joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515020
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x1000
call fcn.00593e38
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x515043
mov eax, 1
mov esp, ebp
pop ebp
ret
push edi
push 0x1000
call fcn.00593e38
mov edi, eax
add esp, 4
test edi, edi
jne 0x51505f
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], 0x4c82e0
push 0x5d7d18
push eax
mov dword [ebp - 0x18], fcn.004f3030
mov dword [ebp - 0x14], 0
call fcn.00535880
add esp, 0xc
test eax, eax
je 0x515092
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push dword [eax]
call fcn.00595867
add esp, 4
test eax, eax
jne 0x515168
push ebx
mov ebx, dword [ebp + 0xc]
mov edi, edi
test si, si
jne 0x515167
mov eax, dword [ebp + 8]
push dword [eax]
push 0x1000
push 1
push dword [ebp - 4]
call fcn.00595b79
mov ecx, dword [ebp - 4]
add esp, 0x10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x515152
lea ecx, [ecx]
test si, si
jne 0x515152
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x3c]
push 1
push eax
call fcn.00534050
add esp, 8
cmp eax, 1
je 0x515131
cmp eax, 0xfffffffd
jne 0x51511c
lea eax, [ebp - 0x3c]
push eax
call fcn.00535a10
add esp, 4
jmp 0x515121
cmp eax, 0xfffffffb
je 0x515131
test eax, eax
jne 0x51512c
cmp dword [ebp - 0x2c], eax
ja 0x5150f6
jmp 0x515131
mov esi, 4
push dword [ebx]
push 1
push dword [ebp - 0x28]
push edi
call fcn.0059628c
add esp, 0x10
cmp dword [ebp - 0x2c], 0
jne 0x51514c
test si, si
je 0x5150e5
cmp dword [ebp - 0x38], 0
ja 0x5150e0
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00595867
add esp, 4
test eax, eax
je 0x5150b0
pop ebx
push dword [ebp - 4]
call fcn.00592c4b
push edi
call fcn.00592c4b
lea eax, [ebp - 0x3c]
push eax
call fcn.00535770
add esp, 0xc
mov ax, si
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x515570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [esi]
mov eax, dword [ebp + 0x1c]
push 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push 6
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x515611
lea eax, [ebp - 0x14]
cmp dword [eax], 0x494d4953
jne 0x515611
cmp word [eax + 4], 0x4153
jne 0x515611
push 0xa
push esi
call fcn.0045d3f0
push esi
call fcn.0045d030
push esi
call fcn.0045d030
mov ecx, dword [ebp - 0x1c]
push esi
mov dword [ecx], eax
call fcn.0045d030
push esi
mov dword [edi], eax
call fcn.0045d030
push esi
mov dword [ebx], eax
call fcn.0045d030
push esi
call fcn.0045d030
mov ecx, dword [ebp - 0x18]
add esp, 0x20
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x51bc50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf04
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0xf04]
push 1
push 0xf00
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
je 0x51bc98
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push 7
lea eax, [ebp - 0xf04]
push str.PCD_OPA
push eax
call fcn.00596360
add esp, 0xc
test eax, eax
je 0x51bccc
push 3
lea eax, [ebp - 0x704]
push 0x5f0ce8
push eax
call fcn.00596360
add esp, 0xc
test eax, eax
jne 0x51bc87
mov al, byte [ebp - 0x102]
mov ecx, dword [ebp - 4]
and al, 3
mov byte [esi], al
xor ecx, ebp
mov eax, 1
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret

Function at 0x51cbe0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 1
mov cl, dl
shl ax, cl
mov ecx, dword [ebp + 0xc]
dec ax
push esi
movzx esi, ax
mov ax, word [ebp + 0x14]
push edi
cmp dx, 8
jg 0x51cc80
