joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5165e0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x1cc
call fcn.00609610
push ebx
push ebp
push esi
lea eax, [esp + 0x48]
push eax
push 0x101
mov ebp, ecx
call sub.WSOCK32.dll_WSAStartup
lea ebx, [ebp + 0xc]
mov edx, str._tallydata
mov ecx, ebx
call fcn.004ea050
lea ecx, [esp + 0xc]
call fcn.00501ee0
mov eax, dword [ebp + 0xbc]
test eax, eax
je 0x51662c
push str.author.ini
lea ecx, [esp + 0x10]
push ecx
jmp 0x516636
push str.Tally.ini
lea edx, [esp + 0x10]
push edx
call fcn.00501560
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
add esp, 8
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x516677
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x516673
mov edx, dword [ecx]
call dword [edx + 0x64]
test eax, eax
je 0x516673
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x516673
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
je 0x516677
mov eax, esi
jmp 0x5166b2
mov eax, dword [ebp + 0xbc]
test eax, eax
je 0x516691
mov ecx, dword [ebp + 0x10]
push str.author.ini
push ecx
lea edx, [esp + 0x14]
push edx
jmp 0x51669f
mov eax, dword [ebp + 0x10]
push str.Tally.ini
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.005015d0
add esp, 0xc
push 1
lea ecx, [esp + 0x10]
call fcn.0040a700
test eax, eax
jne 0x5166c7
push 1
push ebp
push 0x516580
lea ecx, [esp + 0x18]
call fcn.00501e20
push edi
mov edi, dword [esp + 0x1e0]
cmp edi, 1
jle 0x516710
mov ecx, dword [ebx]
call fcn.004dc710
mov esi, dword [esp + 0x1e4]
mov edx, dword [esi + 4]
mov ecx, ebx
call fcn.004ea050
cmp edi, 2
jle 0x516710
mov edi, 1
mov dword [ebp + 0x54], edi
mov edx, dword [esi + 8]
push edx
call fcn.00609a1b
add esp, 4
mov dword [0x75d08c], eax
mov dword [0x75d090], edi
cmp dword [ebx], 0
jne 0x516721
mov edx, str._tallydata
mov ecx, ebx
call fcn.004ea050
mov eax, dword [ebp + 0x14]
test eax, eax
lea esi, [ebp + 0x14]
jne 0x516744
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.004ea050
cmp dword [esi], 0
jne 0x516744
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.004ea050
mov ecx, dword [ebx]
mov eax, ecx
lea edi, [eax + 1]
jmp 0x516750
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x516750
sub eax, edi
mov dl, byte [ecx + eax - 1]
mov bl, 0x5c
cmp dl, bl
pop edi
jne 0x516769
mov byte [ecx + eax - 1], 0
mov ecx, dword [esi]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x516770
sub eax, esi
cmp byte [ecx + eax - 1], bl
jne 0x516784
mov byte [ecx + eax - 1], 0
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x516792
mov ecx, ebp
call fcn.00515e40
call fcn.0061904a
lea ecx, [esp + 0xc]
call fcn.005016a0
pop esi
pop ebp
pop ebx
add esp, 0x1cc
ret 8
Function at 0x5170d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x14]
movzx ax, byte [ecx + 2]
push ebp
mov ebp, dword [ebx + 0x20]
push esi
mov esi, dword [esp + 0x24]
mov word [esp + 0x14], ax
mov eax, dword [ebx + 0x18]
add ebp, eax
test esi, esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
je 0x517131
mov eax, dword [esi + 4]
test eax, eax
je 0x517131
movzx ebx, byte [ecx + 6]
push edi
mov ecx, esi
call fcn.00517180
mov ecx, esi
sub ebp, eax
call fcn.00517090
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x20]
cmp ebp, dword [esp + 0x10]
jle 0x517173
movzx edx, byte [ecx + 6]
mov eax, dword [ebx + 0x10]
movsx esi, word [esp + 0x18]
push eax
mov dword [esp + 0x24], edx
