joyce8/EMBER2024-capa huggingface dataset:
Function at 0x567600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58ba52
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f30a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.00582ef0
mov ecx, eax
call fcn.00581fe0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x567652
xor eax, eax
jmp 0x56774a
mov ecx, dword [ebp - 0x28]
add ecx, 0x24
call fcn.0040d690
movzx edx, al
test edx, edx
je 0x56766b
xor eax, eax
jmp 0x56774a
mov eax, dword [ebp - 0x14]
add eax, 0x24
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x24
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00408f60
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00472880
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0057e140
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00472880
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5676c9
lea ecx, [ebp - 0x10]
call fcn.00472880
push eax
call fcn.00580880
add esp, 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005812b0
add esp, 8
test eax, eax
jne 0x567704
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041e800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041e800
mov eax, dword [ebp - 0x20]
jmp 0x56774a
push 0
push 0
push 1
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
call fcn.00472880
push eax
lea ecx, [ebp - 0x18]
call fcn.00472880
push eax
call fcn.00580740
add esp, 0x18
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041e800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041e800
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x567ec0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5f30a8]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x567ef4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x567ef4
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x567f03
jmp 0x56800e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
movzx ecx, word [eax]
test ecx, ecx
je 0x567f55
mov edx, dword [ebp - 0x218]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x567f3b
mov ecx, dword [ebp - 0x218]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x567f44
mov eax, dword [ebp - 0x218]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x218], ecx
jmp 0x567f12
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x567fb8
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x420]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
mov word [ebp + ecx*2 - 0x420], 0
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00567ec0
add esp, 8
mov ecx, dword [ebp - 0x214]
add ecx, 2
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x567fda
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004585d0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004585a0
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x56800e
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a1f8d
mov esp, ebp
pop ebp
ret
Function at 0x568170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x5681bf
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5681b5
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x568219
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x5681df
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x568800
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x5d6a18]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x5d6a18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x568880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x568890
xor eax, eax
jmp 0x568a2d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x5689ee
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x5d6a18]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x5d6a18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5d6a18]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x5d6a18]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x5d6a18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5d6a18]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x5d6a18]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x5d6a18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x568899
cmp dword [ebp + 0x10], 0
je 0x568a27
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x5d6a18]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x5689f4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x56e640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x56e65a
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x56e664
mov eax, 0x1000000
jmp 0x56e73f
mov edx, dword [ebp - 0x18]
add edx, 0x244
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x18]
add eax, 0x244
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx + eax*2 + 0x242]
mov word [ebp - 8], dx
movzx eax, word [ebp - 8]
cmp eax, 0x5c
je 0x56e6c3
movzx ecx, word [ebp - 8]
cmp ecx, 0x2f
je 0x56e6c3
push 0x5d6eb0
mov edx, dword [ebp - 0x18]
add edx, 0x244
push edx
call fcn.004585a0
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x56e6f7
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0xffffffff
setne cl
mov byte [ebp - 0x11], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x56e6f7
mov eax, 0x2000000
jmp 0x56e73f
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005683c0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56e71d
mov eax, dword [ebp - 0xc]
jmp 0x56e73f
mov ecx, dword [ebp - 4]
push ecx
call fcn.0056d910
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x56e73d
mov eax, 0x200
jmp 0x56e73f
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x56f3a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00458430
cmp dword [ebp + 0xc], 0
je 0x56f3ee
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x56f3ee
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0xffffffff
mov esp, ebp
pop ebp
ret 8

Function at 0x56f460
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.00458430
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x56f49e
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
cmp dword [ebp + 0x10], 0
je 0x56f4b8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
jmp 0x56f4c1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x56f360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call fcn.004582e0
