joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527bc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
push esi
shr ebx, 3
xor eax, eax
push edi
test ebp, ebp
je 0x527cca
mov edi, dword [esp + 0x20]
test edi, edi
je 0x527cca
mov esi, dword [esp + 0x24]
test esi, esi
je 0x527cca
lea edx, [ebx*8]
cmp edx, ecx
je 0x527c0e
pop edi
pop esi
pop ebp
mov eax, 0xffffe5d3
pop ebx
add esp, 8
ret
test ebx, ebx
jbe 0x527ccf
jmp 0x527c20
movzx eax, byte [edi]
movzx ecx, byte [edi + 1]
movzx edx, byte [edi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 3]
shl eax, 8
or eax, edx
movzx edx, byte [edi + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 6]
shl edx, 8
mov dword [esp + 0x10], eax
movzx eax, byte [edi + 5]
or edx, eax
movzx eax, byte [edi + 7]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edx
push ecx
mov edx, ebp
call fcn.005279b0
mov eax, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
mov byte [esi], dl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 1], cl
mov edx, eax
mov byte [esi + 3], al
mov eax, dword [esp + 0x18]
shr edx, 8
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 2], dl
mov byte [esi + 4], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esi + 5], dl
mov byte [esi + 6], cl
mov byte [esi + 7], al
add esp, 4
add edi, 8
add esi, 8
sub ebx, 1
jne 0x527c20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, 0xffffe88f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x527ce0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, ecx
push esi
shr ebx, 3
xor eax, eax
push edi
test edx, edx
je 0x527dea
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x527dea
mov esi, dword [esp + 0x20]
test esi, esi
je 0x527dea
push ebp
lea ebp, [ebx*8]
cmp ebp, ecx
je 0x527d2e
mov eax, 0xffffe5d3
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
test ebx, ebx
jbe 0x527d26
lea ebp, [edx + 0x80]
jmp 0x527d40
movzx eax, byte [edi]
movzx ecx, byte [edi + 1]
movzx edx, byte [edi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 3]
shl eax, 8
or eax, edx
movzx edx, byte [edi + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 6]
shl edx, 8
mov dword [esp + 0x10], eax
movzx eax, byte [edi + 5]
or edx, eax
movzx eax, byte [edi + 7]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edx
push ecx
mov edx, ebp
call fcn.005279b0
mov eax, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
mov byte [esi], dl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 1], cl
mov edx, eax
mov byte [esi + 3], al
mov eax, dword [esp + 0x18]
shr edx, 8
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 2], dl
mov byte [esi + 4], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esi + 5], dl
mov byte [esi + 6], cl
mov byte [esi + 7], al
add esp, 4
add edi, 8
add esi, 8
sub ebx, 1
jne 0x527d40
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 0xffffe88f
pop ebx
add esp, 8
ret
Function at 0x529fb3
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
jno 0x54e254
shl cl, 0x20
jo 0x529fc5
invalid
jo 0x54e254
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x529fd3
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x55c1f5
ret
push esi
ja 0x533e87
xchg bl, ch
xchg ch, bl
jbe 0x54e263
jecxz 0x54e2ca
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.00542415
add byte [eax - 0x627df0fe], ch
retf 0

Function at 0x52a075
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
mov edx, dword [ebp + 0x38]
lea esi, [esi + 8]
mul dword [ebp + ebx]
mov dword [ebp + 0x30], eax
xchg esi, edi
xchg edi, esi
mov dword [ebp + 0x38], edx
mov bl, bl
ja 0x5487f4
jbe 0x52a06d
nop
cpuid
ret 0x860f
jbe 0x5487f4
and byte [eax - 0x73], 0x64
and al, 4
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
ja 0x53e17a
jbe 0x52a08c
cli
into
jbe 0x53e17a
invalid
mov bx, bx
push esi
mov esi, esi
mov byte [esi + 0xba], cl
shr edi, 0x40
shr esi, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
shr bp, 0x40
xchg bl, ah
mov bh, bh
xchg ah, bl
mov word [esi + 0xbc], dx
call fcn.0055d1a5
mov al, byte [ebp + 0xb]
shr cx, 0x40
mov cx, cx
jmp 0x53e1b7
push esi
xchg bp, ax
mov bx, bx
shl bp, 0x20
xchg bp, ax
mov byte [esi + 0xba], bl
jne 0x54f920
mov cx, cx
je 0x53e1d9
sti
popfd
cmpsd dword [esi], dword es:[edi]
je 0x54f920
je 0x54f920
and eax, 0xdd296859
push ebx
add bl, al
or byte [ecx + edx*2 + 0x1e23e852], 2
add byte [ebx + 0xff0ff06], cl
sbb dword [eax + 0x70000070], 0x4eb65803
jmp dword [esi]
Function at 0x52b3f0
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
cmp eax, ecx
jb 0x54dff5
push edi
pop edi
jae 0x52b404
scasd eax, dword es:[edi]
cpuid
ret
mov edx, edx

