joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e22a0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
lea ebx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0xc], 0
call fcn.004e28d0
test eax, eax
jl 0x4e2392
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call ebp
cmp eax, 0xffffffff
jne 0x4e22ec
call fcn.004129d0
mov ebx, eax
jmp 0x4e22f1
mov dword [esi + 0x28], eax
xor ebx, ebx
cmp dword [esp + 0xc], 0
jne 0x4e2390
mov eax, dword [esi]
test eax, eax
je 0x4e230d
add eax, 8
je 0x4e230d
mov dword [eax], 0
mov eax, dword [esi]
test eax, eax
je 0x4e231f
add eax, 8
je 0x4e231f
mov dword [eax + 4], 0
test ebx, ebx
jge 0x4e234c
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x4e2376
call fcn.004129d0
mov ebx, eax
test ebx, ebx
jl 0x4e237d
lea edx, [esp + 0x14]
push edx
push 0
push esi
push 0x4e23a0
push 0
push 0
mov dword [esi + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
mov eax, ebx
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 0x28], eax
xor ebx, ebx
jmp 0x4e234c
mov esi, dword [esi]
test esi, esi
je 0x4e2390
lea eax, [esi + 8]
test eax, eax
je 0x4e2390
mov dword [eax], 1
mov eax, ebx
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4e5d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5a3b58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
mov ebp, dword [esp + 0x40]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x4e5e09
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4e5e19
mov edi, vtable.CxMemFile.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
mov dword [esp + 0x40], ebx
call fcn.004e5f70
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], edi
je 0x4e5e03
cmp byte [esp + 0x24], bl
je 0x4e5e03
push eax
call fcn.0057876f
add esp, 4
mov al, byte [esp + 0x40]
jmp 0x4e5e1b
lea edi, [ebp + 0x44]
mov ecx, 6
mov esi, str.Unable_to_load_resource_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x4fc900
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4fc951
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0x1c
push 1
push esi
call ecx
mov dword [esi + 0x180], eax
mov dword [eax], 0x4ff340
mov dword [eax + 4], 0x4ff4a0
mov byte [eax + 8], 0
add esp, 0xc
mov eax, esi
call fcn.004ff180
cmp byte [esi + 0x40], 0
je 0x4fc94a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4fc9cc
mov edx, dword [esi + 0x190]
cmp byte [edx + 0x10], 0
je 0x4fc9bc
mov eax, dword [esi + 8]
test eax, eax
je 0x4fc976
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov ecx, dword [esi + 0x190]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
test eax, eax
je 0x4fc9b8
cmp eax, 2
je 0x4fc9bc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4fc967
cmp eax, 3
je 0x4fc99e
cmp eax, 1
jne 0x4fc967
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x4fc967
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x4fc967
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.004fca00
pop esi
ret
cmp eax, 0xcc
je 0x4fc9ee
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.004fca00
pop esi
ret
Function at 0x50f480
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x50f487
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.0050f490
Function at 0x50f490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x50f4c2
lea esp, [esp]
test cl, 3
je 0x50f4c2
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5b6678]
add ecx, 1
sub esi, 1
jne 0x50f4a0
cmp esi, 0x20
push ebx
push edi
jb 0x50f6ac
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x5b6a78]
xor edx, dword [ebx*4 + 0x5b6e78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5b6678]
add ecx, 4
xor edx, dword [eax*4 + 0x5b7278]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5b6a78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x5b6e78]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x5b6678]
add ecx, 4
xor eax, dword [edx*4 + 0x5b7278]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x5b6a78]
xor edx, dword [ebx*4 + 0x5b6e78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5b6678]
xor edx, dword [eax*4 + 0x5b7278]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5b6a78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x5b6e78]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x5b6678]
xor eax, dword [edx*4 + 0x5b7278]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x5b6a78]
xor edx, dword [ebx*4 + 0x5b6e78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5b6678]
xor edx, dword [eax*4 + 0x5b7278]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5b6a78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x5b6e78]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x5b6678]
and edx, 0xff
xor eax, dword [edx*4 + 0x5b7278]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x5b6a78]
xor edx, dword [ebx*4 + 0x5b6e78]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5b6678]
add ecx, 4
xor edx, dword [eax*4 + 0x5b7278]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5b6a78]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x5b6e78]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x5b6678]
and edx, 0xff
xor eax, dword [edx*4 + 0x5b7278]
sub edi, 1
jne 0x50f4d2
cmp esi, 4
jb 0x50f6f9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x5b6a78]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x5b6e78]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x5b6678]
and eax, 0xff
xor edi, dword [eax*4 + 0x5b7278]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x50f6b6
test esi, esi
pop edi
pop ebx
je 0x50f71d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5b6678]
add ecx, 1
sub esi, 1
jne 0x50f700
not eax
pop esi
ret
Function at 0x517750
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x517777
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x517783
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0x14], ecx
jle 0x5178ac
