joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d230
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push edi
push eax
call fcn.0051600c
mov edi, dword [esp + 0x14]
add esp, 4
test edi, edi
mov dword [esp + 4], eax
je 0x50d348
cmp edi, 0x28
push ebx
push ebp
push esi
jl 0x50d25c
cmp edi, 0x64
jl 0x50d267
lea ecx, [edi - 0x8c]
cmp ecx, 0x3b
ja 0x50d2c9
mov eax, dword [esp + 0x28]
test eax, eax
jle 0x50d2c3
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
sub ebx, esi
mov ebp, eax
jmp 0x50d280
mov al, byte [ebx + esi]
test al, al
je 0x50d28f
movzx ecx, al
sub ecx, 1
jmp 0x50d294
mov ecx, 0xff
mov eax, dword [esp + 0x10]
cdq
idiv edi
add dword [esp + 0x10], 1
mov byte [esi], cl
and al, 1
test al, al
je 0x50d2bb
test cl, cl
je 0x50d2b4
movzx eax, cl
sub eax, 1
jmp 0x50d2b9
mov eax, 0xff
mov byte [esi], al
add esi, 1
sub ebp, 1
jne 0x50d280
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov eax, edi
sub eax, 1
je 0x50d30b
sub eax, 1
je 0x50d2ff
sub eax, 1
je 0x50d2f5
mov edx, edi
sar edi, 4
and edx, 0xf
movzx ebx, byte [edx + 0x5bc230]
and edi, 0xf
movzx edi, byte [edi + 0x5bc240]
jmp 0x50d313
mov edi, 0xe3
lea ebx, [edi - 0x4a]
jmp 0x50d313
mov edi, 0xdf
mov ebx, 0x55
jmp 0x50d313
mov edi, 0xdd
lea ebx, [edi - 0x33]
mov ebp, dword [esp + 0x28]
test ebp, ebp
jle 0x50d2c3
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
sub esi, ecx
mov eax, dword [esp + 0x10]
cdq
idiv edi
add dword [esp + 0x10], 1
add ecx, 1
xor dl, byte [ecx + esi - 1]
xor dl, bl
sub ebp, 1
mov byte [ecx - 1], dl
jne 0x50d325
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call fcn.005154f0
add esp, 0xc
pop edi
pop ecx
ret

Function at 0x50db30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
add eax, esi
cmp esi, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], eax
jne 0x50db55
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
cmp esi, eax
push ebx
push edi
jae 0x50dbe1
mov eax, dword [esp + 0x20]
movzx ebx, byte [esi]
movzx edi, bx
mov dword [esp + 0x1c], edi
mov edx, sym.convertifd.exe_tab
mov ecx, 0x80
and ecx, ebx
add ebp, 1
cmp ecx, dword [edx + 4]
je 0x50dbb4
cmp dword [esp + 0x24], ebp
jle 0x50dbec
movzx ecx, byte [esi + 1]
add esi, 1
xor ecx, 0xffffff80
and ecx, 0xff
test cl, 0xc0
jne 0x50dbc8
shl edi, 6
or edi, ecx
mov ecx, dword [edx + 0x14]
add edx, 0x14
test ecx, ecx
movzx edi, di
mov dword [esp + 0x1c], edi
jne 0x50db77
jmp 0x50dbc8
mov cx, word [esp + 0x1c]
and cx, word [edx + 0xc]
movzx edi, cx
cmp edi, dword [edx + 0x10]
jl 0x50dbc8
mov word [eax], cx
add dword [esp + 0x10], 1
add esi, 1
add eax, 2
cmp esi, dword [esp + 0x14]
jb 0x50db63
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x50dbe4
or eax, 0xffffffff
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x510c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
mov esi, ecx
movzx eax, word [esi + 0xc]
cdq
mov ecx, 3
idiv ecx
movzx eax, word [esp + 0x2c]
push edi
mov edi, 0x8000
mov dword [esp + 0x14], edi
mov ecx, dword [edx*4 + sym.convertifd.exe_g_ctable]
movzx ebx, word [ecx + eax*2]
xor edx, edx
cmp word [esi + 0x16], dx
mov al, 1
sete dl
mov ecx, 1
movzx edx, dx
test dx, dx
mov dword [esp + 0x18], edx
je 0x510cea
mov byte [esp + 0x13], 9
mov bp, word [esp + 0x14]
nop
test bp, bp
je 0x510d1d
mov edx, edi
and edx, ebx
test cx, cx
jne 0x510d05
test dx, dx
jne 0x510d1d
jmp 0x510d0a
test dx, dx
je 0x510d1d
shr bp, 1
mov word [esp + 0x14], bp
mov edi, dword [esp + 0x14]
add al, 1
test bp, bp
jne 0x510cf5
cmp word [esp + 0x18], 0
je 0x510d39
mov cl, byte [esp + 0x13]
add cl, 0xff
mov byte [esp + 0x13], cl
movzx ecx, cl
mov byte [esp + ecx + 0x1c], al
jmp 0x510d5b
test cx, cx
je 0x510d4e
movzx dx, al
push edx
push esi
call fcn.00510b20
add esp, 8
jmp 0x510d5b
movzx ax, al
push eax
call fcn.00510c10
add esp, 4
test bp, bp
je 0x510d75
mov ecx, edi
and ecx, ebx
xor al, al
neg cx
sbb ecx, ecx
neg ecx
movzx ecx, cx
jmp 0x510cf0
cmp word [esp + 0x18], 0
je 0x510dc2
mov al, byte [esp + 0x13]
xor ebp, ebp
cmp al, 9
jae 0x510dc2
movzx edi, al
mov dl, 9
sub dl, al
lea edi, [esp + edi + 0x1c]
movzx ebx, dl
test bp, bp
je 0x510daa
movzx ax, byte [edi]
push eax
push esi
call fcn.00510b20
add esp, 8
jmp 0x510db7
movzx cx, byte [edi]
push ecx
call fcn.00510c10
add esp, 4
xor ebp, 1
add edi, 1
sub ebx, 1
jne 0x510d95
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511a80
add esp, 0x1c
ret

Function at 0x5117a0
Capabilities:
Read file on windows

Disassembly:
movzx ecx, word [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [esp + 0xc]
ret

Function at 0x5117d0
Capabilities:
Write file on windows

Disassembly:
movzx ecx, word [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ax, word [esp + 0xc]
ret

Function at 0x511a80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5bd254]
jne 0x511a8a
repz ret
jmp fcn.0051b0d1
Function at 0x515a1a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x515a57
cmp dword [ebp + 0x14], edi
je 0x515a57
cmp ecx, edi
jne 0x515a5e
call fcn.0051af93
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0051b2db
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x515a72
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x515a93
cmp ebx, 0xffffffff
je 0x515a82
push ebx
push edi
push ecx
call fcn.00511e90
add esp, 0xc
cmp esi, edi
je 0x515a3f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x515a3f
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x515aaf
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x515ab6
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x515ba7
test word [esi + 0xc], 0x10c
je 0x515b0a
mov eax, dword [esi + 4]
test eax, eax
je 0x515b0a
jl 0x515c08
cmp ebx, eax
mov edi, ebx
jb 0x515adb
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x515baf
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00521b61
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x515b9f
cmp ebx, dword [ebp - 0xc]
jb 0x515b77
cmp dword [ebp - 0xc], 0
je 0x515b34
mov ecx, Ordinal_3
xor edx, edx
cmp ebx, ecx
jbe 0x515b29
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x515b30
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x515b3f
mov eax, Ordinal_3
cmp ebx, eax
ja 0x515b3f
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x515bdb
push eax
push dword [ebp - 8]
push esi
call fcn.00520c63
pop ecx
push eax
call fcn.00521a64
add esp, 0xc
test eax, eax
je 0x515c1a
cmp eax, 0xffffffff
je 0x515c08
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x515b9f
push esi
call fcn.00521383
cmp eax, 0xffffffff
pop ecx
je 0x515c0c
cmp dword [ebp - 4], 0
je 0x515bdb
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x515abe
mov eax, dword [ebp + 0x14]
jmp 0x515a59
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x515bc6
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00511e90
add esp, 0xc
call fcn.0051af93
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x515a4f
cmp dword [ebp + 0xc], 0xffffffff
je 0x515bf1
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00511e90
add esp, 0xc
call fcn.0051af93
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x515a4f
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x515a59
or dword [esi + 0xc], 0x10
jmp 0x515c0c
Function at 0x51e599
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5bdd88]
je 0x51e5b4
inc edi
cmp edi, 0x17
jb 0x51e5a5
cmp edi, 0x17
jae 0x51e734
push ebp
push 3
call fcn.00527639
cmp eax, 1
pop ecx
je 0x51e700
push 3
call fcn.00527639
test eax, eax
pop ecx
jne 0x51e5e8
cmp dword [0x5bd330], 1
je 0x51e700
cmp ebx, 0xfc
je 0x51e733
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x69c958
push ebp
call fcn.00517df3
add esp, 0xc
test eax, eax
je 0x51e61e
push esi
push esi
push esi
push esi
push esi
call fcn.0051b1df
add esp, 0x14
push 0x104
mov esi, 0x69c971
push esi
push 0
mov byte [0x69ca75], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x51e662
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00517df3
add esp, 0xc
test eax, eax
je 0x51e662
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0051b1df
add esp, 0x14
push esi
call fcn.005138b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x51e6a7
push esi
call fcn.005138b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x69cc6c
push 0x5823a8
sub ecx, eax
push ecx
push eax
call fcn.00516b77
add esp, 0x14
test eax, eax
je 0x51e6a7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0051b1df
add esp, 0x14
jmp 0x51e6a9
xor esi, esi
push 0x5825cc
push ebx
push ebp
call fcn.00517d82
add esp, 0xc
test eax, eax
je 0x51e6c9
push esi
push esi
push esi
push esi
push esi
call fcn.0051b1df
add esp, 0x14
push dword [edi*8 + 0x5bdd8c]
push ebx
push ebp
call fcn.00517d82
add esp, 0xc
test eax, eax
je 0x51e6eb
push esi
push esi
push esi
push esi
push esi
call fcn.0051b1df
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0052747c
add esp, 0xc
jmp 0x51e733
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x51e733
cmp ebp, 0xffffffff
je 0x51e733
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5bdd8c]
push dword [esi]
call fcn.005138b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x522f3f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x522f6c
call fcn.0051afa6
mov dword [eax], esi
call fcn.0051af93
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0051b2db
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x522f48
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x522f9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051afb9
pop ecx
call fcn.0051af93
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x522fc2
test al, 1
je 0x522fc2
test byte [esp + 0xc], 2
je 0x522fc2
call fcn.0051afa6
mov dword [eax], 5
call fcn.0051af93
mov dword [eax], 0xd
jmp 0x522f92
xor eax, eax
pop esi
ret
Function at 0x52747c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0051a691
xor ebx, ebx
cmp dword [0x69cdd4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x527552
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x527632
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x58ca88
push edi
call esi
cmp eax, ebx
je 0x527632
push eax
call fcn.0051a623
mov dword [esp], 0x58ca78
push edi
mov dword [0x69cdd4], eax
call esi
push eax
call fcn.0051a623
mov dword [esp], 0x58ca64
push edi
mov dword [0x69cdd8], eax
call esi
push eax
call fcn.0051a623
mov dword [0x69cddc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00516806
test eax, eax
pop ecx
pop ecx
je 0x527520
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0051b1df
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x527552
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0051a623
cmp eax, ebx
pop ecx
mov dword [0x69cde4], eax
je 0x527552
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0051a623
pop ecx
mov dword [0x69cde0], eax
mov eax, dword [0x69cde0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x5275d7
cmp dword [0x69cde4], ecx
je 0x5275d7
push eax
call fcn.0051a69a
push dword [0x69cde4]
mov esi, eax
call fcn.0051a69a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x5275d7
cmp edi, ebx
je 0x5275d7
call esi
cmp eax, ebx
je 0x5275a4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5275a4
test byte [ebp - 0x18], 1
jne 0x5275d7
lea eax, [ebp - 0x10]
push eax
call fcn.00516879
test eax, eax
pop ecx
je 0x5275bf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0051b1df
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x5275ce
or dword [ebp + 0x10], 0x200000
jmp 0x527612
or dword [ebp + 0x10], 0x40000
jmp 0x527612
mov eax, dword [0x69cdd8]
cmp eax, dword [ebp - 8]
je 0x527612
push eax
call fcn.0051a69a
cmp eax, ebx
pop ecx
je 0x527612
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x527612
mov eax, dword [0x69cddc]
cmp eax, dword [ebp - 8]
je 0x527612
push eax
call fcn.0051a69a
cmp eax, ebx
pop ecx
je 0x527612
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x69cdd4]
call fcn.0051a69a
cmp eax, ebx
pop ecx
je 0x527632
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x527634
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x52d580
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0xfdf0
call fcn.00516c30
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0xfdec], eax
mov eax, dword [esp + 0xfdf4]
mov eax, dword [eax + 4]
push ebx
push ebp
push esi
push 0x239b
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 0x25f6
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
jg 0x52d650
je 0x52d5f7
cmp esi, 0x4a1
je 0x52d5ea
cmp esi, 0x1e03
jne case.0x52d666.9723
mov dword [esp + 0xc], 0x58cb0c
jmp 0x52d695
mov dword [esp + 0xc], 0x58cb04
jmp 0x52d702
push 0
push 0
push 0xb0
push ebx
mov dword [esp + 0x1c], 0x586c88
call ebp
movzx esi, ax
lea edx, [esi - 1]
cmp edx, 0xfde6
ja 0x52d702
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 1]
push ecx
push 0xd
push ebx
call ebp
mov al, byte [esp + esi + 0xf]
cmp al, 0x21
je 0x52d643
cmp al, 0x5e
je 0x52d643
cmp al, 0x3e
je 0x52d643
cmp al, 0x3c
jne 0x52d702
mov dword [esp + 0xc], 0x581f78
jmp 0x52d702
lea eax, [esi - 0x25f7]
cmp eax, 0x1d
ja case.0x52d666.9723
movzx ecx, byte [eax + 0x52d7e8]
