joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5fa0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x4c5fb1
cmp al, 0x7a
jle 0x4c6019
cmp al, 0x41
jl 0x4c5fb9
cmp al, 0x5a
jle 0x4c6019
cmp al, 0x30
jl 0x4c5fc1
cmp al, 0x39
jle 0x4c6019
cmp al, 0x2d
je 0x4c6019
cmp al, 0x2e
je 0x4c6019
cmp al, 0x5f
je 0x4c6019
cmp al, 0x7e
je 0x4c6019
cmp al, 0x25
jne 0x4c60c1
mov al, byte [edx + 1]
cmp al, 0x30
jl 0x4c5fe4
cmp al, 0x39
jle 0x4c5ff6
cmp al, 0x61
jl 0x4c5fec
cmp al, 0x66
jle 0x4c5ff6
sub al, 0x41
cmp al, 5
ja 0x4c6129
mov al, byte [edx + 2]
cmp al, 0x30
jl 0x4c6001
cmp al, 0x39
jle 0x4c6019
cmp al, 0x61
jl 0x4c6009
cmp al, 0x66
jle 0x4c6019
cmp al, 0x41
jl 0x4c6129
cmp al, 0x46
jg 0x4c6129
push ebx
mov bl, byte [esp + 0x10]
nop
mov al, byte [edx]
cmp al, 0x61
jl 0x4c602e
cmp al, 0x7a
jle 0x4c616c
cmp al, 0x41
jl 0x4c603a
cmp al, 0x5a
jle 0x4c616c
cmp al, 0x30
jl 0x4c6046
cmp al, 0x39
jle 0x4c616c
cmp al, 0x2d
je 0x4c616c
cmp al, 0x2e
je 0x4c616c
cmp al, 0x5f
je 0x4c616c
cmp al, 0x7e
je 0x4c616c
cmp al, 0x25
jne 0x4c6134
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x4c607b
cmp cl, 0x39
jle 0x4c608d
cmp cl, 0x61
jl 0x4c6085
cmp cl, 0x66
jle 0x4c608d
sub cl, 0x41
cmp cl, 5
ja 0x4c60ba
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x4c609e
cmp cl, 0x39
jle 0x4c616c
cmp cl, 0x61
jl 0x4c60ac
cmp cl, 0x66
jle 0x4c616c
cmp cl, 0x41
jl 0x4c60ba
cmp cl, 0x46
jle 0x4c616c
pop ebx
mov dword [esi], edx
xor eax, eax
pop esi
ret
cmp al, 0x21
je 0x4c6019
cmp al, 0x24
je 0x4c6019
cmp al, 0x26
je 0x4c6019
cmp al, 0x28
je 0x4c6019
cmp al, 0x29
je 0x4c6019
cmp al, 0x2a
je 0x4c6019
cmp al, 0x2b
je 0x4c6019
cmp al, 0x2c
je 0x4c6019
cmp al, 0x3b
je 0x4c6019
cmp al, 0x3d
je 0x4c6019
cmp al, 0x27
je 0x4c6019
cmp al, 0x3a
je 0x4c6019
cmp al, 0x40
je 0x4c6019
xor eax, eax
cmp dword [esp + 0x10], eax
pop esi
sete al
ret
cmp al, 0x21
je 0x4c616c
cmp al, 0x24
je 0x4c616c
cmp al, 0x26
je 0x4c616c
cmp al, 0x28
je 0x4c616c
cmp al, 0x29
je 0x4c616c
cmp al, 0x2a
je 0x4c616c
cmp al, 0x2b
je 0x4c616c
cmp al, 0x2c
je 0x4c616c
cmp al, 0x3b
je 0x4c616c
cmp al, 0x3d
je 0x4c616c
cmp al, 0x27
je 0x4c616c
cmp al, 0x3a
je 0x4c616c
cmp al, 0x40
jne 0x4c60ba
cmp al, bl
je 0x4c60ba
xor ecx, ecx
cmp al, 0x25
sete cl
lea edx, [edx + ecx*2]
inc edx
lea ecx, [ecx*2 + 1]
jmp 0x4c6020
Function at 0x4c62c0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x4c62d6
cmp al, 0x7a
jle 0x4c6386
cmp al, 0x41
jl 0x4c62e2
cmp al, 0x5a
jle 0x4c6386
cmp al, 0x30
jl 0x4c62ee
cmp al, 0x39
jle 0x4c6386
cmp al, 0x2d
je 0x4c6386
cmp al, 0x2e
je 0x4c6386
cmp al, 0x5f
je 0x4c6386
cmp al, 0x7e
je 0x4c6386
cmp al, 0x25
jne 0x4c6356
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x4c631b
cmp cl, 0x39
jle 0x4c632d
cmp cl, 0x61
jl 0x4c6325
cmp cl, 0x66
jle 0x4c632d
sub cl, 0x41
cmp cl, 5
ja 0x4c634e
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x4c633a
cmp cl, 0x39
jle 0x4c6386
cmp cl, 0x61
jl 0x4c6344
cmp cl, 0x66
jle 0x4c6386
cmp cl, 0x41
jl 0x4c634e
cmp cl, 0x46
jle 0x4c6386
pop esi
mov eax, 1
pop ebx
ret
cmp al, 0x21
je 0x4c6386
cmp al, 0x24
je 0x4c6386
cmp al, 0x26
je 0x4c6386
cmp al, 0x28
je 0x4c6386
cmp al, 0x29
je 0x4c6386
cmp al, 0x2a
je 0x4c6386
cmp al, 0x2b
je 0x4c6386
cmp al, 0x2c
je 0x4c6386
cmp al, 0x3b
je 0x4c6386
cmp al, 0x3d
je 0x4c6386
cmp al, 0x27
je 0x4c6386
cmp al, 0x3a
jne 0x4c639d
xor ecx, ecx
cmp al, 0x25
sete cl
lea esi, [esi + ecx*2]
inc esi
lea ecx, [ecx*2 + 1]
jmp 0x4c62c8
cmp al, 0x40
jne 0x4c634e
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4c63eb
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4c63bb
push eax
call dword [0x6b21ac]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x4c63dc
push eax
push ecx
call fcn.004b95c0
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push eax
push ecx
call fcn.004c7120
add esp, 0xc
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x4de010
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.00490e90
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004cffb0
mov ebx, eax
push ebx
push esi
call fcn.004cfe90
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4de099
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4de073
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004cff00