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x5177c8
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x5177e9
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x517841
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x517820
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
add ebx, 1
mov edx, eax
cmp esi, edx
jg 0x517820
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
add esi, 1
cmp esi, 0xff
jle 0x517806
cmp dword [esp + 0x10], 0
je 0x517891
mov eax, 1
lea edx, [ebp - 1]
jmp 0x517870
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
add eax, 1
sub edx, 1
cmp eax, 0xff
jle 0x517870
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], ecx
jl 0x5177c0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x522e90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov esi, edx
push eax
mov ebx, ecx
xor edi, edi
push esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x522fd1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
push edx
mov eax, esi
call fcn.00522ff0
add esp, 8
test eax, eax
je 0x522fd1
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, ecx
je 0x522fd1
mov edx, dword [esp + 0xc]
cmp edx, ecx
jbe 0x522fd1
cmp dword [ebp + 8], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
lea edi, [esp + 0x10]
push ecx
je 0x522f40
mov esi, edx
mov ebx, eax
call fcn.00522d30
mov ebx, dword [esp + 0x1c]
jmp 0x522f47
mov esi, eax
call fcn.00522e20
mov esi, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x522fab
test esi, esi
je 0x522fb8
cmp dword [esp + 0xc], 0
jbe 0x522fab
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea edx, [esp + 0x20]
push edx
push ebx
call edi
cmp eax, 0xffffffff
je 0x522f7e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x20]
push eax
push ebx
call edi
cmp eax, 0xffffffff
je 0x522f94
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x522fab
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
push ecx
mov ebx, esi
call fcn.005230b0
add esp, 4
mov dword [esp + 0x14], eax
test esi, esi
je 0x522fb8
push esi
call fcn.00578327
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x274]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret
Function at 0x522ff0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x523017
xor eax, eax
pop esi
pop ecx
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x523035
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
push ebx
push edi
call fcn.00578e5f
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
mov ebx, eax
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x52306b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [esp + 0xc]
jne 0x52308d
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], ebx
pop ebx
mov dword [eax], edi
pop edi
mov eax, 1
pop esi
pop ecx
ret
test ebx, ebx
je 0x52309a
push ebx
call fcn.00578327
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x5230b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
je 0x523190
cmp dword [esp + 0x26c], ebp
jbe 0x523190
cmp edi, ebp
je 0x523190
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x5230f0
sub eax, edx
sar eax, 1
je 0x523190
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x523190
mov ecx, dword [esp + 0x26c]
push ebp
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x52316d
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.005787fd
add esp, 0x260
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.005787fd
add esp, 0x260
ret
mov ecx, dword [esp + 0x264]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.005787fd
add esp, 0x260
ret
Function at 0x523310
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x5a05cc
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebp, ecx
cmp dword [ebp + 0xc], 1
jne 0x52335d
mov eax, 0x80004005
jmp 0x523513
mov eax, dword [ebp + 0x260]
cmp eax, 0xffffffff
jne 0x5234a2
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x280], 0
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push edx
call fcn.00526f20
lea eax, [esp + 0x18]
push eax
mov ecx, 0x5c6a9c
mov byte [esp + 0x284], 1
call fcn.00404460
lea ecx, [esp + 0x20]
push ecx
mov bl, 2
lea esi, [esp + 0x1c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x284], bl
call fcn.00527ac0
add esp, 4
lea edi, [esp + 0x1c]
mov byte [esp + 0x280], 3
call fcn.004035d0
mov byte [esp + 0x280], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x52340b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x280], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x523433
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
cmp eax, 0xffffffff
mov dword [ebp + 0x260], eax
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x14]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x523479
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5234b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x5234b0
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
xor edx, edx
test ebx, ebx
sete dl
cmp ebx, 1
mov dword [ebp + 0xc], edx
jne 0x523503
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x5bf10c
lea eax, [esp + 0x54]
push eax
call esi
test eax, eax
je 0x5234f5
push 0x5c06c0
lea ecx, [esp + 0x54]
push ecx
call esi
test eax, eax
je 0x5234f5
lea edi, [ebp + 0x10]
mov ecx, 0x94
lea esi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
jmp 0x523503
mov ecx, ebp
call fcn.00523310
xor ebx, ebx
test eax, eax
setge bl
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005787fd
add esp, 0x270
ret
Function at 0x523ff0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xa0
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa4]
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xb0]
push ecx
push eax
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00528980
push esi
mov esi, edi
call fcn.00528a40
mov ecx, dword [esp + 0xb0]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.005787fd
add esp, 0xa0
ret