add esp, 8
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx], 0
setne al
mov esp, ebp
pop ebp
ret 0x10

Function at 0x56f780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x80004005
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x56f7b1
jmp 0x56f827
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x56f7d2
jmp 0x56f827
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x56f7de
jmp 0x56f827
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x56f6d0
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.004582e0
add esp, 8
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x56f820
jmp 0x56f827
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x56f980
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5f30a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 8], 0
je 0x56f9e1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x56f9eb
jmp 0x56fb0e
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x56fa1a
jmp 0x56fb0e
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x56fa39
jmp 0x56fb0e
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x56fa62
jmp 0x56fb0e
lea edx, [ebp - 0xc]
push edx
call fcn.0056f8a0
add esp, 4
test eax, eax
jne 0x56fa7c
jmp 0x56fb0e
mov eax, dword [ebp - 0x14]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x56faa1
jmp 0x56fb0e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x56fade
jmp 0x56fb0e
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0056f8d0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x56fb0e
cmp dword [ebp - 0x24], 0
je 0x56fb0e
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 0xffffffff
je 0x56fb25
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1f8d
mov esp, ebp
pop ebp
ret
Function at 0x56fb40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x56fb5c
mov eax, dword [ebp - 4]
jmp 0x56fc37
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x56fc12
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5d77f8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5d77f8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5d77f8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5d77f8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5d77f8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5d77f8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5d77f8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x5d77f8]
dec ebp
jne 0x56fb7c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x56fc2e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x5d77f8]
dec ecx
jne 0x56fc1c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5706e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589723
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5f30a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x6c], 0
push 0x40
push 0
lea eax, [ebp - 0x68]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x70]
call fcn.0041e820
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5d84c0
lea ecx, [ebp - 0x70]
push ecx
call fcn.00405940
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x57077c
mov word [ebp - 0x3c], 0xa
jmp 0x570782
mov word [ebp - 0x3c], 0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.00472880
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5707b2
jmp 0x5707cd
cmp dword [ebp + 0x10], 0
je 0x5707c6
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x24], 0
je 0x5707e4
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x20], 0
je 0x5707fb
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0041e800
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x570f20
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58af41
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5f30a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x6c], 0
jne 0x570f56
jmp 0x571021
mov ecx, dword [ebp - 0x18]
add ecx, 0x7c
push ecx
lea ecx, [ebp - 0x14]
call fcn.00454490
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00587230
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x570fbd
mov ecx, dword [ebp - 0x18]
add ecx, 0x7c
call fcn.00472880
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x570fbd
mov ecx, dword [ebp - 0x18]
add ecx, 0x7c
call fcn.00472880
push eax
call fcn.0057de30
add esp, 4
test eax, eax
je 0x570fbd
mov ecx, dword [ebp - 0x18]
add ecx, 0x7c
call fcn.00472880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x84], 3
jne 0x570fd3
mov ecx, dword [ebp - 0x18]
call fcn.00570ee0
jmp 0x571005
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x80], 2
je 0x570feb
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x80], 3
jne 0x570ff9
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00570df0
jmp 0x571005
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00570e40
push 0x16760
mov ecx, dword [ebp - 0x18]
call fcn.00570d60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004545b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5733c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b0fe
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f30a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.00450db0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.004482a0
mov ecx, eax
call fcn.00413a80
movzx ecx, al
test ecx, ecx
je 0x573420
xor al, al
jmp 0x5734db
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.0057e4f0
add esp, 8
mov dword [ebp - 4], 0
push 0x5d896c
lea ecx, [ebp - 0x1c]
call fcn.0044c010
lea ecx, [ebp - 0x14]
call fcn.00450e40
add eax, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d040
mov byte [ebp - 4], 1
movzx eax, byte [ebp + 0x1c]
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.___vipfrom_d____subpid_d____fid_d___top_most_d
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044ed90
add esp, 0x18
mov dword [ebp - 0x24], 0x20
push 1
push 0
lea ecx, [ebp - 0x18]
call fcn.00472880
push eax
lea ecx, [ebp - 0x1c]
call fcn.00472880
push eax
push 0x5d8984
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setg al
mov byte [ebp - 0x2d], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0041e800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041e800
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18