xor edx, edx
cmp dx, ax
jge 0x51cccb
movsx edi, si
mov esi, dword [ebp + 8]
push ebx
add esi, 0x200
movzx ebx, ax
nop
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
imul eax, eax, 0xff
lea esi, [esi + 1]
cdq
idiv edi
mov byte [esi + 0xff], al
movzx eax, byte [ecx - 3]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 1], al
movzx eax, byte [ecx - 2]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 0x101], al
movzx eax, byte [ecx - 1]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 0x201], al
dec ebx
jne 0x51cc20
mov ebx, dword [ebp + 8]
mov byte [ebx + 0x400], 1
pop ebx
pop edi
pop esi
pop ebp
ret
xor edx, edx
cmp dx, ax
jge 0x51cccb
mov edi, dword [ebp + 8]
movzx esi, ax
lea edx, [edi + 0x200]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov byte [edx + 0x100], al
lea edx, [edx + 1]
movzx eax, byte [ecx - 3]
mov byte [edx - 1], al
movzx eax, byte [ecx - 2]
mov byte [edx - 0x101], al
movzx eax, byte [ecx - 1]
mov byte [edx - 0x201], al
dec esi
jne 0x51cc93
mov byte [edi + 0x400], 1
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax + 0x400], 1
pop ebp
ret
Function at 0x51ced0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 1
mov cl, dl
shl ax, cl
mov ecx, dword [ebp + 0xc]
dec ax
movzx eax, ax
push esi
cmp dx, 8
jg 0x51cf53
mov dx, word [ebp + 0x14]
xor esi, esi
cmp si, dx
jge 0x51cf93
mov esi, dword [ebp + 8]
push ebx
push edi
movsx edi, ax
add esi, 0x100
movzx ebx, dx
nop
movzx eax, byte [ecx]
lea ecx, [ecx + 3]
imul eax, eax, 0xff
lea esi, [esi + 1]
cdq
idiv edi
mov byte [esi + 0xff], al
movzx eax, byte [ecx - 2]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 1], al
movzx eax, byte [ecx - 1]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 0x101], al
dec ebx
jne 0x51cf10
pop edi
pop ebx
pop esi
pop ebp
ret
mov si, word [ebp + 0x14]
xor eax, eax
cmp ax, si
jge 0x51cf93
mov edx, dword [ebp + 8]
add edx, 0x100
movzx esi, si
lea ebx, [ebx]
movzx eax, byte [ecx]
lea ecx, [ecx + 3]
mov byte [edx + 0x100], al
lea edx, [edx + 1]
movzx eax, byte [ecx - 2]
mov byte [edx - 1], al
movzx eax, byte [ecx - 1]
mov byte [edx - 0x101], al
dec esi
jne 0x51cf70
pop esi
pop ebp
ret
Function at 0x51cfa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
mov eax, 1
mov cl, dl
shl ax, cl
push ebx
dec ax
movzx ecx, ax
push esi
push edi
cmp dx, 8
jg 0x51d042
mov dx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
movsx eax, dx
lea edi, [eax + esi]
add eax, edi
mov dword [ebp + 0x10], eax
xor eax, eax
cmp ax, dx
jge 0x51d11b
movsx ebx, cx
mov ecx, dword [ebp + 8]
movzx eax, dx
add ecx, 0x200
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edi, [edi + 1]
inc dword [ebp + 0x10]
lea esi, [esi + 1]
lea ecx, [ecx + 1]
movzx eax, byte [eax]
imul eax, eax, 0xff
cdq
idiv ebx
mov byte [ecx - 0x201], al
movzx eax, byte [edi - 1]
imul eax, eax, 0xff
cdq
idiv ebx
mov byte [ecx - 0x101], al
movzx eax, byte [esi - 1]
imul eax, eax, 0xff
cdq
idiv ebx
dec dword [ebp - 4]
mov byte [ecx - 1], al
jne 0x51cff2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bx, word [ebp + 0x14]
xor edi, edi
mov edx, dword [ebp + 0xc]
movsx ecx, bx
lea eax, [edx + ecx*2]
lea esi, [eax + ecx*2]
xor ecx, ecx
mov dword [ebp + 0x10], esi
cmp cx, bx
jge 0x51d093
mov edi, edi
movsx ecx, di
mov edx, 0xff
cmp word [esi + ecx*2], dx
mov edx, dword [ebp + 0xc]
ja 0x51d093
mov esi, 0xff
cmp word [eax + ecx*2], si
mov esi, dword [ebp + 0x10]
