joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fe10
Capabilities:
Contain obfuscated stackstrings
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 4
push 0x11
call fcn.006601ab
add esp, 4
mov dword [ebp - 0x34], eax
push 0x280
call fcn.006601ab
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x55fe54
mov eax, 0x6d4580
jmp 0x55ffc2
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x55fe85
mov edx, dword [ebp - 0x30]
push edx
call fcn.006601ab
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x55fe85
mov eax, 0x6d4581
jmp 0x55ffc2
mov byte [ebp - 0x24], 0x25
mov byte [ebp - 0x23], 0x30
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0x58
mov byte [ebp - 0x20], 0x3a
mov byte [ebp - 0x1f], 0x25
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x58
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x58
mov byte [ebp - 0x16], 0x3a
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0x11], 0x3a
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x30
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0x3a
mov byte [ebp - 0xb], 0x25
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x58
mov byte [ebp - 7], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x55ffb6
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 2
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 1
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + eax + 0x194]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.0065c981
add esp, 0x20
mov eax, dword [ebp - 0x34]
jmp 0x55ffc2
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0065cb97
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x564b10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6af2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x564c78
lea ecx, [ebp - 0x28]
call fcn.00461390
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.005ab310
add esp, 4
push 0x224
push 0
lea ecx, [ebp - 0x24c]
push ecx
call fcn.006593c0
add esp, 0xc
mov dword [ebp - 0x24c], 0x224
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x564c5c
lea ecx, [ebp - 0x28]
call fcn.00461a70
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00564ab0
add esp, 8
test eax, eax
je 0x564c1e
lea edx, [ebp - 0x12c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004a4420
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x238]
mov dword [eax], ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x24d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00462020
mov al, byte [ebp - 0x24d]
jmp 0x564c7a
push 0x224
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.006593c0
add esp, 0xc
mov dword [ebp - 0x24c], 0x224
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Module32Next
mov dword [ebp - 0x258], eax
jmp 0x564bb0
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00462020
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x56eec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6afd1b
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x28]
call fcn.00461390
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.0051ccf0
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
je 0x56efa6
push 0x6d6f94
push str.HackShield.Config.Error.txt
call fcn.0065bf95
add esp, 8
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
push edx
push str._HackShield__Error_while_decrypting_this_text:
call fcn.006609c3
add esp, 8
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00461a70
push eax
call fcn.006609c3
add esp, 8
mov ecx, dword [ebp - 0x48]
push ecx
push 0x6d7024
call fcn.006609c3
add esp, 8
mov edx, dword [ebp - 0x48]
push edx
call fcn.0065bb1c
add esp, 4
push 0xffffffffffffffff
call fcn.00660e6c
push 0x6d657a
mov ecx, dword [ebp + 8]
call fcn.00461700
mov eax, dword [ebp - 0x44]
or eax, 1
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00462020
mov eax, dword [ebp + 8]
jmp 0x56f08c
mov ecx, dword [ebp + 0xc]
call fcn.0051ccf0
shr eax, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], 0
jmp 0x56efc5
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x4c]
jbe 0x56f065
mov dword [ebp - 0x50], 0
push 1
push 3
lea ecx, [ebp - 0x10c]
call fcn.00577000
mov byte [ebp - 4], 1
push 2
mov eax, dword [ebp - 0x4c]
shl eax, 1
push eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00498640
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x58]
push eax
push 0x5807a0
lea ecx, [ebp - 0xfc]
call fcn.00578360
push eax
call fcn.00573350
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00462020
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x10c]
call fcn.005781e0
movzx edx, byte [ebp - 0x50]
push edx
lea ecx, [ebp - 0x28]
call fcn.00580f40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.00578630
jmp 0x56efbc
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.004617c0
mov ecx, dword [ebp - 0x44]
or ecx, 1
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00462020
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x58e870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b107b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x762dc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00495890
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004958c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x595e20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [eax + 0x34]
call edx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x595fb2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00594cd0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00594db0
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.00594bf0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00594bf0
push 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [eax + 0x18]
call edx
test eax, eax
jne 0x595f71
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00594cd0
push 0
push 0x1000000
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x20]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x14]
call eax
test eax, eax
jge 0x595f2c
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.00596670
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x595f6c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
and ecx, 0x8000
jne 0x595f6a
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
jne 0x595f6a
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x595f6c
jmp 0x595f71
jmp 0x595ebb
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 1
je 0x595f7f
jmp 0x595f94
mov edx, dword [ebp + 0x1c]
push edx
push 0x514
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00595fd0
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret 0x18