call fcn.00519110
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
mov edx, esi
shr edx, 3
and edx, 1
push edx
shr esi, 1
and esi, 1
push esi
push eax
push edi
push ebp
push edi
mov ecx, ebx
call fcn.00560d20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x518530
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov ecx, dword [esp + 0x20]
lea eax, [edi + ebp]
add eax, ecx
jns 0x51855c
push str.Could_not_fit_on_screen__nToo_small_to_be_used_
push 4
push 0x1c
call fcn.004edf70
add esp, 0xc
jmp 0x518566
movsx eax, word [esi + 0x1a]
cmp edi, eax
jle 0x518566
mov edi, eax
mov ebx, dword [esp + 0x14]
test ebx, ebx
jge 0x5185a3
mov ax, word [esi + 0xe]
movsx ecx, ax
mov edx, ebx
neg edx
cmp edx, ecx
jg 0x51858d
mov eax, dword [esi + 8]
inc ebx
imul ebx, ebx, 0x1c
pop edi
pop esi
pop ebp
sub eax, ebx
pop ebx
ret 0x10
cmp ax, word [esi + 0xc]
jne 0x51859a
mov ecx, esi
call fcn.00518490
movsx eax, word [esi + 0xe]
mov ecx, dword [esi + 8]
jmp 0x5185d1
mov ax, word [esi + 6]
movsx ecx, ax
cmp ebx, ecx
jg 0x5185be
mov edx, dword [esi]
imul ebx, ebx, 0x1c
pop edi
pop esi
pop ebp
lea eax, [ebx + edx - 0x1c]
pop ebx
ret 0x10
cmp ax, word [esi + 4]
jne 0x5185cb
mov ecx, esi
call fcn.00518400
movsx eax, word [esi + 6]
mov ecx, dword [esi]
imul eax, eax, 0x1c
add eax, ecx
mov cx, word [esi + 6]
test cx, cx
jle 0x5185f5
mov edx, dword [esi]
movsx ecx, cx
imul ecx, ecx, 0x1c
lea ecx, [ecx + edx - 0x1c]
movsx edx, word [ecx + 6]
movsx ecx, word [ecx + 2]
jmp 0x5185fd
movsx edx, word [esi + 0x20]
movsx ecx, word [esi + 0x18]
add edx, ecx
mov cx, word [esi + 0xe]
add edx, ebp
test cx, cx
jle 0x518622
mov ebp, dword [esi + 8]
movsx ecx, cx
imul ecx, ecx, 0x1c
lea ecx, [ecx + ebp - 0x1c]
movsx ebp, word [ecx + 4]
movsx ecx, word [ecx]
sub ecx, ebp
jmp 0x51862c
movsx ecx, word [esi + 0x1a]
movsx ebp, word [esi + 0x18]
add ecx, ebp
sub ecx, dword [esp + 0x20]
cmp edx, ecx
jl 0x51863d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
lea ebp, [edx + edi]
cmp ebp, ecx
jle 0x518648
mov edi, ecx
sub edi, edx
test ebx, ebx
jge 0x518674
mov dx, word [esp + 0x1c]
sub ecx, edi
mov word [eax], cx
add ecx, edi
mov word [eax + 2], cx
mov cx, word [esp + 0x20]
pop edi
mov word [eax + 4], dx
mov word [eax + 6], cx
inc word [esi + 0xe]
pop esi
pop ebp
pop ebx
ret 0x10
mov cx, word [esp + 0x20]
mov word [eax], dx
add edx, edi
mov word [eax + 2], dx
mov dx, word [esp + 0x1c]
pop edi
mov word [eax + 4], dx
mov word [eax + 6], cx
inc word [esi + 6]
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x523290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.00609610
push ebx
xor ebx, ebx
mov eax, 0x61b564
push esi
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x58], eax
mov esi, edx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov ecx, 0x1a
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 4]
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x78], ecx
call fcn.00512c90
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x523466
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x523466
mov cl, byte [eax]
cmp cl, bl
je 0x523466
cmp cl, 4
je 0x523466
mov ecx, dword [0x7324fc]
push eax
call fcn.004ef750
mov ecx, eax
call fcn.005612a0
mov edi, eax
cmp edi, ebx
jne 0x52335c
lea ecx, [esp + 0x18]
call fcn.00420cf0
pop edi
pop esi
pop ebx
add esp, 0x74
ret
test byte [edi + 0x12], 0x10
jne 0x523369
mov ecx, edi
call fcn.00562220
mov edi, dword [edi + 8]
mov cx, word [edi + 0x38]
push ebp
call fcn.00512ac0
mov ebp, eax
cmp ebp, ebx
je 0x523455
mov cx, word [ebp]
call fcn.00567210
mov edi, eax
cmp edi, ebx
je 0x52344a
test byte [edi + 0x12], 0x10
jne 0x5233a0
mov ecx, edi
call fcn.00562220
mov ecx, 0x58
call fcn.004dc5a0
cmp eax, ebx
je 0x5233be
mov ecx, dword [esi + 4]
push ecx
push ebx
mov ecx, eax
call fcn.004fc980
mov esi, eax
jmp 0x5233c0
xor esi, esi
movzx eax, word [ebp]
lea edx, [eax + eax*2]
mov edx, dword [edx*4 + 0x676b68]
lea ecx, [esp + 0x10]
call fcn.004ea050
mov ecx, dword [esp + 0x10]
xor edx, edx
call fcn.00502ee0
push eax
push 0x401
mov ecx, esi
call fcn.004f3fd0
mov ecx, dword [esp + 0x10]
call fcn.004dc710
mov eax, dword [edi + 8]
mov ecx, dword [eax + 8]
cmp ecx, ebx
jne 0x523407
mov ecx, 1
call fcn.004e9e40
mov edx, eax
lea ecx, [esp + 0x10]
call fcn.004ea050
mov ecx, dword [esp + 0x10]
xor edx, edx
call fcn.00502ee0
push eax
push 0x1048
mov ecx, esi
call fcn.004f3fd0
mov ecx, dword [esp + 0x10]
call fcn.004dc710
mov edx, dword [esp + 0x14]
mov ecx, esi
call dword [esp + 0x18]
test eax, eax
je 0x523455
mov esi, dword [esp + 0x14]
mov ebp, dword [ebp + 4]
cmp ebp, ebx
jne 0x523380
lea ecx, [esp + 0x1c]
call fcn.00420cf0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x74
ret
lea ecx, [esp + 0x58]
call fcn.004e6380
lea ecx, [esp + 0x48]
call fcn.004e6380
lea ecx, [esp + 0x38]
call fcn.004e6380
lea ecx, [esp + 0x28]
call fcn.004e6380
lea ecx, [esp + 0x1c]
call fcn.004e6380
pop edi
pop esi
pop ebx
add esp, 0x74
ret
Function at 0x52a670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
lea ebx, [esi + 0xa8]
mov dword [esi + 0x50], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
call fcn.0050d670
mov ecx, ebx
mov dword [ebx], edi
call fcn.0050c6c0
lea ebx, [esi + 0x118]
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov ecx, ebx
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
call fcn.0050d7e0
mov dword [ebx], edi
lea ecx, [esi + 0x180]
mov dword [esi + 0x170], 0x61b564
mov dword [esi + 0x174], edi
mov dword [esi + 0x178], edi
call fcn.0052ac30
lea ecx, [esi + 0x228]
call fcn.0050d670
mov ecx, 0xe00
call fcn.004dc610
mov dword [esi], eax
xor ecx, ecx
mov eax, dword [esi]
add eax, ecx
je 0x52a73f
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
lea eax, [ecx + eax + 0x38]
cmp eax, edi
je 0x52a75d
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
lea edx, [ecx + 0xa8]
lea eax, [edx + eax - 0x38]
cmp eax, edi
je 0x52a781
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
mov eax, dword [esi]
add eax, edx
je 0x52a79b
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax], edi
add ecx, 0xe0
cmp ecx, 0xe00
jl 0x52a725
mov ecx, 0x80
call fcn.004dc660
mov ecx, 0x801
mov dword [esi + 4], eax
call fcn.004dc660
mov dword [esi + 0xa0], edi
mov dword [esi + 0x10], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x532a80
Capabilities:
Parse url

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
xor eax, eax
mov dword [esi], 0x635454
mov ecx, 0xf
mov edi, ebx
rep stosd dword es:[edi], eax
xor edi, edi
push edi
mov ebp, 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x1b]
push ecx
push edx
mov dword [esp + 0x24], ebp
mov dword [ebx], 0x3c
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x3c], ebp
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esi + 0x44], ebp
call fcn.004dc530
mov edx, dword [esp + 0x1c]
push edi
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
mov dword [esi + 0x40], eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov eax, dword [esi + 0x40]
mov ecx, dword [esp + 0x14]
mov byte [ecx + eax], 0
mov ebp, dword [esi + 0x40]
mov eax, ebp
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x532b20
push ebx
push edi
sub eax, ecx
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x532b46
mov dword [esi + 0x44], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
pop edi
mov byte [edx + eax], 0
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x5332e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, 0x68
call fcn.00609610
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
xor ebx, ebx
call fcn.00532b80
mov edi, eax
cmp edi, 1
jne 0x533333
mov ecx, esi
call fcn.00532c90
mov ecx, esi
mov ebp, eax
call fcn.00532bf0
push eax
lea ecx, [esp + 0x34]
call fcn.00532a80
mov ecx, dword [esp + 0x70]
test ecx, ecx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x30], 0x635454
je 0x533333
call fcn.004dc710
mov eax, dword [esp + 0x7c]
xor ecx, ecx
cmp edi, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [eax], 0xffffffff
mov dword [esp + 0x1c], ecx
mov word [esp + 0x10], 2
mov eax, ebx
je 0x533364
mov eax, dword [esp + 0x84]
push eax
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0x20]
mov word [esp + 0x12], ax
call fcn.00512e60
cmp edi, 1
mov ebx, dword [esp + 0x80]
lea ecx, [esp + 0x20]
jne 0x53338b
push ebp
jmp 0x53338c
push ebx
call fcn.004e1be0
lea ecx, [esp + 0x20]
call fcn.00533d50
push eax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x5333d7
lea ecx, [esp + 0x20]
call fcn.00533d50
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x5333d0
lea ecx, [esp + 0x20]
call fcn.004e1cf0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x68
ret 0xc
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
test edi, edi
mov dword [esp + 0x14], eax
jne 0x533419
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
push 0x10
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
push esi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
lea ecx, [esp + 0x20]
je 0x5333bc
mov edx, dword [esp + 0x7c]
mov dword [edx], esi
call fcn.004e1cf0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 0xc
mov ecx, esi
call fcn.00532d40
test eax, eax
je 0x53342f
mov ecx, esi
call fcn.00532e60
mov edi, eax
jmp 0x533431
xor edi, edi
mov ecx, esi
call fcn.00532d40
test eax, eax
je 0x533445
mov ecx, esi
call fcn.00532db0
jmp 0x533447
xor eax, eax
mov edx, dword [esp + 0x7c]
push edi
push eax
mov eax, dword [esp + 0x8c]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00532f10
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.004e1cf0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0xc
Function at 0x5343c0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.006095d3
add esp, 4
mov ebx, eax
call fcn.006095b1
push 1
cdq
push 0
push edx
push eax
call fcn.00609ad0
mov esi, eax
push 0xf0000000
mov edi, edx
push 1
mov eax, ebx
cdq
add esi, eax
push 0
push 0
lea eax, [esp + 0x1c]
adc edi, edx
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x534453
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 8
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x534446
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x5344a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1060
