb58c
jmp 0x403222
test esi, esi
je 0x40321d
mov eax, 0x5fb57c
jmp 0x403222
mov eax, 0x5fb570
push eax
lea eax, [ebp - 0x100]
push 0x5fb554
push eax
call fcn.005a3b0e
add esp, 0xc
test esi, esi
pop esi
je 0x403249
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
leave
ret

Function at 0x403aa8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5cd4ef
call fcn.005a39e4
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
lea edi, [esi + 0x30]
push ebx
push ebx
mov ecx, edi
mov dword [ebp - 0x14], esi
mov byte [edi], al
call fcn.0054c1c2
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], 0x100
call fcn.00403b4b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4082ef
Capabilities:
Inspect section memory permissions

Disassembly:
test cl, 0x80
je 0x4082fe
mov ecx, 0x10011
jmp 0x408389
test ecx, 0x10000
je 0x40830d
mov ecx, 0x110011
jmp 0x408389
test ecx, 0x40000000
je 0x40831c
mov ecx, 0x1011
jmp 0x408389
test ch, 2
je 0x408328
mov ecx, 0x20011
jmp 0x408389
test ecx, 0x80000000
je 0x408337
mov ecx, 0x2011
jmp 0x408389
test cl, 1
je 0x408343
mov ecx, 0x8011
jmp 0x408389
test ecx, 0x2000000
je 0x408350
push 0x11
pop ecx
jmp 0x408389
test ch, 0x80
je 0x40835c
mov ecx, 0x411
jmp 0x408389
test ecx, 0x20000000
je 0x40836b
mov ecx, 0x211
jmp 0x408389
test ch, 0x10
je 0x408377
mov ecx, 0x400111
jmp 0x408389
test ecx, 0x8000000
mov ecx, 0x811
jne 0x408389
mov ecx, 0x111
jmp fcn.00407f77
Function at 0x4149ef
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5cdb2f
call fcn.005a39e4
push ecx
push esi
fldz
mov esi, ecx
fstp dword [esi + 0x14]
fldz
mov al, byte [ebp + 0xb]
fstp dword [esi + 0x10]
mov dword [ebp - 0x10], esi
fldz
fstp dword [esi + 0xc]
fld1
fstp dword [esi + 0x18]
fldz
fstp dword [esi + 0x24]
fldz
fstp dword [esi + 0x20]
fldz
fstp dword [esi + 0x1c]
fld1
fstp dword [esi + 0x28]
fldz
fstp dword [esi + 0x38]
fldz
fstp dword [esi + 0x34]
fldz
fstp dword [esi + 0x30]
fld1
fstp dword [esi + 0x3c]
fldz
fstp dword [esi + 0x48]
fldz
fstp dword [esi + 0x44]
fldz
fstp dword [esi + 0x40]
fld1
fstp dword [esi + 0x4c]
fldz
fstp dword [esi + 0x58]
fldz
fstp dword [esi + 0x54]
fldz
fstp dword [esi + 0x50]
fld1
mov byte [esi + 0x60], al
xor eax, eax
fstp dword [esi + 0x5c]
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00414a91
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41c8db
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5cdd70
call fcn.005a39e4
sub esp, 0x3c
push ebx
push esi
push edi
push 1
mov ebx, ecx
xor esi, esi
push esi
mov dword [ebp - 0x20], ebx
call fcn.004d8a35
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x34], al
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov esi, dword [ebx]
lea eax, [esi + esi]
push eax
call fcn.005bca7e
test esi, esi
mov edi, dword [ebx + 0x24]
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], edi
jle 0x41ca31
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
mov ebx, dword [edi + 0x24]
test bl, 1
jne 0x41c943
mov eax, dword [ebp - 0x14]
or word [eax], 0xffff
jmp 0x41ca1b
movzx eax, word [edi + 0x28]
push 0
mov dword [ebp - 0x48], eax
push 0
mov eax, 0x100
push eax
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.user32.dll_SetRect]
sar ebx, 0x1b
and ebx, 3
inc ebx
xor eax, eax
mov ax, bx
test eax, eax
jle 0x41c99e
mov esi, edi
mov edi, eax
fld dword [esi + 4]
fmul dword [0x5d7bb8]
call fcn.005a35cc
fld dword [esi]
fmul dword [0x5d7bb8]
push eax
call fcn.005a35cc
lea ecx, [ebp - 0x48]
push eax
call fcn.0041dab4
add esi, 8
dec edi
jne 0x41c973
xor edi, edi
cmp dword [ebp - 0x30], edi
je 0x41c9b3
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
push 0x14
cdq
pop ecx
idiv ecx
mov edi, eax
xor ebx, ebx
test edi, edi
jle 0x41ca06
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x30]
lea ecx, [esi + eax]
call fcn.0041dae1
test al, al
jne 0x41c9d6
inc ebx
add esi, 0x14
cmp ebx, edi
jl 0x41c9bb
cmp ebx, edi
jge 0x41ca06
mov ecx, dword [ebp - 0x30]
lea eax, [ebx + ebx*4]
cmp dword [ecx + eax*4], 0
lea eax, [ecx + eax*4]
jge 0x41c9f5
push 5
pop ecx
lea esi, [ebp - 0x48]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x41ca12
lea ecx, [ebp - 0x44]
add eax, 4
push ecx
push eax
push eax
call dword [sym.imp.user32.dll_UnionRect]
jmp 0x41ca12
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041dc36
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov word [eax], bx
add dword [ebp - 0x14], 2
add edi, 0x40
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
jne 0x41c92f
mov ebx, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x41ca44
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
push 0x14
cdq
pop ecx
idiv ecx
mov ecx, dword [ebx + 0x30]
or dword [ebp - 4], 0xffffffff
mov byte [ecx + 0xa], al
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x34]
call fcn.004edf27
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43ef35
Capabilities:
Delete file

Disassembly:
mov eax, 0x5cf5cc
call fcn.005a39e4
sub esp, 0x248
and byte [ebp - 0xd], 0
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x10]
xor ebx, ebx
cmp edi, ebx
je 0x43f08a
cmp byte [edi], bl
je 0x43f08a
cmp dword [esi + 0x1c], ebx
mov byte [ebp - 0xd], 1
je 0x43f098
cmp dword [esi + 0x18], ebx
jne 0x43f098
push dword [esi + 0x14]
and byte [ebp - 0xd], bl
lea ecx, [ebp - 0x1c]
call fcn.005bcdab
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.005bd119
push 0x5fc710
push dword [ebp - 0x1c]
call dword [0x62d0a0]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x18], edi
je 0x43f078
push edi
push 1
pop ebx
push ebx
push 4
push esi
call dword [0x62d0ac]
add esp, 0x10
cmp eax, ebx
jne 0x43f06a
mov eax, dword [esi + 0xc]
push edi
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 4
push eax
call dword [0x62d0ac]
add esp, 0x10
cmp eax, ebx
jne 0x43f06a
cmp dword [ebp - 0x14], 0
mov eax, dword [esi + 8]
mov edi, dword [eax]
mov byte [ebp - 0xd], bl
je 0x43f06a
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x254]
call fcn.0043e57b
push dword [ebp - 0x18]
mov byte [ebp - 4], bl
push ebx
mov ebx, 0x238
lea eax, [ebp - 0x254]
push ebx
push eax
call dword [0x62d0ac]
add esp, 0x10
cmp eax, 1
jne 0x43f057
mov edi, dword [edi]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.0050a59c
dec dword [ebp - 0x14]
je 0x43f06a
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x254]
call fcn.0043e57b
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
push 1
jmp 0x43f011
and byte [ebp - 0xd], 0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.0050a59c
push dword [ebp - 0x18]
call dword [0x62d0a4]
and dword [esi + 0x1c], 0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.005bcd3d
cmp byte [ebp - 0xd], 0
jne 0x43f098
mov esi, dword [esi + 0x10]
test esi, esi
je 0x43f098
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x440df4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, esi
push edi
shl eax, 2
push eax
mov edi, edx
call fcn.005a3f79
test eax, eax
pop ecx
je 0x440e30
test esi, esi
mov edx, edi
mov edi, eax
je 0x440e30
push ebx
mov ecx, dword [edx]
add edx, 4
mov ebx, ecx
ror ebx, 0x10
xor ebx, ecx
and ebx, 0xff00ff
xor ebx, ecx
mov dword [edi], ebx
add edi, 4
dec esi
jne 0x440e13
pop ebx
pop edi
pop esi
ret
Function at 0x44b981
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5d000a