Function at 0x52c879
Capabilities:
Check os version

Disassembly:
mov ebp, esp
sub esp, 0x20
push ebx
push esi
shr eax, 0x40
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
jmp 0x52ab74
push edi
lea edx, [ebp - 0x14]
lea eax, [esi + 0x10]
jmp 0x52ab7d
push ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
shr cx, 0x40
push edx
lea ecx, [ebp - 0x1c]
push eax
push ecx
jno 0x563399
jo 0x52ab9c
cpuid
nop
ret
jo 0x563399
fxch st(0)
pop esi
setle dl
dec edx
pop ebx
sub ah, 0
jne 0x547ef4
mov ax, ax
je 0x52abba
sub ecx, dword [edx]
je 0x547ef4
sub byte [esi - 0x71], 0x44
and al, 0xfc
mov word [eax + 2], bx
shr dh, 0x40
pop esi
mov eax, 1
jmp 0x5467e6
js 0x548818
jns 0x52c885
dec eax
cmp cl, dl
jns 0x548818
and eax, 0x85e8b87
sub ecx, dword [eax]
mov dh, dh
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
sub byte [ebx], al
mov al, al
jmp dword [esi]
pop ebx
pop ebp
ret
and edx, 2
jb 0x52d287
dec edx
mov eax, edx
mov esi, esi
pop ebp
ret
jmp 0x548819
push ebp
jne 0x52ab60
je 0x548826
aam 0x87
xchg esp, eax
je 0x52ab60
fdivr st(5)
shl bp, 0x20
mov ecx, dword [ebp + 0x1c]
lea edx, [ebp - 0x20]
lea eax, [ebp - 8]
jmp 0x5633a7
push edx
add ecx, 6
push eax
push ecx
call fcn.00560013
mov eax, dword [ebp - 8]
add esp, 0x1c
add edi, 0x6548278b
sub edi, 0x6548278b
cmp eax, 1
ja 0x52a39a
xchg edi, eax
xchg edi, eax

Function at 0x52cc21
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x62ddc1]
test eax, eax
jb 0x55ca83
xchg dl, dh
xchg dh, dl
jne 0x55ddcb
je 0x52cc41
fadd st(0), st(0)
std
call fcn.00544d87
test eax, eax
jb 0x543c61
xchg bx, di
xchg di, bx
jne 0x55ddcb
je 0x52cc5f
js 0x52cca3
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
wait
int1
push esp
add byte [eax], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
sbb byte [edx + 0x55], dh
add dh, ah
or edx, dword [ebp]
xor byte [eax], al
add byte [eax], al
xor al, 0
add byte [eax], al
and al, 0xca
push ebx
add byte [eax], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edx + ecx*8], ah
push ebx
add byte [eax + eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
jle 0x52cd02
push ebp
add byte [eax + eax], dh
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
jle 0x52cd0e
push ebp
add byte [eax], bh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
xor dword [ecx + 0x54], eax
add byte [ecx], dh
inc ecx
push esp
add byte [eax], bl
not dword [ebx]
ret 0x55ff
add byte [0x5c0052cd], dl
ret
add eax, 0xff5e8d57
Function at 0x5326ff
Capabilities:
Check os version
Encrypt data using speck

Disassembly:
add eax, 0xe815ff89
sbb dword [ecx], 0xdb85c389
js 0x537d89
jns 0x53270b
invalid
jns 0x537d89
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
jmp dword [esi]
mov ax, ax
jno 0x540d23
jo 0x537d98
cpuid
ret
jo 0x540d23
xor al, 0x77
call fcn.005293bc
add esp, 0x24
test ax, ax
jb 0x54a5b3
je 0x537dde
add byte [eax], al
add byte [ebp + 2], dh
jne 0x537dbe
mov edx, 0x1a3d663b
add byte [edi], cl
test byte [esi], dl
add byte [eax], al
add byte [ebp + 4], dh
cmp ax, 0x1a
je 0x537dde
jne 0x537dce
loope 0x537ddb
mov byte [0xa3d66c3], al
add byte [edi], cl
test dword [ebp + 0x740000d6], ebp
add al, 0xb5
cmp ax, 0xa
jne 0x545485
je 0x537dde
mov ch, 0x10
jne 0x537db7
push ebp
jno 0x546786
jo 0x54100c
nop
cpuid
ret
jo 0x546786
and eax, 0x85e8bf9
shr ch, 0x40
push 0xf8c20c51
jmp 0x545486
push eax
mov eax, dword [esi]
push eax
call fcn.005486e5
add esp, 8
pop edi
pop esi
push 0x54b768
ret
jmp dword [esi]
mov al, byte [ebp + eax]
push 0x55bbc2
ret
invalid
xor al, 0x95
push eax
mov eax, dword [ebp - 4]
push edx
and eax, 0xff
jb 0x559e9e
sub bl, 0
and ecx, 0xff
jb 0x55ee5c
push eax
jmp 0x54a11a
push ecx
push 2
call fcn.005293bc
add dh, 0x6e
sub dh, 0x6e
add esp, 0x24
test ax, ax
jb 0x55ee65
je 0x55e034
jne 0x54a143
in al, 0x3e
pcmpgtd mm7, qword [0x840f001f]
pop ss
add byte [eax], al
add byte [eax + 0x58], dl
cmp ax, 0x1f
je 0x54a164
push eax
pop eax
jne 0x54a155
xchg esi, eax
sub byte [edi], ah
pushfd
cmp ax, 0x21
jne 0x54a16c
je 0x54a164
shr byte [ebx - 0x793c799c], 0xd8
xchg bl, al
xchg al, bl
mov word [ebx + 4], ax
pop edi
pop esi
or eax, 0xffffffff
jb 0x541012
jne 0x55e02b
shl ecx, 0x20
je 0x54a188
nop
cpuid
ret
je 0x55e02b
invalid
invalid

Function at 0x533041
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
jne 0x5545e8
je 0x533051
mov word [eax - 0x51], ds
ja 0x54255c
jbe 0x53305b
test ecx, 0x1000
jb 0x5675ed
push ebx
pop ebx
jne 0x537a9e
push eax
pop eax
je 0x53a47d
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x5675e2
jne 0x54823a
je 0x554617
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x53a461
je 0x554634
cpuid
nop
ret
je 0x53a461
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]

Function at 0x533344
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
inc esp
and al, 0xfc
mov al, byte [ebp + 0xb]
add esp, 0x30
add eax, 0
cmp bl, 1
shr di, 0x40
mov cl, cl
mov byte [esi + 0xba], bl
js 0x559270
jns 0x533371
cpuid
pop edi
ret
jns 0x559270
fnstenv [ebx - 0x7e13ea01]
pop ecx
add byte [ebp - 0x7b7df040], al
cmp eax, dword [eax]
add byte [esi + 0xffa86d7], al
mov byte [ebp + 0x7900017a], cl
add al, 0xf
dec esi
jno 0x533345
Function at 0x5374a5
Capabilities:
Check os version

Disassembly:
invalid
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x54c521
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x5374fb
jbe 0x5374d1
nop
cpuid
ret
xor ecx, ecx
jb 0x559038
shr ecx, 0x40
mov cl, byte [eax + 0x567da4]
jmp dword [ecx*4 + 0x567d9c]
xor eax, eax
jb 0x559051
pop ebp
jne 0x539157
mov dx, dx
je 0x537513
cpuid
ret
je 0x539157
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea esi, [esi + 0xc]
test byte [ebx + edx], al
jb 0x52e449
jmp dword [esi]
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x56492c
je 0x55906a
sub dword [ebx], ecx
inc ecx
je 0x56492c
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x54612a
je 0x559088
cpuid
ret
je 0x54612a
sar dh, 1
invalid
fidiv dword [edx - 0x65]
int1
push esp
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
loope 0x55908b
push edx
add byte [edi - 0x3bffad79], cl
pushfd
push ebx
add ah, al
nop
push ebp
add byte [eax - 0x3b3c5df1], dl
pushfd
push ebx
add byte [esi], bh
push 0x56
add dl, bl
xchg ecx, eax
pop esi
pop ebp
ret
Function at 0x53dbcc
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
js 0x559c67
xchg bl, ah
xchg ah, bl
jns 0x53dbe0
jns 0x559c67
fadd st(7)
xchg ecx, edx
xchg si, dx