ja 0x51d093
mov esi, 0xff
cmp word [edx + ecx*2], si
mov esi, dword [ebp + 0x10]
ja 0x51d093
inc edi
cmp di, bx
jl 0x51d060
xor ecx, ecx
cmp di, bx
jne 0x51d0e0
cmp cx, bx
jge 0x51d11b
mov edi, dword [ebp + 8]
add edi, 0x200
movzx ebx, bx
nop
movzx ecx, byte [esi]
lea esi, [esi + 2]
mov byte [edi - 0x200], cl
lea eax, [eax + 2]
movzx ecx, byte [eax - 2]
lea edx, [edx + 2]
mov byte [edi - 0x100], cl
lea edi, [edi + 1]
movzx ecx, byte [edx - 2]
mov byte [edi - 1], cl
dec ebx
jne 0x51d0b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cx, bx
jge 0x51d11b
mov edi, dword [ebp + 8]
add edi, 0x200
movzx ebx, bx
movzx ecx, byte [esi + 1]
lea esi, [esi + 2]
mov byte [edi - 0x200], cl
lea eax, [eax + 2]
movzx ecx, byte [eax - 1]
lea edx, [edx + 2]
mov byte [edi - 0x100], cl
lea edi, [edi + 1]
movzx ecx, byte [edx - 1]
mov byte [edi - 1], cl
dec ebx
jne 0x51d0f1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51d130
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 1
mov cl, dl
shl ax, cl
mov ecx, dword [ebp + 0xc]
dec ax
push esi
movzx esi, ax
mov ax, word [ebp + 0x14]
push edi
cmp dx, 8
jg 0x51d1d0
xor edx, edx
cmp dx, ax
jge 0x51d21b
movsx edi, si
mov esi, dword [ebp + 8]
push ebx
add esi, 0x100
movzx ebx, ax
nop
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
imul eax, eax, 0xff
lea esi, [esi + 1]
cdq
idiv edi
mov byte [esi + 0xff], al
movzx eax, byte [ecx - 3]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 1], al
movzx eax, byte [ecx - 2]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 0x101], al
movzx eax, byte [ecx - 1]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi + 0x1ff], al
dec ebx
jne 0x51d170
mov ebx, dword [ebp + 8]
mov byte [ebx + 0x400], 1
pop ebx
pop edi
pop esi
pop ebp
ret
xor edx, edx
cmp dx, ax
jge 0x51d21b
mov edi, dword [ebp + 8]
movzx esi, ax
lea edx, [edi + 0x100]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov byte [edx + 0x100], al
lea edx, [edx + 1]
movzx eax, byte [ecx - 3]
mov byte [edx - 1], al
movzx eax, byte [ecx - 2]
mov byte [edx - 0x101], al
movzx eax, byte [ecx - 1]
mov byte [edx + 0x1ff], al
dec esi
jne 0x51d1e3
mov byte [edi + 0x400], 1
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax + 0x400], 1
pop ebp
ret
Function at 0x51d8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
xor esi, esi
lea eax, [edi + edi]
push eax
call fcn.00593e38
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x51d902
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x51d9dd
mov edx, dword [ebp + 0xc]
lea ecx, [ecx]
mov al, byte [ebx + edx]
mov byte [ebp - 1], al
lea eax, [ebx + 1]
cmp eax, edi
jge 0x51d937
mov ecx, eax
sub ecx, ebx
mov bl, byte [ebp - 1]
cmp ecx, 0x7f
jge 0x51d934
cmp byte [eax + edx], bl
jne 0x51d934
inc eax
inc ecx
cmp eax, edi
jl 0x51d924
mov ebx, dword [ebp - 0xc]
mov ecx, eax
sub ecx, ebx
cmp ecx, 1
jne 0x51d9b6
cmp eax, edi
jge 0x51d98e
mov dword [ebp - 0xc], ecx
cmp ecx, 0x7f
jge 0x51d974
mov cl, byte [eax + edx]
cmp cl, byte [eax + edx - 1]
mov ecx, dword [ebp - 0xc]
jne 0x51d969
cmp eax, 1
jle 0x51d974
mov cl, byte [eax + edx]
cmp cl, byte [eax + edx - 2]
mov ecx, dword [ebp - 0xc]
je 0x51d974
inc eax
inc ecx
mov dword [ebp - 0xc], ecx
cmp eax, edi
jl 0x51d947
jmp 0x51d98e
cmp eax, edi
jge 0x51d98e
jmp 0x51d980
mov cl, byte [eax + edx]
cmp cl, byte [eax + edx - 1]
jne 0x51d98e
dec eax
cmp eax, edi
jl 0x51d980
mov edi, dword [ebp - 8]