call fcn.005a39e4
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x20
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.005bca7e
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x44b9ab
call fcn.00442534
jmp 0x44b9ad
xor eax, eax
or dword [eax + 0x18], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4552ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x606ff8
push Ordinal_4
mov dword [ebp - 8], 0x104
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x455307
lea eax, [ebp - 8]
push eax
mov ebx, 0x62f4e8
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x606fe4
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
je 0x45530e
mov eax, 0x62f5ec
jmp 0x45533c
or ecx, 0xffffffff
push edi
xor eax, eax
mov edi, 0x606fdc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, ebx
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a1b8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5d0435
call fcn.005a39e4
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x78]
mov dword [ebp - 0x10], esi
call fcn.0050e2ad
xor ebx, ebx
lea ecx, [esi + 0x80]
mov dword [ebp - 4], ebx
call fcn.00431a93
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 1
call fcn.0045dc08
lea ecx, [esi + 0x274]
call fcn.0045db9f
lea ecx, [esi + 0x33c]
mov byte [ebp - 4], 2
call fcn.00459b68
push 0x58
mov byte [ebp - 4], 3
call fcn.005bca7e
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov byte [ebp - 4], 4
je 0x45a22d
call fcn.00441efe
jmp 0x45a22f
xor eax, eax
fldz
or edi, 0xffffffff
fstp dword [esi + 0x2c]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x1eb8]
fldz
fstp dword [esi + 0x30]
and eax, 0xffffcd60
fldz
or eax, 0xc40
mov dword [esi + 0x1e9c], ebx
fstp dword [esi + 0x34]
mov dword [esi + 0x1ea0], ebx
fldz
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x70], ebx
fstp dword [esi + 0x38]
mov dword [esi + 0x1eac], ebx
mov dword [esi + 0x3c], 0x40800000
mov dword [esi + 0x1ee0], ebx
mov dword [esi + 0x1eb4], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x338], ebx
mov dword [esi + 0x2e4], ebx
mov dword [esi + 0x2e8], ebx
mov dword [esi + 0x1ee4], ebx
mov dword [esi + 0x14], 0xbe
mov dword [esi + 0x2f0], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2f8], ebx
mov dword [esi + 0x2fc], ebx
mov dword [esi + 0x300], edi
mov dword [esi + 0x304], edi
mov dword [esi + 0x2ec], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov byte [esi + 0x324], bl
mov dword [esi + 0x328], edi
mov dword [esi + 0x32c], ebx
mov dword [esi + 0x320], ebx
mov dword [esi + 0x1ecc], ebx
mov dword [esi + 0x1ed0], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x1eb8], eax
mov dword [esi + 0x308], edi
mov dword [esi + 0x30c], edi
mov dword [esi + 0x1ec0], ebx
mov dword [esi + 0x1ec8], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x330], ebx
mov dword [esi + 0x318], ebx
mov dword [esi + 0x31c], ebx
call fcn.005a3f57
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], edi
mov dword [esi + 0x314], eax
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x310], ebx
mov dword [esi + 0x334], ebx
mov dword [esi + 0x1e98], ebx
mov dword [esi + 0x1eb0], ebx
mov dword [esi + 0x1ebc], ebx
mov dword [esi + 0x1ec4], ebx
mov dword [esi + 0x1ed4], ebx
mov dword [esi + 0x1ed8], ebx
mov dword [esi + 0x1edc], ebx
mov dword [esi + 0x1ee8], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46782a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 8], 0xf2
mov byte [ebp - 7], 0xe0
mov byte [ebp - 6], 0xe9
mov byte [ebp - 5], 0xe6
mov byte [ebp - 4], 0xea
mov byte [ebp - 3], 0xe8
mov byte [ebp - 2], 0xe0