Function at 0x53e74c
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
mov eax, dword [esi + 4]
shl ah, 0x20
mov ebx, dword [esi + 8]
mov dx, dx
lea esi, [esi + 0xc]
cmp esi, esi
and word [ebp + ebx], ax
jb 0x53dbf3
shr ebp, 0x40
jmp dword [esi]

Function at 0x543229
Capabilities:
Check os version

Disassembly:
add esp, 4
cmp al, 0x3a
je 0x54fe80
dec ecx
int3
jne 0x54323d
add al, 0xfa
ror byte [edx + 0x68303cf5], cl
je 0x543233
cmc
cmp al, 0x30
push 0x52f074
ret
push edx
add bl, al
xor eax, 0x21810ff5
xchg byte [eax], al
add byte [eax + 2], dh
xchg ebx, eax
and al, 0x66
mov eax, eax
mov ecx, dword [ebp + 8]
inc edi
mov al, byte [edi + ecx]
test al, al
jb 0x54d177
je 0x52a8ee
jne 0x54fe9a
push edi
aas
sbb eax, eax
jmp 0x54fedd
shr bl, 0x40

Function at 0x543690
Capabilities:
Check os version

Disassembly:
mov dword [ebp + 0x38], edx
jmp dword [esi]
mov bh, bh
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
mov bp, bp
call fcn.0053ace6
jne 0x54c15d
shl ebx, 0x20
je 0x53bfe7
adc edx, esp
imul ecx, dword [edi], 0xffffff84
jo 0x53bfec
je 0x54c15d
add dword [eax], eax
add cl, bl
pop esp
fstp dword [ebx + ebp*8 - 1]
invalid
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
mov ah, ah
mov di, di
mov byte [esi + 0xbb], dl
mov si, si
mov word [esi + 0xbc], di
shl edx, 0x20
call fcn.00559c82
mov bl, bl
mov cl, byte [ebp + 0xc]
jno 0x544b6f
mov ax, ax
shl ah, 0x20
jo 0x5436ce
inc esp
push esp
lea eax, [ecx + 0xf]
sbb byte [ebx + 0x25000014], 0x2d
jo 0x544b6f
and eax, 0x48758b2d
shl si, 0x20
mov dx, word [ebp + 0x10]
jno 0x55936c
jo 0x544b81
dec esp
fisttp qword [edi]
and ch, 0x47
add dword [eax], eax
jo 0x55936c
and eax, 0x3b24f782
jo 0x544b9b
cmpsd dword [esi], dword es:[edi]
jo 0x53b494
add eax, 0x24448f93
push esi
mov byte [esi + 0xba], cl
mov al, al
js 0x53bfc1
jns 0x547594
mov edx, 0x27890f10
dec edx
invalid
jns 0x53bfc1
mov dword [esi], 0x880f3f8d
inc esp
jno 0x5475a1
dec dword [eax + 0x20379c0]
invalid
push 0x54c4e6
ret
jmp 0x55936d
push eax
xchg bl, dl
mov edx, edx
xchg dl, bl
mov ax, ax
jne 0x547581
je 0x559382
cli
xchg esi, eax
je 0x547581
fld dword [ecx + 0x6a]
add byte [ebp - 0x419727ab], cl
and byte [ebx], dl

Function at 0x54490e
Capabilities:
Check os version
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x546def
je 0x544929
and al, 0xc5
je 0x546def
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x546df7
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.00537252
shl eax, 0x20
call fcn.0055ebcd
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x5449a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push ebx
push edi
pop edi
push esi
push edi
js 0x544975
jns 0x528877
pop ecx
pop edi
jae 0x528887
jns 0x544975
mov eax, edi
rol byte [ecx], 0
add eax, 0x2c26ff20
cli
mov esi, dword [esi + 4]
xchg bx, bp
xchg ebx, ebp
xchg bp, bx
jmp dword [esi]
shl bh, 0x20
push ebp
mov ebp, esp
jno 0x52885e
jo 0x52a9ee
nop
cpuid
ret 0x800f
jo 0x52885e
invalid
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x5477eb
shr ax, 0x40
jbe 0x54498b
push 0xffffffffffffffce
jbe 0x5477eb
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.0054d836
and eax, 0x24448f81
cld
js 0x554afb
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x5449b7
cpuid
nop
ret
jns 0x554afb
invalid
push eax
ja 0x537d75
jbe 0x5477f7
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
test byte [esi - 0x3a01ffad], cl
push ebx
add byte [edx + 0x120054c2], cl
jbe 0x537d75
xor eax, 0x538e8438
add dh, bh
lds edx, [ebx]
mov al, dl
push esp
add byte [edx], dl
js 0x547862
add byte [ebx - 0x3d750dac], bh
push esp
add dh, bh
lds edx, [ebx]
invalid
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20
jmp 0x554b04
push esi
mov ah, ah
mov bh, bh
mov byte [esi + 0xba], bl
jno 0x52da08
jo 0x554b1b
pop esi
sti
sbb al, 0xf
and bh, 0x8e
std
inc dword [edx + 0x24448f4d]
pop dword [esp - 4]
jo 0x52da08
or byte [ebp - 0x71], 0x44
and al, 0xfc