call fcn.00609610
xor eax, eax
mov dword [esp + 1], eax
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov eax, dword [esp + 0x1064]
test eax, eax
push ebx
mov byte [esp + 4], 0
je 0x534689
mov eax, dword [esp + 0x1070]
test eax, eax
je 0x534689
mov ebx, dword [esp + 0x1074]
mov ecx, ebx
and ecx, 0x80000007
jns 0x5344f6
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x534689
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x534500
sub eax, edx
push esi
mov esi, eax
cmp esi, ebx
jle 0x53451d
pop esi
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
push ebp
push edi
lea edi, [ebx + 1]
mov ecx, edi
call fcn.004dc530
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov ebp, eax
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, dword [esp + 0x107c]
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], ebp
mov byte [esp + 0x14], 0x54
mov byte [esp + 0x15], 0x20
mov byte [esp + 0x16], 0x87
mov byte [esp + 0x17], 0x84
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 2
mov byte [esp + 0x1b], 0x99
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 6
mov byte [esp + 0x1e], 9
mov byte [esp + 0x1f], 0x23
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x12
mov byte [esp + 0x22], 0x51
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0
call fcn.00574e30
push ebx
push ebp
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.00574fe0
cmp eax, 0xffffffff
jne 0x5345fa
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.004dc710
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
mov eax, dword [esp + 0x1078]
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea esi, [eax + ebx + 1]
mov dword [esp + 0x18], edx
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.004dc530
mov ebp, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, dword [esp + 0x24]
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1078]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1074]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [ebx + ebp]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
add eax, ebp
mov byte [eax + ebx], 0
call fcn.004dc710
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x1060
ret 0x10
xor eax, eax
pop ebx
add esp, 0x1060
ret 0x10
Function at 0x5346a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x105c
call fcn.00609610
xor eax, eax
mov dword [esp + 1], eax
push ebx
push esi
mov esi, dword [esp + 0x1068]
test esi, esi
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov byte [esp + 8], 0
mov dword [esp + 0x15], eax
je 0x5347dc
mov ebx, dword [esp + 0x1070]
cmp dword [esp + 0x106c], ebx
jl 0x5347dc
mov ecx, ebx
and ecx, 0x80000007
jns 0x5346f5
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x5347dc
push ebp
push edi
lea edi, [ebx + 1]
mov ecx, edi
call fcn.004dc530
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov ebp, eax
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x28]
mov byte [esp + 0x14], 0x54
mov byte [esp + 0x15], 0x20
mov byte [esp + 0x16], 0x87
mov byte [esp + 0x17], 0x84
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 2
mov byte [esp + 0x1b], 0x99
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 6
mov byte [esp + 0x1e], 9
mov byte [esp + 0x1f], 0x23
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x12
mov byte [esp + 0x22], 0x51
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0