Function at 0x596be0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x104]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movsx edx, byte [ebp + eax - 0x105]
cmp edx, 0x5c
je 0x596c34
push 0x6db734
lea eax, [ebp - 0x104]
push eax
call fcn.00660250
add esp, 8
push str.metin2client.dat
lea ecx, [ebp - 0x104]
push ecx
call fcn.00660250
add esp, 8
call fcn.0055e5b0
push eax
lea edx, [ebp - 0x204]
push edx
call fcn.00660240
add esp, 8
push 0x6db74c
call fcn.0065aee0
add esp, 4
push eax
push 0x6db754
lea eax, [ebp - 0x204]
push eax
call fcn.00660338
add esp, 0xc
test eax, eax
jne 0x596ca9
call fcn.0055e5b0
mov esi, eax
push str.locale_
call fcn.0065aee0
add esp, 4
add esi, eax
push esi
lea ecx, [ebp - 0x204]
push ecx
call fcn.00660240
add esp, 8
lea edx, [ebp - 0x104]
push edx
push 0x1ff
lea eax, [ebp - 0x404]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x404]
test edx, edx
jne 0x596d00
push 0x1ff
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x79eea4]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x404]
test edx, edx
jne 0x596d38
lea eax, [ebp - 0x104]
push eax
push 0x1ff
lea ecx, [ebp - 0x404]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0x6db764
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x404]
test edx, edx
jne 0x596d5f
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00660240
add esp, 8
lea edx, [ebp + 8]
push edx
mov ecx, 0x79eea8
call fcn.00525620
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x408]
call fcn.004a4420
mov eax, dword [ebp - 0x408]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x599720
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x7a0b10]
test eax, eax
je 0x599764
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x7a0b10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x59974e
push dword [0x7a0b10]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x7a0b14]
mov dword [0x7a0b10], 0
call dword [sym.imp.USER32.dll_SetFocus]
ret
Function at 0x5ab610
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5ab6b9
cmp byte [esi], 0
je 0x5ab6b9
mov ecx, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5ab630
sub ecx, edx
cmp ecx, 3
jb 0x5ab647
cmp byte [esi + 1], 0x3a
jne 0x5ab647
add esi, 3
mov ecx, esi
push ebx
push edi
mov edi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5ab650
sub ecx, edx
lea eax, [ecx + 1]
push eax
mov dword [ebp - 4], eax
call fcn.006551fb
add esp, 4
mov ebx, eax
cmp byte [esi], 0
je 0x5ab6ae
xor eax, eax
mov dword [ebp + 8], eax
mov cl, byte [edi]
cmp cl, 0x2f
je 0x5ab680
cmp cl, 0x5c
jne 0x5ab6a4
push dword [ebp - 4]
push 0
push ebx
call fcn.006593c0
push dword [ebp + 8]
push esi
push ebx
call fcn.0065e200
add esp, 0x18
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
inc edi
inc eax
mov dword [ebp + 8], eax
cmp byte [edi], 0
jne 0x5ab674
push ebx
call fcn.005d0680
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ac5b0
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x24
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x130], ecx
test eax, eax
jne 0x5ac5cf
mov eax, dword [edi + 0x114]
mov dword [edi + 0x134], eax
add eax, ecx
cmp eax, dword [edi + 0x114]
jbe 0x5ac5e8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [edi + 0x130]
xor edx, edx
mov eax, esi
mov ecx, dword [edi + 0x134]
div dword [ebp - 8]
push 0
mov ebx, eax
imul ebx, dword [ebp - 8]
lea eax, [ecx + edx]
mov dword [ebp + 0xc], eax
mov eax, esi
sub eax, ebx
mov dword [ebp + 0x10], eax
lea eax, [esi + ecx]
push eax
push 0
push 2
push 0
push dword [edi + 0x110]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 0x12c], eax
test eax, eax
jne 0x5ac652
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x138], eax
test eax, eax
jne 0x5ac68a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.005aaeb0
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x13c], ecx
mov dword [eax], ecx
mov ecx, edi
push dword [edi + 0x13c]
mov dword [edi + 0x128], 0
push dword [edi + 0x134]
call fcn.005ac590
mov eax, dword [edi + 0x134]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5afa30
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
add edi, edx
test ebx, ebx
jne 0x5afa43
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5afaa0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0xc6ef3720
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, esi
mov ecx, esi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
sub esi, edx
test ebx, ebx
jne 0x5afab6
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5afc00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x10
jb 0x5afc9a
mov ecx, edi
shr ecx, 4
mov dword [ebp + 0xc], ecx
push ebx
lea edx, [esi + 1]
mov ebx, 4
jmp 0x5afc30
movsx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x74aab8]
movsx ecx, byte [edx - 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x74aab8]
movsx ecx, byte [edx - 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x74aab8]
movsx ecx, byte [edx - 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x74aab8]
dec ebx
jne 0x5afc30
add esi, 0x10
sub edi, 0x10
dec dword [ebp + 0xc]
jne 0x5afc20
pop ebx
test edi, edi
je 0x5afcbb
mov edi, edi
movsx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x74aab8]
dec edi
jne 0x5afca0
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x5b0020
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5b004b
xor eax, eax
pop edi
pop ebp
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x5b0070
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 8]
push 0
push edi
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
xor eax, eax
test esi, esi
je 0x5b00e7
xor edx, edx
div ebx
mov ecx, eax
imul ecx, ebx
lea eax, [edx + edi]
push eax
push ecx
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
push edi
push ebx
call fcn.005afc00
add esp, 8
mov edi, eax
test ebx, ebx
je 0x5b00de
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b0480
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.005b0520
push 0x104
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call fcn.0065e200
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov edx, 1
cmp edi, 2
jne 0x5b04b7
mov ecx, 0xc0000000
lea edx, [edi + 1]
jmp 0x5b04bc
mov ecx, closesocket
xor eax, eax
cmp edi, 1
push 0
push 0x80
setne al
add eax, 3
push eax
push 0
push edx
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x5b0504
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
mov dword [esi + 0x114], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
xor eax, eax
pop esi
pop ebp
ret 8