Function at 0x544da7
Capabilities:
Check os version

Disassembly:
push ebp
ja 0x550ab6
jbe 0x52ef92
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x550ab6
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x52ef85
jo 0x544db2
dec edi
xor edi, ecx
jo 0x52ef85
xor eax, 0xfbe1e8e0
invalid
push ebx
jmp 0x545fa5
push esi
lds esi, [edi + ecx + 0x180f786]
invalid
invalid
invalid

Function at 0x54624f
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
jmp fcn.00531d73
Function at 0x54d836
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
lea esi, [esi + 4]
push 0xd30569ff
mov dword [esp], ebx
pushfd
mov ebx, 0xf597a04e
sub ebx, 0x800edc60
popfd
push eax
pop eax
call fcn.0053f28a
xor eax, 0xee850f71
mov al, 0xfd
push dword [edx + eax - 0x68]

Function at 0x557940
Capabilities:
Check os version

Disassembly:
push 0xe37fa68f
mov dword [esp], ebx
push 0x62
mov dword [esp], edx
call fcn.00558618
xor al, 0x35
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, esp
pushfd
push 0x2f
mov dword [esp], ecx
pushfd
mov dword [esp], eax
js 0x5454d9
shl dl, 0x20
jns 0x557938
jp 0x5578fc
call 0xdbf1024b
invalid
jns 0x5454d9
sbb byte [eax - 0x3dbbb71], 0x85
dec dword [edi]
sub byte [edi + 0x27], 0xff
dec dword [edi]
test dword [edx], esp
jb 0x557951
add byte [ecx + 0x320374db], cl
dec ebp
inc edi
Function at 0x5589a1
Capabilities:
Check os version