push esi
call fcn.004d0050
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4de099
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004cffb0
mov ebx, eax
push ebx
push esi
call fcn.004cfe90
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4de108
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4de0ee
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004cff00
push esi
call fcn.004d0050
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x4de091
push esi
call fcn.004d0050
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x52c800
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x52c814
mov dword [esp + 0x18], fcn.0052afe0
jmp fcn.004d1b40
mov dword [esp + 0x18], fcn.0052a280
jmp fcn.004d1870
Function at 0x569141
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x110
call fcn.00490e90
mov eax, dword [0x6b20c8]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
push ebp
mov dword [esp + 4], ecx
mov edx, dword [eax]
cmp edx, 8
ja case.default.0x569056
jmp dword [edx*4 + 0x5692a0]
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.othername
call fcn.00556da0
add esp, 0xc
jmp 0x569267
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.X400Name
call fcn.00556da0
add esp, 0xc
jmp 0x569267
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.EdiPartyName
call fcn.00556da0
add esp, 0xc
jmp 0x569267
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push str.email
call fcn.00556f60
add esp, 0xc
jmp 0x569267
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push 0x626348
call fcn.00556f60
add esp, 0xc
jmp 0x569267
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push 0x62634c
call fcn.00556f60
add esp, 0xc
jmp 0x569267
push 0x100
lea ecx, [esp + 0x14]
push ecx
push dword [eax + 4]
call fcn.0055da60
add esp, 0xc
test eax, eax
je 0x56926b
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push str.DirName
call fcn.00556da0
add esp, 0xc
jmp 0x569267
mov eax, dword [eax + 4]
mov ebp, dword [eax + 8]
mov eax, dword [eax]
cmp eax, 4
jne 0x56917e
movzx eax, byte [ebp + 3]
push eax
movzx eax, byte [ebp + 2]
push eax
movzx eax, byte [ebp + 1]
push eax
movzx eax, byte [ebp]
push eax
push str._d._d._d._d
lea eax, [esp + 0x24]
push 0x100
push eax
call fcn.004da460
add esp, 0x1c
jmp 0x56920c
cmp eax, 0x10
jne 0x569225
push ebx
push esi
push edi
mov byte [esp + 0x1c], 0
xor ebx, ebx
movzx ecx, byte [ebp]
movzx eax, byte [ebp + 1]
shl ecx, 8
or ecx, eax
lea eax, [esp + 0x14]
push ecx
push 0x6247a4
push 5
push eax
call fcn.004da460
lea edx, [esp + 0x24]
add esp, 0x10
lea ebp, [ebp + 2]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x5691c0
lea edi, [esp + 0x1c]
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5691d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 7
je 0x569203
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x5691f0
mov ax, word [0x6a14dc]
mov word [edi], ax
inc ebx
cmp ebx, 8
jl 0x569191
pop edi
pop esi
pop ebx
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push str.IP_Address
call fcn.00556da0
add esp, 0xc
jmp 0x569267
lea eax, [esp + 4]
push eax
push str._invalid_
push str.IP_Address
call fcn.00556da0
add esp, 0xc
jmp 0x569267
push dword [eax + 4]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.004dc6d0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push str.Registered_ID
call fcn.00556da0
add esp, 0x18
test eax, eax
jne 0x569283
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0048f6ef
add esp, 0x110
mov ecx, dword [esp + 4]
mov eax, ecx
mov ecx, dword [esp + 0x110]
pop ebp
xor ecx, esp
call fcn.0048f6ef
add esp, 0x110
ret
Function at 0x57b3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8fef
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push esi
mov eax, dword [0x6b20c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x13c], ecx
lea ecx, [ebp - 0x14]
call fcn.00575ad0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x57b407
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x50]
push eax
push str._s_tmp
lea ecx, [ebp - 0x14]
push ecx
call fcn.00581da0
add esp, 0xc
jmp 0x57b416
mov edx, dword [ebp - 0x10]
add edx, 0x50
push edx
lea ecx, [ebp - 0x14]
call fcn.005815b0
mov ecx, dword [ebp + 8]
invalid
inc edx