mov cl, al
sub cl, bl
dec cl
mov byte [edi + esi], cl
inc esi
mov edi, dword [ebp + 0x10]
cmp ebx, eax
jge 0x51d9cd
mov edi, dword [ebp - 8]
mov cl, byte [ebx + edx]
inc ebx
mov byte [edi + esi], cl
inc esi
cmp ebx, eax
jl 0x51d9a5
mov edi, dword [ebp + 0x10]
jmp 0x51d9cd
mov ecx, dword [ebp - 8]
sub bl, al
inc bl
mov byte [ecx + esi], bl
mov ebx, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [ebx + esi + 1], cl
add esi, 2
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp eax, edi
jl 0x51d910
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x51d9e6
mov dword [eax], esi
mov eax, dword [ebp + 8]
push dword [eax]
push 1
push esi
push ecx
call fcn.0059628c
push dword [ebp - 8]
call fcn.00592c4b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51dbf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 4], 0
lea eax, [ebx + ebx]
push eax
call fcn.00593e38
mov edi, eax
add esp, 4
xor esi, esi
mov dword [ebp + 0x10], edi
test edi, edi
jne 0x51dc24
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.005960c7
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push dword [eax]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
push eax
push 1
push edi
call fcn.00595b79
add esp, 0x14
mov edx, eax
mov dword [ebp - 8], edx
test ebx, ebx
jle 0x51dcc4
cmp esi, edx
jge 0x51dcbd
movzx ecx, byte [esi + edi]
inc esi
cmp cx, 0x7f
jg 0x51dc85
movsx eax, cx
add eax, esi
cmp eax, edx
jge 0x51dcbd
mov eax, dword [ebp + 0x10]
inc ecx
movsx edi, cx
add eax, esi
push edi
push eax
push dword [ebp + 0xc]
sub ebx, edi
call fcn.00592150
add esi, edi
jmp 0x51dcab
cmp esi, edx
jge 0x51dcbd
mov eax, 0x101
sub eax, ecx
movzx eax, ax
movsx edi, ax
mov eax, dword [ebp + 0x10]
sub ebx, edi
push edi
movzx eax, byte [esi + eax]
inc esi
cwde
push eax
push dword [ebp + 0xc]
call fcn.00595760
add dword [ebp + 0xc], edi
add esp, 0xc
mov edi, dword [ebp + 0x10]
test ebx, ebx
jle 0x51dcc4
mov edx, dword [ebp - 8]
jmp 0x51dc54
mov dword [ebp - 4], 4
push edi
call fcn.00592c4b
mov edi, dword [ebp - 4]
add esp, 4
test di, di
jne 0x51dcea
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add ecx, esi
push 0
push ecx
push dword [eax]
call fcn.00595cb4
add esp, 0xc
mov ax, di
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51ddf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
mov eax, 1
push ebx
mov cl, dl
shl ax, cl
push esi
dec ax
movzx esi, ax
push edi
mov edi, dword [ebp + 0xc]
cmp dx, 8
jg 0x51de8f
mov dx, word [ebp + 0x14]
movsx eax, dx
lea ecx, [eax + edi]
lea ebx, [eax + ecx]
xor eax, eax
cmp ax, dx
jge 0x51df69
movsx eax, si
mov esi, dword [ebp + 8]
mov dword [ebp + 0x10], eax
add esi, 0x200
movzx eax, dx
sub edi, ecx
mov dword [ebp - 4], eax
movzx eax, byte [edi + ecx]
lea ecx, [ecx + 1]
imul eax, eax, 0xff
lea ebx, [ebx + 1]
lea esi, [esi + 1]
cdq
idiv dword [ebp + 0x10]
mov byte [esi - 0x201], al
movzx eax, byte [ecx - 1]
imul eax, eax, 0xff
cdq
idiv dword [ebp + 0x10]
mov byte [esi - 0x101], al
movzx eax, byte [ebx - 1]
imul eax, eax, 0xff
cdq
idiv dword [ebp + 0x10]
dec dword [ebp - 4]
mov byte [esi - 1], al
jne 0x51de41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bx, word [ebp + 0x14]
xor esi, esi
movsx ecx, bx
lea eax, [edi + ecx*2]
lea edx, [eax + ecx*2]
xor ecx, ecx
mov dword [ebp + 0x10], edx
cmp cx, bx
jge 0x51dee3
jmp 0x51deb0
movsx ecx, si
mov edx, 0xff
cmp word [edi + ecx*2], dx
mov edx, dword [ebp + 0x10]