Disassembly:
push ebp
sub cl, byte [edi]
sub dword [edx + 0x24], 0x4700003
invalid
mov eax, dword [0xff89664a]
mov ecx, dword [esi + 4]
lea ecx, [ecx]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
sar word [ebx], cl
xchg al, dl
xchg dl, al
jmp dword [esi]
add edi, edx
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
shr bl, 0x40
mov ah, ah
sar dword [ebx], cl
mov cl, cl
js 0x546803
jns 0x539dce
jecxz 0x539dde
jns 0x546803
mov dword [edi], ebp
retf 0
add eax, 0x54e65589
add ch, bl
pop esi
add byte [eax], al
xor byte [eax], al
add byte [eax], al
xchg esp, eax
cld
push edx
add byte [eax], al
add byte [eax], al
add byte [eax + eax], al
add byte [ebx - 0xffab01], dl
inc dword [eax]
add byte [eax], dh
add byte [eax], al
add ah, al
pushfd
push ebx
add bl, ch
and al, 0x54
add byte [esi + ecx*4 - 0x529bffad], al
push esp
add byte [edx + 0x150054c2], cl
sahf
push ebx
add dl, dl
mov bh, 0x87
mov al, dl
push esp
add byte [ebp + ebp*4 + 0x54], ah
add cl, bl
test byte [ebx - 0x77fffabc], 0xd2
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
or dword [ebp + ebx], eax
jb 0x54bd68
mov dx, dx
jmp dword [esi]
call fcn.0056595e
jmp dword [esi]
pop edi
pop esi
lea ecx, [ecx]
pop ebx
push eax
pop eax
mov esp, ebp
js 0x550858
push esi
pop esi
jns 0x546975
jg 0x54698a
clc
jns 0x550858
push esi
mov byte [esi + 0xba], cl
shl cl, 0x20
mov si, si
mov byte [esi + 0xbb], 0
xchg byte [ebx], bh
xchg bx, bp
shl ax, 0x20
xchg bp, bx
shr edx, 0x40
mov word [esi + 0xbc], dx
shl bp, 0x20
call fcn.00532308
mov al, byte [ebp + 0xb]
push esi
shr bx, 0x40
mov byte [esi + 0xba], bl
shr cx, 0x40
mov byte [esi + 0xbb], al
shl ecx, 0x20
shr dl, 0x40
mov word [esi + 0xbc], di
shl edx, 0x20
push 0x54cf3d
ret
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid
pop ebp
ret
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
mov cx, cx
lea eax, [ebp - 8]
push 8
lea ecx, [ebp - 0x1c]
shr cx, 0x40
jne 0x5621d5
je 0x558277
cpuid
and ebx, eax
je 0x5621d5
add eax, 0x24448f00
cld
jmp 0x558284
push esi
call fcn.0053ec6f
add esp, 0x30
test ax, ax
jb 0x535878
jne 0x54695f
je 0x5582a5
mov ch, 0x58
mov al, byte [0xff6ffeb]
sub dword [ecx], 0x70fffe7d
add al, byte [ecx]
adc ecx, dword [edi]
sbb byte [edi], 0x7d
invalid
jmp 0x5582a6
push esi
jno 0x53ffd7
jo 0x5582b2
add dword [ebx], edx
jo 0x53ffd7
and eax, 0x38558b69
div ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], edx
jmp dword [esi]
add esp, 4
xor eax, eax
jb 0x553ce1
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x548816
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x5589b5
jge 0x5589e4
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp 0x55825c
jmp 0x5621d6
push eax
jmp 0x5621d9
push ecx
call fcn.00536f44
add esp, 0xc
test al, al
jb 0x539d97
jne 0x56220a
je 0x5621f8
inc edi
invalid
xor eax, eax
jb 0x539db0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55b730
Capabilities:
Check os version
Encode data using base64

Disassembly:
clc
lodsb al, byte [esi]
call fcn.00548800
pop dword [esp - 4]
je 0x5620d8
jne 0x55b73f
pop ebx
out 0x6e, al
xor eax, eax
jb 0x5513f9
pop esi
mov esp, ebp
jne 0x5620d1
je 0x55b754
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x5620d1
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x56212d
je 0x5620ea
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x551402
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x553cda
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x5620fb
jge 0x562126
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
jmp 0x55825c
cmp al, 2
mov esi, esi
call 0x566b40
invalid

Function at 0x55dada
Capabilities:
Check os version

Disassembly:
push 0x538b09
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x53dc74
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x52e8b9
je 0x549809
push cs
sub byte [eax], ch
jmp 0x528c20
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x5497b5
shr edi, 0x40
je 0x55daf3
push ebx
out dx, al
je 0x5497b5
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]

Function at 0x5610f1
Capabilities:
Check os version

Disassembly:
add esp, 4
and edx, 7
jb 0x5394d3
and bp, bp
sub eax, edx
push eax
push esi
mov si, si
xchg edi, eax
xchg edi, eax
call fcn.005662b8
jmp fcn.00531d73

Function at 0x56238d
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jb 0x536f0b
xchg bh, dl
xchg dl, bh
js 0x54ae1e
jns 0x533397
fiadd dword [edi + 0x6a]
sbb cl, ch
xor eax, 0xf70001a7
test al, 0x68
dec edi
rcl byte [ebp]
ret
mov bp, bp
mov eax, dword [0x62e031]
test eax, eax
jb 0x535750
jne 0x5623b1
je 0x5623a9
dec esp
push ecx
jecxz 0x5623e2
mov eax, dword [0x62de40]
ret
push 0x58
push 0x62dde8
push 0x62e025
shr ah, 0x40
mov dword [0x62e031], 0
shl si, 0x20
ja 0x533379
jbe 0x5623da
nop
cpuid
ret
jbe 0x533379
mov dword [esi - 0x7f], 0x5176f1
add byte [edi], cl
or byte [esi], 0x9e
cld
dec dword [edi]
test dword [eax], esp
adc ch, bh
jmp dword [esi - 0x77]
Function at 0x567bdc
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
jne 0x54823a
shl ax, 0x20
je 0x567bef
add edi, dword [ecx + 0x6870fb5]
popfd
cld
ja 0x5318fb
jbe 0x567bfb