mov byte [ebp - 1], 0xa5
mov byte [ebp - 0x20], 0xe3
mov byte [ebp - 0x1f], 0xfa
mov byte [ebp - 0x1e], 0xe7
mov byte [ebp - 0x1d], 0xf1
mov byte [ebp - 0x1c], 0xea
mov byte [ebp - 0x1b], 0xeb
mov byte [ebp - 0x1a], 0xea
mov byte [ebp - 0x19], 0xe3
mov byte [ebp - 0x18], 0xe3
mov byte [ebp - 0x17], 0xfa
mov byte [ebp - 0x16], 0xe9
mov byte [ebp - 0x15], 0xfa
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xea
mov byte [ebp - 0x12], 0xe2
mov byte [ebp - 0x11], 0xea
mov byte [ebp - 0x10], 0xe3
mov byte [ebp - 0xf], 0x85
mov byte [ebp - 0xe], 0x8d
mov byte [ebp - 0xd], 0x94
mov byte [ebp - 0xc], 0x8c
mov byte [ebp - 0xb], 0xa5
xor eax, eax
xor byte [ebp + eax - 8], 0xa5
inc eax
cmp eax, 8
jl 0x4678aa
xor eax, eax
xor byte [ebp + eax - 0x20], 0xa5
inc eax
cmp eax, 0x16
jl 0x4678b7
mov ecx, dword [ecx + 0x94]
lea eax, [ebp - 8]
push eax
call fcn.0045bd85
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.00457dfb
mov eax, dword [eax + 0x30]
test eax, eax
je 0x46790c
cmp dword [eax + 8], 3
jne 0x467907
cmp dword [eax + 4], 7
jne 0x467907
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x467907
mov ecx, dword [ecx + 0x20]
mov dword [ecx + 0x10], 0x87654321
mov dword [ecx + 0x38], 0xc7045bea
mov eax, dword [eax + 0xc]
jmp 0x4678df
leave
ret
Function at 0x4e0685
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push 0x611310
push esi
push 0x6112ec
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push dword [ebp + 8]
push 1
push esi
push 0x6112e4
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegFlushKey]
lea eax, [ebp - 0xc]
push eax
push 0x3e8
push esi
push esi
push esi
push 0x1a
push 0xffff
call dword [sym.imp.user32.dll_SendMessageTimeoutA]
pop edi
pop esi
leave
ret 4
Function at 0x4ef368
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.004ef1a2
test eax, eax
je 0x4ef461
mov bl, byte [eax + 9]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x4ef46c
cmp dword [ebp - 0x94], 5
jne 0x4ef46c
cmp dword [ebp - 0x90], 0
jne 0x4ef46c
mov byte [ebp - 1], 1
and byte [ebp - 2], 0
mov ecx, 0x1002
cmp si, cx
jne 0x4ef463
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x298]
push eax
mov edx, edi
call fcn.004ef219
lea eax, [ebp - 0x198]
push 0x612130
push eax
call fcn.005a4aa0
test eax, eax
pop ecx
pop ecx
je 0x4ef463
mov edx, dword [ebp + 8]
xor bl, bl
cmp byte [ebp - 1], bl
mov ecx, 0x10ccf
je 0x4ef429
mov eax, 0x5000d
cmp edx, eax
ja 0x4ef427
jne 0x4ef429
cmp dword [ebp + 0xc], ecx
jb 0x4ef429
mov bl, 1
cmp byte [ebp - 2], 0
je 0x4ef441
mov eax, 0x6000d
cmp edx, eax
ja 0x4ef43f
jne 0x4ef441
cmp dword [ebp + 0xc], ecx
jb 0x4ef441
mov bl, 1
cmp byte [ebp - 1], 0
jne 0x4ef463
cmp byte [ebp - 2], 0
jne 0x4ef463
mov eax, 0x4000d
cmp edx, eax
ja 0x4ef461
jne 0x4ef463
cmp dword [ebp + 0xc], 0x11c18
jb 0x4ef463
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8
and byte [ebp - 1], 0
cmp dword [ebp - 0x88], 2
jne 0x4ef3ca
cmp dword [ebp - 0x94], 5
jne 0x4ef496
cmp dword [ebp - 0x90], 1
jae 0x4ef49c
cmp dword [ebp - 0x94], 5
jbe 0x4ef3ca
mov byte [ebp - 2], 1
jmp 0x4ef3ce
Function at 0x5320bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
push 0x3c
push 1
mov dword [ebp - 8], ecx
call fcn.005a453a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x532228
push dword [ebp - 8]
and dword [esi + 0x24], 0
or dword [esi + 0x34], 0xffffffff
push 1
push 0x14
push esi
call fcn.00532f2e
add esp, 0x10
cmp eax, 1
jne 0x53221b
mov eax, dword [esi]
cmp eax, 0x30564642
je 0x532114
cmp eax, 0x3041524d
jne 0x53221b
push ebx
push edi
mov ecx, esi
call fcn.00531d73
mov edi, dword [esi + 4]
imul edi, edi, 0x118