ja 0x51dee3
mov edx, 0xff
cmp word [eax + ecx*2], dx
mov edx, dword [ebp + 0x10]
ja 0x51dee3
mov edi, 0xff
cmp word [edx + ecx*2], di
mov edi, dword [ebp + 0xc]
ja 0x51dee3
inc esi
cmp si, bx
jl 0x51deb0
xor ecx, ecx
cmp si, bx
jne 0x51df2e
cmp cx, bx
jge 0x51df69
mov esi, dword [ebp + 8]
add esi, 0x200
movzx ebx, bx
sub edi, eax
lea ecx, [ecx]
movzx ecx, byte [edi + eax]
lea eax, [eax + 2]
mov byte [esi - 0x200], cl
lea edx, [edx + 2]
movzx ecx, byte [eax - 2]
lea esi, [esi + 1]
mov byte [esi - 0x101], cl
movzx ecx, byte [edx - 2]
mov byte [esi - 1], cl
dec ebx
jne 0x51df00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cx, bx
jge 0x51df69
mov esi, dword [ebp + 8]
add esi, 0x200
movzx ebx, bx
sub edi, eax
movzx ecx, byte [edi + eax + 1]
lea eax, [eax + 2]
mov byte [esi - 0x200], cl
lea edx, [edx + 2]
movzx ecx, byte [eax - 1]
lea esi, [esi + 1]
mov byte [esi - 0x101], cl
movzx ecx, byte [edx - 1]
mov byte [esi - 1], cl
dec ebx
jne 0x51df41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51df70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 1
mov cl, dl
shl ax, cl
mov ecx, dword [ebp + 0xc]
dec ax
push esi
movzx esi, ax
mov ax, word [ebp + 0x14]
push edi
cmp dx, 8
jg 0x51e010
xor edx, edx
cmp dx, ax
jge 0x51e05b
movsx edi, si
mov esi, dword [ebp + 8]
push ebx
add esi, 0x200
movzx ebx, ax
nop
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
imul eax, eax, 0xff
lea esi, [esi + 1]
cdq
idiv edi
mov byte [esi - 0x201], al
movzx eax, byte [ecx - 3]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 0x101], al
movzx eax, byte [ecx - 2]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi - 1], al
movzx eax, byte [ecx - 1]
imul eax, eax, 0xff
cdq
idiv edi
mov byte [esi + 0xff], al
dec ebx
jne 0x51dfb0
mov ebx, dword [ebp + 8]
mov byte [ebx + 0x400], 1
pop ebx
pop edi
pop esi
pop ebp
ret
xor edx, edx
cmp dx, ax
jge 0x51e05b
mov edi, dword [ebp + 8]
movzx esi, ax
lea edx, [edi + 0x200]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov byte [edx - 0x200], al
lea edx, [edx + 1]
movzx eax, byte [ecx - 3]
mov byte [edx - 0x101], al
movzx eax, byte [ecx - 2]
mov byte [edx - 1], al
movzx eax, byte [ecx - 1]
mov byte [edx + 0xff], al
dec esi
jne 0x51e023
mov byte [edi + 0x400], 1
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax + 0x400], 1
pop ebp
ret
Function at 0x535e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esi], 0
mov eax, edi
sub eax, dword [esi]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [esi]
push eax
push dword [ebx + 0x14]
call fcn.005a46fd
add esp, 0xc
test eax, eax
jle 0x535e77
add dword [esi], eax
cmp dword [esi], edi
jb 0x535e55
test eax, eax
jns 0x535e99
call fcn.00599de8
push dword [eax]
call fcn.00599eed
push eax
push 0xffffffffffffffff
push ebx
call fcn.00536350
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, eax
jne 0x535ea4
mov dword [ebx + 0x40], 1
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x537400
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x250], eax
cmp dword [esi + 4], 0x3d40
jge 0x53743d
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push 0
push 0x1d6
push dword [esi]
call fcn.00595cb4
push dword [esi]
lea eax, [ebp - 0x44]
push 1
push 0x22
push eax
call fcn.00595b79
add esp, 0x1c
test eax, eax
je 0x537429
mov ecx, str.Kodak_DC120_ZOOM_Digital_Camera
lea eax, [ebp - 0x44]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x537490