call fcn.00574e30
push ebx
push ebp
xor edx, edx
lea ecx, [esp + 0x2c]
call fcn.005754b0
cmp eax, 0xffffffff
jne 0x5347cd
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.004dc710
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x105c
ret 0xc
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x105c
ret 0xc
pop esi
xor eax, eax
pop ebx
add esp, 0x105c
ret 0xc

Function at 0x5367e4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
mov ecx, 0x80
shr ecx, 3
mov eax, 0
mov ebx, 0
xor dword [esi], eax
xor dword [esi + 4], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
call fcn.00575f78
mov dword [esi], eax
mov dword [esi + 4], ebx
add esi, 8
loop 0x5367fd
pop ebx
pop edi
pop esi
ret

Function at 0x537090
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
call fcn.00501290
mov ecx, dword [esi + 0x10]
pop esi
jmp fcn.004ed990
Function at 0x537564
Capabilities:
Inspect section memory permissions

Disassembly:
sub eax, eax
sub ebx, ebx
bt ecx, 0xa
jae 0x537573
or eax, 0x80
bt ecx, 0x17
jae 0x53757c
or eax, 0x40
bt ecx, 0xd
jae 0x537585
or eax, 0x20
bt ecx, 0x10
jae 0x53758e
or eax, 0x10
bt ecx, 7
jae 0x537597
or eax, 8
bt ecx, 3
jae 0x5375a0
or eax, 4
bt ecx, 5
jae 0x5375a9
or eax, 2
bt ecx, 0x1c
jae 0x5375b2
or eax, 1
bt ecx, 9
jae 0x5375bd
or eax, 0x8000
bt ecx, 2
jae 0x5375c8
or eax, 0x4000
bt ecx, 0x13
jae 0x5375d3
or eax, 0x2000
bt ecx, 0xe
jae 0x5375de
or eax, 0x1000
bt ecx, 0x11
jae 0x5375e9
or eax, 0x800
bt ecx, 0x15
jae 0x5375f4
or eax, 0x400
bt ecx, 0xc
jae 0x5375ff
or eax, 0x200
bt ecx, 4
jae 0x53760a
or eax, 0x100
bt ecx, 0x1e
jae 0x537615
or eax, 0x800000
bt ecx, 0
jae 0x537620
or eax, 0x400000
bt ecx, 8
jae 0x53762b
or eax, 0x200000
bt ecx, 1
jae 0x537636
or eax, 0x100000
bt ecx, 0x1d
jae 0x537641
or eax, 0x80000
bt ecx, 0x14
jae 0x53764c
or eax, 0x40000
bt ecx, 0xb
jae 0x537657
or eax, 0x20000
bt ecx, 6
jae 0x537662
or eax, 0x10000
bt edx, 0xf
jae 0x53766d
or eax, 0x80000000
bt edx, 0x14
jae 0x537678
or eax, 0x40000000
bt edx, 0x19
jae 0x537683
or eax, 0x20000000
bt edx, 3
jae 0x53768e
or eax, 0x10000000
bt edx, 9
jae 0x537699
or eax, 0x8000000
bt edx, 0x11
jae 0x5376a4
or eax, 0x4000000
bt edx, 0x1a
jae 0x5376af
or eax, 0x2000000
bt edx, 0
jae 0x5376ba
or eax, 0x1000000
bt edx, 0x15
jae 0x5376c6
or ebx, 0x80
bt edx, 0xb
jae 0x5376cf
or ebx, 0x40
bt edx, 7
jae 0x5376d8
or ebx, 0x20
bt edx, 8
jae 0x5376e1
or ebx, 0x10
bt edx, 0xc
jae 0x5376ea
or ebx, 8
bt edx, 0x17
jae 0x5376f3
or ebx, 4
bt edx, 1
jae 0x5376fc
or ebx, 2
bt edx, 0x10
jae 0x537705
or ebx, 1
bt edx, 6
jae 0x537711
or ebx, 0x8000
bt edx, 0x13
jae 0x53771d
or ebx, 0x4000
bt edx, 0xa
jae 0x537729
or ebx, 0x2000
bt edx, 0xe
jae 0x537735
or ebx, 0x1000
bt edx, 0x16
jae 0x537741
or ebx, 0x800
bt edx, 4
jae 0x53774d
or ebx, 0x400
bt edx, 0x1b
jae 0x537759
or ebx, 0x200
bt edx, 0x18
jae 0x537765
or ebx, 0x100
ret

Function at 0x537770
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
call fcn.005370b0
test eax, eax
je 0x5377c4
mov ecx, dword [esi + 8]
call fcn.005370f0
cmp eax, 0x65
je 0x5377aa
cmp eax, 0x6b
je 0x5377aa
cmp eax, 0x6c
je 0x5377aa
cmp eax, 0xa
je 0x5377aa
cmp eax, 7
je 0x5377aa
cmp eax, 0x19
je 0x5377aa
cmp eax, 0x1a
jne 0x5377bb
push str.Data_files_damaged.__Need_to_rewrite.
push 3
push 0x64
call fcn.004edf70
add esp, 0xc
mov ecx, dword [esi + 8]
pop esi
jmp fcn.00537090
pop esi
ret