Function at 0x524ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x524cb8
test al, 0x10
jne 0x524cb8
mov eax, 1
ret
xor eax, eax
ret
Function at 0x527535
Capabilities:
Clear file content

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 4]
push ecx
push 0
push edx
mov ecx, esi
mov dword [esp + 0x10], 0
call eax
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
pop ecx
ret 4

Function at 0x527570
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x527588
mov eax, 0x80070057
pop esi
add esp, 8
ret 4
mov ecx, dword [ecx + 8]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5275b9
mov dword [esi], eax
mov eax, 0x80004005
pop esi
add esp, 8
ret 4
cmp dword [esp + 8], 0
ja 0x5275c9
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
jbe 0x5275db
mov dword [esi], 0xffffffff
mov eax, 0x80004005
pop esi
add esp, 8
ret 4
mov dword [esi], eax
xor eax, eax
pop esi
add esp, 8
ret 4

Function at 0x527700
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [ecx + 8]
cmp edx, 0xffffffff
je 0x52774e
mov eax, dword [esp + 4]
test eax, eax
je 0x52774e
mov ecx, dword [eax]
push esi
mov esi, dword [eax + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x52773b
mov eax, 0x80004005
pop esi
ret 4
mov eax, dword [esp + 8]
sub eax, esi
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
ret 4
mov eax, 0x80070057
ret 4

Function at 0x527813
Capabilities:
Clear file content

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov edx, dword [esi]
mov edx, dword [edx + 0x3c]
xor eax, eax
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call edx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
add esp, 8
ret 8
Function at 0x5278e0
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5a0438
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
call fcn.00404460
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
cmp edx, 3
jg 0x527960
or ebp, 0xffffffff
mov dword [esp + 0x24], ebp
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x527947
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea eax, [edx - 1]
cmp eax, ebx
jl 0x527ab5
cmp eax, edx
jg 0x527ab5
movzx edx, word [ecx + eax*2]
or ebp, 0xffffffff
cmp dx, 0x5c
jne 0x5279c2
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.00403560
lea edi, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.004035d0
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5279be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
je 0x5279d5
test al, 0x10
jne 0x527aa5
mov ecx, dword [esp + 0x14]
push 0x5c
push ecx
call fcn.0057b53f
mov ecx, dword [esp + 0x1c]
add esp, 8
cmp eax, ebx
je 0x5279f4
sub eax, ecx
sar eax, 1
cmp eax, ebp
jne 0x527a27
lea eax, [ecx - 0x10]
mov dword [esp + 0x24], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x527a11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.00403560
mov byte [esp + 0x24], 2
mov esi, dword [esp + 0x18]
push esi
call fcn.005278e0
mov ecx, dword [esp + 0x18]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov byte [esp + 0x24], bl
lea eax, [esi - 0x10]
jne 0x527a8d
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x527a75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
jmp 0x527a03
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x527aa5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
jmp 0x527931
push 0x80070057
call fcn.00404550
int3