Function at 0x57c090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6b20c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.005740b0
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.0058a1a0
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.0058a1a0
add esp, 0xc
mov dx, word [0x629038]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.0058a1a0
add esp, 0xc
push 0x629d1c
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.005a8fda
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0xa0
call fcn.005763a0
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.005a8fda
add esp, 0xc
push 0x629d20
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.005a8fda
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.005a8fda
add esp, 0xc
push 0x629d1c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.005a8fda
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0xa0
call fcn.005817e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x57c1f4
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x57c211
push 0x629d28
call fcn.005740b0
add esp, 4
mov eax, 1
jmp 0x57c265
cmp dword [ebp + 0xc], 0
je 0x57c22c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x57c23f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x57c256
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push str.Success.
call fcn.005740b0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f6ef
mov esp, ebp
pop ebp
ret 0xc
Function at 0x584d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9573
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6b20c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.00586840
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x584dbe
mov eax, 1
jmp 0x584e0c
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.00575a30
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.005815b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00575c40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f6ef
mov esp, ebp
pop ebp
ret
Function at 0x585870
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9763
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6b20c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00575ad0
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp + 0xc]
call fcn.005817e0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x585989
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.005817e0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x585989
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x629058
mov edx, dword [ebp - 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x28]
push eax
call fcn.00581da0
add esp, 0x18
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00581030
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00575c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00575c40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5859e0
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9796
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6b20c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00575ad0
mov byte [ebp - 4], 1
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.00586880
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x585a36
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp + 8]
call fcn.00586880
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x585a61
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.005815b0
jmp 0x585a96
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.005824d0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.005815b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00575c40
push 0
lea ecx, [ebp - 0x14]
call fcn.005817e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x585ae4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x585ae4
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00575c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00575c40
mov eax, dword [ebp - 0x2c]
jmp 0x585b60
lea ecx, [ebp - 0x14]
call fcn.005817e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
and edx, 0x10
jne 0x585b25
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00575c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00575c40
mov eax, dword [ebp - 0x34]
jmp 0x585b60
cmp dword [ebp - 0x10], 0xffffffff
jne 0x585b2d
jmp 0x585b3b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x585a3c
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00575c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00575c40
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x586a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x586a18
mov dword [ebp - 8], 1
jmp 0x586a1f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x586a25
cmp dword [ebp - 0x14], 0
jne 0x586a39
push 0x80004005
call fcn.005762f0
xor edx, edx
jne 0x586a09
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x586b80
cmp dword [ebp + 8], 0
je 0x586b80
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x586b6f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x586b55
cmp dword [ebp - 4], 2
jbe 0x586aa6
cmp dword [ebp - 4], 7
je 0x586aeb
jmp 0x586b55
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x586acb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x586ae6
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x586b83
jmp 0x586b6d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x586b3b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x586b3b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x586b3b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x586b53
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x586b53
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax], cx
mov eax, 0xd
jmp 0x586b83
jmp 0x586b6d
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x586b83
jmp 0x586b80
mov ecx, 2
imul edx, ecx, 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + edx], ax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5875d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c98c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6b20c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00575ad0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.005758d0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x587890
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ecx + 8]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.00588b50
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x5af14d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aee10

Function at 0x5af158
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aef91

Function at 0x5b0eb5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b0823

Function at 0x5b0ec0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b0a5e

Function at 0x5b217e
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5b21a0
cmp ecx, 0x62e6d0
je 0x5b21a0
xor eax, eax
inc eax
lock xadd dword [ecx + 0xb0], eax
inc eax
pop ebp
ret
mov eax, closesocket
dec ecx
sub eax, 0x86e5a454
call 0x8740c600
mov eax, ecx
ror edx, 0xf
call fcn.004a1782
neg esi
cmp ebp, 0x3c40735
jp 0x5b21c2
not eax
sub eax, 0xf6aa8c5f
and esi, 0xe1c466ea
mov esi, 0x5836329f
mov ecx, 0x656e8257
invalid