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x3d]
push eax
push esi
call fcn.005a40f4
mov esi, eax
test byte [esi + 8], 0x10
pop ecx
pop ecx
lea eax, [esi + 0x3c]
je 0x5321ab
mov ebx, dword [esi + 0x10]
push ebx
call fcn.005a3f79
push 0
push dword [esi + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
lea eax, [edi + 1]
mov dword [ebp - 0x10], eax
call fcn.00532f62
push dword [ebp - 8]
push ebx
push 1
push dword [ebp - 0xc]
call fcn.00532f2e
add esp, 0x20
cmp eax, ebx
jne 0x5321a0
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x3c]
push eax
mov dword [ebp - 4], 1
call fcn.005581f0
add esp, 0x10
cmp dword [ebp - 0x10], edi
je 0x532198
and dword [ebp - 4], 0
test eax, eax
je 0x5321a0
and dword [ebp - 4], 0
push dword [ebp - 0xc]
call fcn.005a3d51
pop ecx
jmp 0x5321e1
xor edi, edi
cmp dword [esi + 4], edi
jbe 0x5321d6
mov ebx, eax
push dword [ebp - 8]
push 1
push dword [ebp - 0x10]
push ebx
call fcn.00532f2e
add esp, 0x10
cmp eax, 1
jne 0x5321d6
inc edi
add ebx, 0x118
cmp edi, dword [esi + 4]
jb 0x5321b4
xor eax, eax
cmp edi, dword [esi + 4]
sete al
mov dword [ebp - 4], eax
cmp dword [esi], 0x3041524d
pop edi
pop ebx
jne 0x532215
xor edx, edx
cmp dword [esi + 4], edx
mov dword [esi], 0x30564642
jbe 0x532215
lea eax, [esi + 0x48]
mov ecx, dword [eax + 4]
xor dword [eax], ecx
mov ecx, dword [eax]
xor dword [eax + 4], ecx
mov ecx, dword [eax + 4]
xor dword [eax], ecx
inc edx
add eax, 0x118
cmp edx, dword [esi + 4]
jb 0x5321fb
cmp dword [ebp - 4], 0
jne 0x532228
test esi, esi
je 0x532228
push esi
call fcn.005a3d51
pop ecx
xor esi, esi
mov eax, esi
pop esi
leave
ret
Function at 0x53319d
Capabilities:
Create directory

Disassembly:
push ecx
push ecx
and byte [esp + 3], 0
push ebp
push esi
mov esi, ecx
test esi, esi
mov dword [esp + 0xc], edx
je 0x5332c7
push ebx
push edi
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea eax, [ebx + 2]
push eax
call fcn.005a3f79
mov ebp, eax
mov edi, esi
pop ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [esp + 0x14], 0
rep movsb byte es:[edi], byte [esi]
je 0x533207
push 0x5c
push ebp
call fcn.005a3e70
test eax, eax
pop ecx
pop ecx
je 0x533207
and byte [eax], 0
cmp byte [ebx + ebp - 1], 0x5c
jne 0x533213
and byte [ebx + ebp - 1], 0
push 0x5c
push 0x2f
pop edx
mov ecx, ebp
call fcn.00552a48
mov ecx, ebp
call fcn.0053308d
test al, al
jne 0x5332ba
cmp ebx, 1
mov esi, ebp
jle 0x533244
cmp byte [ebp + 1], 0x3a
jne 0x533244
cmp byte [ebp + 2], 0x5c
jne 0x533244
lea esi, [ebp + 3]
push 0x5c
push esi
call fcn.005a4d50
test eax, eax
pop ecx
pop ecx
je 0x53325a
and byte [eax], 0
lea esi, [eax + 1]
jmp 0x533244
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
and byte [ecx + esi], al
dec ecx
cmp byte [ebp], al
mov esi, ebp
je 0x5332ba
push 0
push ebp
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
setne byte [esp + 0x13]
cmp byte [esp + 0x13], 0
jne 0x5332a0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x533299
mov byte [esp + 0x13], 1
cmp byte [esp + 0x13], 0
je 0x5332ba
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esi + ecx]
lea esi, [eax + 1]
mov byte [eax], 0x5c
cmp byte [esi], 0
jne 0x533270
test ebp, ebp
pop edi
pop ebx
je 0x5332c7
push ebp
call fcn.005a3d51
pop ecx
mov al, byte [esp + 0xb]
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x533311
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov ecx, 0x635e80
call fcn.00402176
mov ecx, 0x610580
jmp 0x533311
push esi
mov esi, ecx
test esi, esi
je 0x53332f
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x53332f
or eax, 2
push eax
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
pop esi
ret