jmp dword [ecx*4 + 0x52d7b8]
mov dword [esp + 0xc], 0x586c54
cmp esi, 0x2609
je 0x52d695
cmp esi, 0x25f8
je 0x52d695
cmp esi, 0x1e03
je 0x52d695
cmp esi, 0x25f7
jne 0x52d702
push 0
push 0
push 0xb0
push ebx
call ebp
mov esi, eax
shr esi, 0x10
cmp esi, 0xfde6
jge 0x52d702
lea edx, [esp + 0x10]
push edx
lea eax, [esi + 3]
push eax
push 0xd
push ebx
call ebp
lea ecx, [esi + 2]
cmp eax, ecx
jne 0x52d702
push edi
mov edi, 0x586c88
lea esi, [esp + esi + 0x14]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x52d702
push edx
push edx
push 0xb0
push ebx
call ebp
shr eax, 0x10
add eax, 1
push eax
push 0
push 0
push 0xb0
push ebx
call ebp
movzx eax, ax
push eax
push 0xb1
push ebx
call ebp
mov ecx, dword [esp + 0xc]
push ecx
push 0
push 0xc2
push ebx
call ebp
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0xfdf8]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00511a80
add esp, 0xfdf0
ret
mov dword [esp + 0xc], 0x58cb00
jmp 0x52d675
mov dword [esp + 0xc], 0x586c5c
jmp 0x52d675
mov dword [esp + 0xc], 0x58cafc
jmp 0x52d675
mov dword [esp + 0xc], 0x586c6c
jmp 0x52d675
mov dword [esp + 0xc], 0x581ad8
jmp 0x52d675
mov dword [esp + 0xc], 0x585138
jmp 0x52d675
mov dword [esp + 0xc], 0x58caf8
jmp 0x52d675
mov dword [esp + 0xc], 0x586c50
jmp 0x52d675
mov dword [esp + 0xc], 0x58caf4
jmp 0x52d675
mov dword [esp + 0xc], 0x584b58
jmp 0x52d675
Function at 0x54af00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x69d328]
test eax, eax
mov dword [0x69d320], 1
je 0x54af86
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [0x69d010], 0x63
jne 0x54af40
push 0xffffea78
call sym.convertifd.exe_IpGMessage
add esp, 4
call fcn.0054aee0
mov eax, dword [0x69d324]
test eax, eax
je 0x54af60
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x69d324], 0
mov eax, dword [0x69d11c]
test eax, eax
je 0x54af72
push 0x63
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x69d11c], 0
mov dword [0x69d014], 0
mov eax, 1
ret
Function at 0x54eae0
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x1f4
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x1f0], eax
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
mov edi, dword [esp + 0x200]
push 0
push 0
push 0x184
push 0x1a99
push edi
mov dword [esp + 0x28], 0x4000
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0
call ebp
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 2
push 1
call sym.convertifd.exe_WNetOpenEnumA
test eax, eax
je 0x54eb5b
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1f0]
xor ecx, esp
call fcn.00511a80
add esp, 0x1f4
ret
push ebx
push esi
lea ecx, [ecx]
mov ecx, dword [esp + 0x1c]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x20]
mov ebx, eax
lea edx, [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x20], ebx
call sym.convertifd.exe_WNetEnumResourceA
mov esi, eax
test esi, esi
mov dword [esp + 0x24], esi
jne 0x54ec6a
push 0x80
lea edx, [esp + 0x2c]
push edx
push 0x1a98
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor ebx, ebx
cmp dword [esp + 0x14], ebx
jbe 0x54ec51
mov esi, dword [esp + 0x10]
add esi, 0x10
nop
mov eax, dword [esi]
test eax, eax
je 0x54ec3d
mov ecx, dword [esi + 4]
push ecx
push eax
lea edx, [esp + 0xb4]
push str._s_t_s
push edx
call fcn.005135ca
add esp, 0x10
lea eax, [esp + 0xac]
push eax
push 0
push 0x180
push 0x1a99
push edi
call ebp
lea ecx, [esp + 0xac]
push 9
push ecx
call fcn.00513950
add esp, 8
test eax, eax
je 0x54ec10
mov byte [eax], 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xb0]
push eax
call fcn.0051e073
add esp, 8
test eax, eax
jne 0x54ec38
push eax
push ebx
push 0x186
push 0x1a99
push edi
call ebp
add dword [esp + 0x18], 1
add ebx, 1
add esi, 0x20
cmp ebx, dword [esp + 0x14]
jb 0x54ebc0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, 0x103
jne 0x54eb60
jmp 0x54ec79
cmp esi, 0x103
je 0x54ec55
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x20]
push ecx
call sym.convertifd.exe_WNetCloseEnum
mov ecx, dword [esp + 0x200]
pop esi
xor eax, eax
cmp dword [esp + 0x14], eax
pop ebx
pop edi
setne al
pop ebp
xor ecx, esp
call fcn.00511a80
add esp, 0x1f4
ret
Function at 0x5532e0
Capabilities:
Read file on windows

Disassembly:
push 0
push 0
push esi
call fcn.00515def
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push ecx
call fcn.00515cb6
sub eax, 1
add esp, 0x1c
neg eax
sbb eax, eax
add eax, 1
ret

Function at 0x559070
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
test eax, eax
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x120]
jne 0x5590b3
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 8]
mov ecx, dword [esp + 0x11c]
push edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x108
ret
Function at 0x55bca0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x6a0f58]
push 0
push eax
push esi
call fcn.00515def
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push 1
push ecx
push edx
call fcn.00515cb6
sub eax, 1
add esp, 0x1c
neg eax
sbb eax, eax
add eax, 1
ret

Function at 0x55cae0
Capabilities:
Read file on windows

Disassembly:
push eax
push 1
push 0x43
push ecx
call fcn.00515cb6
mov ecx, eax
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
and eax, ecx
ret

Function at 0x55d5b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
xor ecx, ecx
push edi
xor eax, eax
lea ecx, [ecx]
mov edx, dword [esi + 0x70]
mov byte [eax + edx], cl
movzx edi, word [esi + 0x18]
mov edx, dword [esi + 0x70]
mov word [eax + edx + 1], di
mov edx, dword [esi + 0x70]
mov byte [eax + edx + 0x300], cl
movzx edi, word [esi + 0x18]
mov edx, dword [esi + 0x70]
mov word [eax + edx + 0x301], di
add eax, 3
add ecx, 1
cmp eax, 0x300
jl 0x55d5c0
mov eax, dword [esp + 0x20]
movzx ecx, word [eax + 2]
mov edi, dword [esp + 0x1c]
push 0
add ecx, 4
push ecx
push edi
call fcn.00515def
add esp, 0xc
cmp eax, 0xffffffff
jne 0x55d620
pop edi
or eax, eax
pop ebp
add esp, 0xc
ret
mov dword [esp + 0xc], 0
push ebx
lea esp, [esp]
push edi
push 1
push 0x12
push ebp
call fcn.00515cb6
add esp, 0x10
cmp eax, 1
jne 0x55d72b
cmp byte [ebp + 6], 0
jne 0x55d6f4
cmp word [esi + 0x1a], 2
movzx dx, byte [ebp + 7]
movzx ebx, dx
movzx eax, bx
mov dword [esp + 0xc], eax
jne 0x55d67c
movsx ecx, bx
push ecx
push 2
call sym.convertifd.exe_CfSymSet
movzx edx, ax
add esp, 8
mov dword [esp + 0xc], edx
lea eax, [esp + 0x24]
push eax
lea eax, [ebp + 0x10]
call fcn.0055d1b0
movsx eax, word [esp + 0x28]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0x18], eax
add esp, 4
fild dword [esp + 0x14]
fadd qword [0x581440]
call fcn.005132d0
cmp bx, 0x30
mov edx, dword [esp + 0xc]
movzx ecx, ax
movsx eax, dx
lea edi, [eax + eax*2]
mov eax, dword [esi + 0x70]
mov byte [edi + eax], dl
mov edx, dword [esi + 0x70]
mov word [edi + edx + 1], cx
mov edi, dword [esi + 0x70]
movsx eax, bx
lea edx, [eax + eax*2 + 0x300]
mov byte [edx + edi], bl
mov edx, dword [esi + 0x70]
mov edi, dword [esp + 0x20]
lea eax, [eax + eax*2]
mov word [eax + edx + 0x301], cx
jne 0x55d6f4
mov word [esi + 0x18], cx
movzx eax, word [ebp + 2]
push 1
sub eax, 0xe
push eax
push edi
call fcn.00515def
add esp, 0xc
cmp eax, 0xffffffff
je 0x55d73b
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, 0x100
mov dword [esp + 0x10], eax
jl 0x55d630
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
push edi
call fcn.00519b00
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0xc
ret

Function at 0x55e730
Capabilities:
Read file on windows

Disassembly:
push eax
push 1
push ecx
push edx
call fcn.00515cb6
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
add eax, 1
ret