test dl, dl
je 0x53748c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x537490
add eax, 2
add ecx, 2
test dl, dl
jne 0x537470
xor eax, eax
jmp 0x537495
sbb eax, eax
or eax, 1
test eax, eax
jne 0x537429
push 0xcb
push esi
call fcn.0045d3f0
push dword [esi]
call fcn.00597fff
add esp, 0xc
cmp eax, 7
jne 0x537429
push edi
push 0x3a7c
push esi
call fcn.0045d3f0
lea eax, [ebp - 0x244]
push 0x200
push eax
call fcn.0045c8f0
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0045cae0
lea eax, [ebp - 0x24c]
push 0x12
push eax
call fcn.0045cb00
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x537511
lea eax, [edi + 4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push ebx
push dword [edi]
push 1
push 0x14
push 0x63b41c
call fcn.0059628c
push dword [esi]
call fcn.00597fff
push dword [esi]
call fcn.00597fff
push dword [esi]
call fcn.00597fff
push dword [esi]
mov ebx, eax
call fcn.00597fff
add esp, 0x20
cmp ebx, 0xffffffff
je 0x537575
cmp eax, 0xffffffff
je 0x537575
push dword [edi]
push eax
call fcn.005958b3
push dword [edi]
push ebx
call fcn.005958b3
push dword [esi]
call fcn.00597fff
push dword [esi]
mov ebx, eax
call fcn.00597fff
add esp, 0x18
cmp ebx, 0xffffffff
jne 0x537548
push edi
call fcn.0045ca10
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0045cae0
lea eax, [ebp - 0x24c]
push 0x11
push eax
call fcn.0045cb00
push 0
push str.Kodak_DC120_Digital_Camera
push dword [ebp - 0x250]
mov esi, eax
push esi
call fcn.0047a8d0
push esi
movzx edi, ax
call fcn.0045ca10
lea eax, [ebp - 0x244]
push eax
call fcn.0045c700
mov ecx, dword [ebp - 4]
add esp, 0x2c
mov ax, di
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret

Function at 0x53fef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x53ff11
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x53ff11
mov eax, dword [eax + 0x44]
test eax, eax
je 0x53ff11
push dword [ebp + 0xc]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x543280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x60]
test ecx, ecx
jle 0x5432ae
mov eax, dword [esi + 0x34]
push dword [eax]
push 1
push ecx
push dword [esi + 0x54]
call fcn.0059628c
mov eax, dword [esi + 0x54]
add esp, 0x10
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], eax
mov eax, 1
pop esi
pop ebp
ret

Function at 0x543e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
push 0
push esi
call fcn.00546de0
add esp, 8
test eax, eax
jne 0x543edf
cmp dword [esi + 0x10], eax
jne 0x543ed1
mov eax, dword [esi + 0x3c]
push dword [eax]
push 1
push 0x1000
push dword [esi + 0x40]
call fcn.0059628c
mov eax, dword [esi + 0x40]
add esp, 0x10
add dword [esi + 0x44], 0x1000
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1000
cmp dword [esi + 4], 0
ja 0x543e92
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x543f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 4], 0
nop
push 4
push esi
call fcn.00546de0
mov edi, eax
add esp, 8
test edi, edi
js 0x543fd6
cmp edi, 1
jg 0x543fd6
mov ecx, dword [esi + 0x10]
cmp ecx, 0x1000
je 0x543fc3
mov eax, dword [esi + 0x3c]
push dword [eax]
mov eax, 0x1000
push 1
sub eax, ecx
push eax
push dword [esi + 0x40]
call fcn.0059628c
mov eax, 0x1000
add esp, 0x10
sub eax, dword [esi + 0x10]
add dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1000
cmp edi, 1
jne 0x543f70
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x44]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret