joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58cc30
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.0058cf20
push 0
call fcn.0056832e
push eax
call fcn.0059bf28
add esp, 8
mov dword [ebp - 4], 0
call fcn.0059bf07
mov edi, dword [esi + 0x19c]
mov ecx, eax
sar ecx, 6
movzx eax, al
test cl, cl
movzx ebx, cl
cmove ebx, eax
mov eax, dword [esi + 0x1a4]
and eax, 0xfffd
mov dword [ebp - 0xc], ebx
or eax, 2
mov dword [ebp - 8], eax
call fcn.00592340
mov ecx, eax
movsx eax, bl
xor eax, edi
shr edi, 8
and eax, 0xff
mov eax, dword [ecx + eax*4]
xor eax, edi
mov edi, dword [esi + 0x1a4]
mov dword [esi + 0x19c], eax
movzx eax, al
add eax, dword [esi + 0x1a0]
imul ebx, eax, 0x8088405
inc ebx
mov dword [esi + 0x1a0], ebx
shr ebx, 0x18
call fcn.00592340
mov edx, dword [ebp - 4]
movsx ecx, bl
xor ecx, edi
shr edi, 8
and ecx, 0xff
xor edi, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
xor ecx, 1
imul ecx, dword [ebp - 8]
mov dword [esi + 0x1a4], edi
mov eax, dword [eax + 4]
sar ecx, 8
xor cl, byte [ebp - 0xc]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jl 0x58cc57
mov eax, dword [esi + 0x1a4]
mov ebx, dword [ebp + 8]
and eax, 0xfffd
mov edi, dword [esi + 0x19c]
or eax, 2
sar ebx, 0x10
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
call fcn.00592340
mov ecx, eax
movsx eax, bl
xor eax, edi
shr edi, 8
and eax, 0xff
mov eax, dword [ecx + eax*4]
xor eax, edi
mov edi, dword [esi + 0x1a4]
mov dword [esi + 0x19c], eax
movzx eax, al
add eax, dword [esi + 0x1a0]
imul ebx, eax, 0x8088405
inc ebx
mov dword [esi + 0x1a0], ebx
shr ebx, 0x18
call fcn.00592340
movsx ecx, bl
xor ecx, edi
mov ebx, dword [ebp + 8]
and ecx, 0xff
shr edi, 8
sar ebx, 0x18
mov dword [ebp + 8], ebx
xor edi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
mov dword [esi + 0x1a4], edi
mov eax, dword [eax + 4]
sar ecx, 8
xor cl, byte [ebp - 8]
mov byte [eax + 0xa], cl
mov eax, dword [esi + 0x1a4]
mov edi, dword [esi + 0x19c]
and eax, 0xfffd
or eax, 2
mov dword [ebp - 0xc], eax
call fcn.00592340
mov ecx, eax
movsx eax, bl
xor eax, edi
shr edi, 8
and eax, 0xff
mov eax, dword [ecx + eax*4]
xor eax, edi
mov edi, dword [esi + 0x1a4]
mov dword [esi + 0x19c], eax
movzx eax, al
add eax, dword [esi + 0x1a0]
imul ebx, eax, 0x8088405
inc ebx
mov dword [esi + 0x1a0], ebx
shr ebx, 0x18
call fcn.00592340
movsx ecx, bl
xor ecx, edi
shr edi, 8
and ecx, 0xff
xor edi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
mov dword [esi + 0x1a4], edi
pop edi
mov eax, dword [eax + 4]
pop esi
sar ecx, 8
xor cl, byte [ebp + 8]
mov byte [eax + 0xb], cl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x58ce40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x100]
test byte [eax + 0xc], 1
je 0x58cf0f
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x6c], eax
jbe 0x58cf0f
push ebx
push edi
lea esp, [esp]
mov ecx, dword [esi + 0x7c]
mov edi, dword [esi + 0x19c]
add ecx, eax
mov eax, dword [esi + 0x1a4]
and eax, 0xfffd
mov dword [ebp - 0xc], ecx
or eax, 2
mov bl, byte [ecx]
mov dword [ebp - 8], eax
call fcn.00592340
mov ecx, eax
movsx eax, bl
xor eax, edi
shr edi, 8
and eax, 0xff
mov eax, dword [ecx + eax*4]
xor eax, edi
mov edi, dword [esi + 0x1a4]
mov dword [esi + 0x19c], eax
movzx eax, al
add eax, dword [esi + 0x1a0]
imul ebx, eax, 0x8088405
inc ebx
mov dword [esi + 0x1a0], ebx
shr ebx, 0x18
call fcn.00592340
movsx ecx, bl
xor ecx, edi
shr edi, 8
and ecx, 0xff
xor edi, dword [eax + ecx*4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, 1
imul eax, dword [ebp - 8]
mov dword [esi + 0x1a4], edi
sar eax, 8
xor byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x6c]
jb 0x58ce70
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x58cf20
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [esi + 0x19c], 0x12345678
mov dword [esi + 0x1a0], 0x23456789
mov dword [esi + 0x1a4], 0x34567890
cmp dword [esi + 0x198], ecx
jbe 0x58cfda
push ebx
push edi
jmp 0x58cf60
mov eax, dword [esi + 0x194]
mov edi, dword [esi + 0x19c]
mov bl, byte [ecx + eax]
call fcn.00592340
mov ecx, eax
movsx eax, bl
xor eax, edi
shr edi, 8
and eax, 0xff
mov eax, dword [ecx + eax*4]
xor eax, edi
mov edi, dword [esi + 0x1a4]
mov dword [esi + 0x19c], eax
movzx eax, al
add eax, dword [esi + 0x1a0]
imul ebx, eax, 0x8088405
inc ebx
mov dword [esi + 0x1a0], ebx
shr ebx, 0x18
call fcn.00592340
movsx ecx, bl
xor ecx, edi
shr edi, 8
and ecx, 0xff
xor edi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi + 0x1a4], edi
mov dword [ebp - 4], ecx
cmp ecx, dword [esi + 0x198]
jb 0x58cf60
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x58ecd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp method.CFile.virtual_56

Function at 0x58fdf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp method.CFile.virtual_60
Function at 0x590510
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6678
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x2e
lea ecx, [ebp - 0x20]
call fcn.00592d40
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 1
push 0x2e
push dword [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00594160
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov dword [edi + 4], eax
movzx eax, word [ecx + 4]
mov word [edi + 8], ax
movzx eax, word [ecx + 6]
mov word [edi + 0xa], ax
movzx eax, word [ecx + 8]
mov word [edi + 0xc], ax
movzx eax, word [ecx + 0xa]
mov word [edi + 0xe], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 0x10], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 0x12], ax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x1c], eax
movzx eax, word [ecx + 0x1e]
movzx esi, word [ecx + 0x1c]
mov dword [ebp + 8], eax
movzx eax, word [ecx + 0x20]
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x22]
mov word [edi + 0x20], ax
movzx eax, word [ecx + 0x24]
mov word [edi + 0x22], ax
mov eax, dword [ecx + 0x26]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 0x2a]
lea ecx, [ebp - 0x20]
mov dword [edi + 0x28], eax
call fcn.00592f20
mov eax, dword [edi + 4]
cmp eax, dword [0x63a620]
je 0x5905ed
xor bl, bl
jmp 0x59065a
mov eax, dword [ebx + 0x54]
lea ecx, [edi + 0x38]
push 0
push esi
mov dword [ebp - 0x14], eax
call fcn.00592e90
push 1
push esi
push dword [edi + 0x3c]
mov ecx, ebx
call fcn.00594160
mov eax, dword [ebp + 8]
test ax, ax
je 0x59062e
movzx esi, ax
lea ecx, [edi + 0x2c]
push 0
push esi
call fcn.00592e90
push 1
push esi
push dword [edi + 0x30]
mov ecx, ebx
call fcn.00594160
mov eax, dword [ebp - 0x10]
test ax, ax
je 0x590651
movzx esi, ax
lea ecx, [edi + 0x44]
push 0
push esi
call fcn.00592e90
push 1
push esi
push dword [edi + 0x48]
mov ecx, ebx
call fcn.00594160
mov eax, dword [ebp - 0x14]
cmp dword [ebx + 0x54], eax
sete bl
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.00592d90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5908e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6678
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [eax + 0x34]
lea ecx, [ebp - 0x20]
mov esi, dword [eax + 0x40]
movzx eax, si
mov dword [ebp - 0x14], eax
add eax, 0x1e
movzx ebx, di
add eax, ebx
push 0
push eax
call fcn.00592d40
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x63a624]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
movzx ecx, word [edx + 0xa]
mov word [eax + 4], cx
mov eax, dword [ebp - 0x1c]
movzx ecx, word [edx + 0xc]
mov word [eax + 6], cx
mov eax, dword [ebp - 0x1c]
movzx ecx, word [edx + 0xe]
mov word [eax + 8], cx
mov eax, dword [ebp - 0x1c]
movzx ecx, word [edx + 0x10]
mov word [eax + 0xa], cx
mov eax, dword [ebp - 0x1c]
movzx ecx, word [edx + 0x12]
mov word [eax + 0xc], cx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edx + 0x14]
mov dword [eax + 0xe], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x12], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x16], ecx
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1a], si
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
push esi
mov word [eax + 0x1c], di
mov eax, dword [ebp - 0x1c]
push dword [edx + 0x3c]
add eax, 0x1e
push eax
call fcn.0056e6d0
mov eax, dword [ebp - 0x10]
push ebx
push dword [eax + 0x30]
mov eax, dword [ebp - 0x1c]
add eax, 0x1e
add eax, esi
push eax
call fcn.0056e6d0
add esp, 0x18
lea edi, [esi + 0x1e]
mov esi, dword [ebp + 8]
add edi, ebx
mov ecx, esi
push 1
push edi
push dword [ebp - 0x1c]
call fcn.00594550
mov ebx, dword [ebp - 0x10]
lea ecx, [ebx + 0x2c]
call fcn.00592f20
mov eax, dword [esi + 0x54]
mov word [ebx + 0x20], ax
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ecx, dword [esi + 0x34]
sub ecx, edi
add eax, ecx
lea ecx, [ebp - 0x20]
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00592d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x591b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea ecx, [ecx]
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x34]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, dword [edi + 0x64]
mov dword [ebp + 8], edx
cmp dword [edi + 0x64], eax
jb 0x591bfc
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.0056e6d0
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x591bcf
sub eax, esi
jmp 0x591bd1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x591bc0
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x591bef
sub eax, esi
jmp 0x591bf1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x591be0
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x591cb1
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x591c29
xor eax, eax
jmp 0x591c75
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x591c46
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00597c00
jmp 0x591c56
cmp eax, 2
jne 0x591c5f
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00592050
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.0056e6d0
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x6c], eax
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x591c9d
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x591cb1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x591b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x592050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x59205c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00592070
Function at 0x5931a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c67f1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.CZipStorage.0
call fcn.00592f50
mov dword [ebp - 4], 0
call fcn.00440143
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5931fb
push 0x80004005
call fcn.0041e590
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 1
call fcn.00592d70
push 3
push 0x601774
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0x10000
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x20], 0
call fcn.0041e3e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x593260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6826
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CZipStorage.0
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 1
call fcn.00592d90
mov edx, dword [esi + 0x30]
or ecx, 0xffffffff
sub edx, 0x10
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5932bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00592fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x597210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test edi, edi
jne 0x59722c
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f39a
add esp, 4
mov byte [ebp - 1], 1
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x59726d
push esi
mov byte [ebp - 1], al
call fcn.0043f3a3
mov al, byte [ebp - 1]
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x597275
xor ecx, ecx
jmp 0x59728f
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x597280
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.0041e3e0
push esi
call fcn.0043f3a3
mov al, byte [ebp - 1]
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5972d0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call fcn.0058b170
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005973e0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x597363
lea eax, [ebp - 0x10]
push eax
call fcn.0058c650
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
add esp, 4
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x597363
xor edi, edi
jmp 0x597375
mov edi, dword [ebp - 0x18]
imul edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0
imul edi, dword [ebp - 0x20]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x597393
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.00596c40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5973c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x5973d7
xor al, al
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, 1
pop ebp
ret

Function at 0x597480
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x5974a7
xor al, al
pop esi
pop ebp
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x5974c5
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebp
ret
Function at 0x5977c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7018
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.0058b170
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.005973e0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, dword [ebp - 0x10]
cmp eax, 2
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x597830
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00596c40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5978c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
pop ebp
ret

Function at 0x597c00
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x597c1c
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x597d1d
jmp 0x597c30
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x597ce2
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x597c56
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x597cf1
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x597ce6
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x597c30
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x59b4f5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
mov ebx, 0x40915c
mov ecx, 0x4e061c67
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x664d47d6
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219