joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push 0x6d1ac8
push str.Read
push esi
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004e8e00
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x4e5dc2
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x4e5dc2
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00501820
test al, al
jne 0x4e5df9
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5de2
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x4e5df4
lea ecx, [esp + 0x28]
call fcn.005018b0
lea ecx, [esp + 0x30]
call fcn.004e8e70
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4e5db9
int3
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.0062e360
jmp 0x4e5d74

Function at 0x4e5e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push 0x6d1ac8
push 0x6d1b17
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.004e8e00
test ebx, ebx
js 0x4e5ee1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00501820
test al, al
jne 0x4e5efd
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5eeb
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x4e5ee6
lea ecx, [esp + 0x10]
call fcn.005018b0
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x4e5ec1
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
ret
neg ebx
jmp 0x4e5eb8
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push 0x6d1b28
call fcn.0062e360
jmp 0x4e5e95
Function at 0x4e5f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x7f
push 0x6d1ac8
push 0x6c9ad5
push ebx
call fcn.004f2b50
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.004e8e00
mov edi, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x4e5ff0
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x4e5ff0
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00501820
test al, al
jne 0x4e6017
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push esi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e6010
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.005018b0
lea ecx, [esp + 0x30]
call fcn.004e8e70
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005412b6
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edi, 0xffffffff
jmp 0x4e5fe7
lea ecx, [esp + 0x28]
push 0
push esi
push dword [esp + 0x10]
push 0x6d1b3f
call fcn.0062e360
jmp 0x4e5fa4
Function at 0x4f2b90
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00507500

Function at 0x4f2ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x4f2baf
pop ebp
jmp fcn.00507420
call fcn.005bf980
xor eax, eax
pop ebp
ret

Function at 0x4f5760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004e5c10
mov dword [esi], 0
test eax, eax
je 0x4f57a7
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4f57d6
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4f579d
mov dword [esi], ebx
call fcn.004f2b80
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.004f2e60
lea ecx, [esi + 0x10]
call fcn.00501850
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x4f578e
Function at 0x4f7590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4f75c6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x4f75b0
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x4f75c1

Function at 0x4f7760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x4f77c5
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x4f778a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x4f77d9
ja 0x4f77f3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x4f77db
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x4f77d1
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x4f77f7
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x4f77d1
Function at 0x4f81f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [edx + 4]
test eax, eax
je 0x4f8311
mov ebx, ecx
mov ecx, dword [edx]
xor esi, esi
xor edi, edi
or edi, dword [ecx + esi*4]
inc esi
cmp eax, esi
jne 0x4f820c
test edi, edi
je 0x4f8311
test eax, eax
jle 0x4f834d
mov ecx, dword [edx]
test byte [ecx], 1
je 0x4f834d
cmp dword [edx + 0xc], 0
jne 0x4f8380
cmp eax, 0x801
jae 0x4f835b
lea esi, [ebx + 0x14]
push edx
push esi
call fcn.00499dd0
add esp, 8
test eax, eax
je 0x4f838e
mov eax, dword [ebx + 0x18]
test eax, eax
mov dword [ebp - 0x14], ebx
jle 0x4f832d
mov ecx, dword [esi]
cmp dword [ecx + eax*4 - 4], 0
jne 0x4f827f
lea edx, [eax - 1]
cmp eax, 1
mov eax, edx
jg 0x4f8269
jmp 0x4f8331
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ecx]
cmp eax, 2
jb 0x4f8346
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
xor eax, eax
xor esi, esi
inc esi
mov edi, 0x40
mov dword [ebp - 0x18], 0
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
and esi, 1
neg esi
mov edi, 0
sbb edi, edi
mov edx, ecx
and edx, edi
and esi, dword [ebp - 0x1c]
mov ecx, edx
xor ecx, eax
and edx, eax
mov eax, esi
xor eax, dword [ebp - 0x10]
and esi, dword [ebp - 0x10]
shrd eax, ecx, 1
shr ecx, 1
add esi, eax
adc edx, ecx
mov ecx, dword [ebp - 0x20]
and edi, 0x80000000
shrd dword [ebp - 0x18], ebx, 1
shr ebx, 1
or ebx, edi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
mov eax, edx
dec edi
jne 0x4f82af
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
xor eax, eax
inc eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xaa
push 0x6d2f4e
push 0x69
push 0
push 3
call fcn.006325a0
add esp, 0x14
xor eax, eax
jmp 0x4f8309
jne 0x4f8342
jmp 0x4f8338
mov dword [ebx + 0x18], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x20], 0
mov eax, dword [esi]
mov edx, dword [eax]
xor ecx, ecx
jmp 0x4f8293
push 0xae
push 0x6d2f4e
push 0x68
jmp 0x4f831d
xor esi, esi
mov edi, 0x800
or esi, dword [ecx + edi*4]
inc edi
cmp eax, edi
jne 0x4f8362
test esi, esi
je 0x4f8244
push 0xb6
push 0x6d2f4e
push 0x66
jmp 0x4f831d
push 0xb2
push 0x6d2f4e
push 0x6d
jmp 0x4f831d
push 0xbc
push 0x6d2f4e
push 0x44
jmp 0x4f831d
Function at 0x4fbc10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4fbc28
cmp dword [ebp + 0x10], 0
jne 0x4fbc24
call fcn.004b25d0
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004fb6d0
Function at 0x50f360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x4b19e0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x4b1830
push 0x757940
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x50f3da
xor esi, esi
cmp dword [0x757944], 0
jne 0x50f3c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x757948]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x50f3c6
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055487f
int3
Function at 0x50f950
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [ebp + 8]
movsx esi, byte [ebx + 0xb]
test esi, esi
mov dword [ebp - 0x10], ecx
jns 0x50f96c
mov esi, dword [ebx + 4]
mov ebx, dword [ebx]
mov eax, esi
mov ecx, ebx
mov edx, esi
mov dword [ebp - 0x1c], esi
cmp esi, 4
jb 0x50f9b6
mov eax, dword [ebp - 0x1c]
mov edx, eax
mov ecx, ebx
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x50f990
cmp edx, 2
mov dword [ebp - 0x18], ebx
je 0x50fa93
cmp edx, 3
mov edi, dword [ebp - 0x10]
je 0x50faaf
cmp edx, 1
je 0x50fa9f
mov ebx, dword [edi + 0x10]
xor ecx, ecx
test ebx, ebx
je 0x50fa87
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
jbe 0x50fb1d
mov edx, esi
cmp esi, ebx
jb 0x50fa46
mov eax, esi
xor edx, edx
div ebx
mov eax, dword [edi + 0xc]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x50fa87
mov edi, dword [eax]
test edi, edi
je 0x50fa87
lea eax, [ebx - 1]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], edx
mov eax, dword [edi + 4]
cmp esi, eax
je 0x50faba
cmp dword [ebp - 0x28], 1
jbe 0x50fb15
cmp eax, ebx
jb 0x50fa7a
xor edx, edx
div ebx
mov eax, edx
cmp eax, dword [ebp - 0x10]
jne 0x50fa85
mov edi, dword [edi]
test edi, edi
jne 0x50fa5f
xor ecx, ecx
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edi, dword [ebp - 0x10]
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x50f9d7
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
jmp 0x50fa96
movzx eax, byte [edi + 0x13]
test al, al
mov ecx, dword [edi + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, dword [ebp - 0x1c]
jne 0x50fa7f
test al, al
jns 0x50fae9
push ecx
push dword [ebp - 0x18]
push dword [edi + 8]
call fcn.0054265d
add esp, 0xc
test eax, eax
jne 0x50fa7f
mov ecx, dword [edi + 0x14]
jmp 0x50fa87
test eax, eax
je 0x50fae4
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ecx
mov dl, byte [edi + ecx + 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp dl, byte [ecx + eax]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
jne 0x50fa7f
inc ecx
cmp eax, ecx
jne 0x50faf2
jmp 0x50fae4
and eax, dword [ebp - 0x24]
jmp 0x50fa7a
lea edx, [ebx - 1]
and edx, esi
jmp 0x50fa46
Function at 0x510420
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov ecx, dword [ebp + 0xc]
movsx edi, byte [ecx + 0xb]
test edi, edi
jns 0x51043b
mov edi, dword [ecx + 4]
mov ecx, dword [ecx]
mov eax, edi
mov dword [ebp - 0x10], ecx
mov edx, edi
mov dword [ebp - 0x18], edi
cmp edi, 4
jb 0x510478
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x10]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x510452
cmp edx, 2
je 0x510565
cmp edx, 3
je 0x51055c
cmp edx, 1
je 0x51056e
mov ebx, dword [esi + 4]
xor ecx, ecx
test ebx, ebx
je 0x51054d
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
jbe 0x5105cb
mov edx, edi
cmp edi, ebx
jb 0x510502
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [esi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x51054d
mov esi, dword [eax]
test esi, esi
je 0x51054d
lea eax, [ebx - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x51057e
movzx eax, byte [esi + 0x13]
test al, al
mov ecx, dword [esi + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, dword [ebp - 0x18]
jne 0x510595
test al, al
jns 0x5105a3
push ecx
push dword [ebp - 0x10]
push dword [esi + 8]
call fcn.0054265d
add esp, 0xc
test eax, eax
jne 0x510595
mov ecx, esi
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x510493
cmp dword [ebp - 0x28], 1
jbe 0x5105d5
cmp eax, ebx
jb 0x51058e
xor edx, edx
div ebx
mov eax, edx
mov edx, dword [ebp - 0x24]
cmp eax, edx
jne 0x51059f
mov esi, dword [esi]
test esi, esi
jne 0x51051a
xor ecx, ecx
jmp 0x51054d
test eax, eax
je 0x51054b
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ecx
mov dl, byte [esi + ecx + 8]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
cmp dl, byte [ecx + ebx]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
jne 0x510595
inc ecx
cmp eax, ecx
jne 0x5105ac
jmp 0x51054b
lea edx, [ebx - 1]
and edx, edi
jmp 0x510502
and eax, dword [ebp - 0x20]
jmp 0x51058e
Function at 0x517a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.005416e0
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7468f4]
cmp eax, 0xffffffff
jne 0x517a6b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.004c1e70
add esp, 8
jmp 0x517a44
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x517a44
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00543ce0
add esp, 0xc
mov ecx, dword [0x7468f4]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.004c1e70
add esp, 8
test ebx, ebx
je 0x517aba
push ebx
call fcn.005403bc
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x75a320]
mov ecx, dword [0x746d68]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x517bfe
mov ebx, dword [0x75a31c]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x517c5a
push 0x1000
push 0x75931c
lea eax, [ebp - 0x1810]
push eax
call fcn.00543ce0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.00544260
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x517b36
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.00517c70
add esp, 8
mov ebx, 4
xor eax, eax
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x517ba5
add ebx, 8
cmp ebx, 0x804
jne 0x517b6d
dec esi
je 0x517c43
test al, 1
lea edi, [ebp - 0x2010]
jne 0x517ac5
jmp 0x517a59
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x517c4d
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x517c4d
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x517b80
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x73c768]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x517b80
push 0x75a320
call fcn.005403cd
add esp, 4
cmp dword [0x75a320], 0xffffffff
jne 0x517ae6
push 4
call fcn.00540349
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.004e5590
mov dword [0x75a31c], ebx
push 0x75a320
call fcn.00540447
add esp, 4
jmp 0x517ae6
call fcn.005bf980
jmp 0x517a59
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x517b80
mov ecx, ebx
call fcn.004e55a0
jmp 0x517afb
Function at 0x51a360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
js 0x51a39d
mov eax, dword [ebp + 8]
je 0x51a398
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word [eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x6df5f4]
inc esi
cmp ecx, esi
jne 0x51a380
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x521650
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x118]
inc esi
cmp esi, 3
mov eax, 2
cmovae eax, esi
lea ecx, [edi + 0x120]
mov dword [edi + 0x120], 0x3020100
dec eax
mov ebx, 0x7060504
xor esi, esi
mov dword [edi + esi*4 + 0x124], ebx
add ebx, 0x4040404
inc esi
cmp eax, esi
jne 0x521689
test edx, edx
je 0x5216f1
lea eax, [edi + 0x11f]
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x14], edx
xor esi, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + ebx]
mov edx, dword [ebp - 0x10]
mov al, byte [edx + edi]
mov byte [ecx + ebx], al
mov ecx, dword [ebp - 0x18]
mov byte [ecx], al
lea eax, [edi + 1]
push eax
push ecx
push edx
call fcn.00543ce0
add esp, 0xc
or esi, edi
inc ebx
cmp dword [ebp - 0x14], ebx
jne 0x5216b2
shr esi, 2
mov edi, dword [ebp + 8]
mov dword [edi + 0x118], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x5216e3
Function at 0x540b89
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x540bc8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x540bc8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x540bc8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x540bc8
cmp dword [ecx + 0x74], 0xe
jbe 0x540bc8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x54f002
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0054f199
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x54f171
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x54f171
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x54f126
jg 0x54f05e
test eax, eax
je 0x54f11c
push 1
push 0x1000
call fcn.004f7390
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x54f081
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x54f113
push 0x8000
push ebx
call fcn.00554942
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x54f0aa
jg 0x54f0a5
cmp ecx, 0x1000
jb 0x54f0aa
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00557c22
add esp, 0x10
cmp eax, 0xffffffff
je 0x54f0ef
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x54f0a5
jl 0x54f0d6
test ecx, ecx
jne 0x54f097
push dword [ebp - 0xc]
push ebx
call fcn.00554942
push esi
call fcn.004f72a0
add esp, 0xc
xor ebx, ebx
jmp 0x54f17f
cmp byte [edi + 0x24], 0
je 0x54f106
cmp dword [edi + 0x20], 5
jne 0x54f106
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x54f111
mov ebx, dword [edi + 0x18]
jmp 0x54f113
xor ebx, ebx
push esi
call fcn.004f72a0
pop ecx
jmp 0x54f17f
test ecx, ecx
jg 0x54f0e8
jl 0x54f126
test eax, eax
jae 0x54f0e8
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0056751d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x54f146
cmp byte [edi + 0x1c], 0
je 0x54f0e8
jmp 0x54f177
push ebx
call fcn.00552b3a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x54f0e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x54f17f
cmp byte [edi + 0x1c], 0
je 0x54f17c
mov ebx, dword [edi + 0x18]
jmp 0x54f17f
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0056751d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret