joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x27]
test al, al
js 0x4f492c
test eax, eax
jne 0x4f4921
cmp dword [esi + 0x28], 0
jne 0x4f4921
mov byte [esi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
je 0x4f4956
lea edi, [esi + 0x10]
mov ebx, 0x80001b
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.004da830
cmp eax, 0xffffffff
jne 0x4f4947
cmp dword [esi + 0x30], 1
je 0x4f4934
mov eax, dword [esi + 8]
mov bl, 1
cmp eax, dword [esi + 0xc]
je 0x4f495c
nop dword [eax]
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.004da830
cmp eax, 0xffffffff
jne 0x4f495c
mov eax, dword [esi + 8]
cmp dword [esi + 0x30], 1
je 0x4f4908
add eax, 1
mov dword [esi + 8], eax
cmp eax, dword [esi + 0xc]
jne 0x4f48e0
jmp 0x4f495c
mov cl, byte [eax]
add cl, 0xf7
cmp cl, 0x17
ja 0x4f48fb
movzx ecx, cl
mov edx, 0x80001b
bt edx, ecx
jae 0x4f48fb
jmp 0x4f495c
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00570c10
mov eax, dword [esi + 0x20]
jmp 0x4f4884
mov eax, dword [esi + 4]
mov al, byte [eax]
add al, 0xf7
cmp al, 0x17
ja 0x4f48cf
movzx eax, al
bt ebx, eax
jae 0x4f48cf
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
jne 0x4f48b1
mov byte [esi + 0x2c], 1
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ffd20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x60b458]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4ffd4b
mov ecx, 0x60b450
pop ebp
jmp fcn.004e65f0
push 0x60b458
call fcn.00503e17
add esp, 4
cmp dword [0x60b458], 0xffffffff
jne 0x4ffd40
xor eax, eax
mov dword [0x60b454], eax
mov dword [0x60b450], eax
mov ecx, 0x60b450
push eax
call fcn.004596c0
push 0x60b458
call fcn.00503e8d
add esp, 4
jmp 0x4ffd40
Function at 0x528cae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528ef7

Function at 0x52d25e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052d269
Function at 0x533c50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
cmp dword [ecx + 0x40], 0
je 0x533d6d
mov esi, ecx
mov edi, dword [ecx + 0x44]
test edi, edi
je 0x533e26
mov eax, dword [esi + 0x5c]
test al, 0x10
jne 0x533c92
test al, 8
jne 0x533d39
xor edi, edi
jmp 0x533d6d
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x533cb6
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x533d6a
lea eax, [esi + 0x48]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov edi, dword [esi + 0x44]
mov ebx, esi
mov esi, dword [esi + 0x34]
add esi, eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
call dword [section..00cfg]
mov ecx, edi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x18]
mov eax, dword [ebx + 0x20]
sub esi, eax
mov edi, ebx
push dword [ebx + 0x40]
push esi
push 1
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, esi
jne 0x533d6a
mov eax, dword [ebp - 0x1c]
cmp eax, 1
mov esi, edi
je 0x533cbc
cmp eax, 2
je 0x533d6a
push dword [esi + 0x40]
call fcn.0051c668
add esp, 4
test eax, eax
mov edi, 0xffffffff
jne 0x533d6d
jmp 0x533c8b
movsd xmm0, qword [esi + 0x50]
movsd qword [ebp - 0x18], xmm0
cmp byte [esi + 0x62], 0
je 0x533d81
mov ebx, dword [esi + 0x10]
sub ebx, dword [esi + 0xc]
mov dword [ebp - 0x1c], 0
neg ebx
push 1
push ebx
push dword [esi + 0x40]
call fcn.0051cc5a
add esp, 0xc
test eax, eax
je 0x533dab
xor edi, edi
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [edi]
mov ebx, dword [eax + 0x14]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x28]
sub ebx, edi
test eax, eax
jle 0x533dd7
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
imul ecx, eax
add ebx, ecx
jmp 0x533d4f
cmp byte [ebp - 0x1c], 0
je 0x533dbb
movsd xmm0, qword [ebp - 0x18]
movsd qword [esi + 0x48], xmm0
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x5c], eax
jmp 0x533c8b
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x533d4f
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi + 0x44]
mov dword [ebp - 0x28], ecx
sub eax, dword [esi + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x20], ecx
call dword [section..00cfg]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x1c]
push eax
call dword [ebp - 0x20]
add ebx, dword [esi + 0x24]
add eax, dword [esi + 0x20]
sub ebx, eax
mov al, 1
mov dword [ebp - 0x1c], eax
jmp 0x533d56
call fcn.00534280
int3
Function at 0x5340b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x40], 0
jne 0x5340e2
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, ecx
call fcn.00534230
mov byte [ebp - 0x11], 0xff
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
cmp dword [ebp + 8], 0xffffffff
je 0x534160
test edi, edi
jne 0x53410f
lea eax, [ebp - 0x10]
lea edi, [ebp - 0x11]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 8]
mov byte [edi], al
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
inc edi
mov dword [esi + 0x18], edi
sub edi, eax
je 0x534150
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
cmp byte [esi + 0x62], 0
je 0x534164
push dword [esi + 0x40]
push edi
push 1
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, edi
jne 0x5340c9
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
cmovne esi, eax
jmp 0x5340cc
mov eax, ecx
jmp 0x53411e
mov eax, dword [esi + 0x20]
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0x44]
test edi, edi
je 0x53422b
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [esi + 0x34]
add ebx, eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c], ecx
call dword [section..00cfg]
mov ecx, edi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [ebp - 0x2c]
mov edi, eax
mov eax, dword [esi + 0x14]
cmp dword [ebp - 0x1c], eax
je 0x5340c9
cmp edi, 3
je 0x534221
cmp edi, 1
ja 0x5340c9
mov ebx, dword [ebp - 0x18]
mov eax, dword [esi + 0x20]
sub ebx, eax
push dword [esi + 0x40]
push ebx
push 1
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, ebx
jne 0x53420b
cmp edi, 1
jne 0x53420b
mov ecx, dword [esi + 0x18]
mov edx, dword [ebp - 0x1c]
mov dword [esi + 0x14], edx
mov dword [esi + 0x1c], ecx
cmp eax, ebx
jne 0x5340c9
cmp edi, 1
je 0x534172
jmp 0x534141
mov edi, dword [esi + 0x18]
sub edi, eax
jmp 0x53412e
call fcn.00534280
Function at 0x539510
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x539525
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x539552
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x53952c
cmp edx, 1
je 0x539573
cmp edx, 2
je 0x53956a
cmp edx, 3
jne 0x53957e
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x53b770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x43b4f0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.005162aa
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.00508e4f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.0051d534
add esp, 0x10
call fcn.00517b60
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00505bc0
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.00508e4f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.0051d534
add esp, 0x10
call fcn.00517b60
int3

Function at 0x53b7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x43b4f0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.005162aa
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.00508e4f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.0051d534
add esp, 0x10
call fcn.00517b60
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00505bc0
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.00508e4f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.0051d534
add esp, 0x10
call fcn.00517b60
int3
Function at 0x53c3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ebx, dword [edi + 0x24]
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call esi
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, esi
jne 0x53c435
cmp ebx, 1
je 0x53c3c5
cmp ebx, 2
mov esi, 0xffffffff
je 0x53c438
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.0051c668
add esp, 4
neg eax
sbb esi, esi
jmp 0x53c438
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x53c450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x53c47b
push dword [ecx + 0x20]
push edi
push 1
push eax
call fcn.0051d534
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
test edi, edi
jle 0x53c4b6
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebp - 0x10]
movzx eax, byte [eax + edi]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x30]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x14]
call ebx
cmp eax, 0xffffffff
je 0x53c4b8
inc edi
mov edx, dword [ebp + 0xc]
cmp edx, edi
mov eax, dword [ebp + 8]
jne 0x53c487
mov edi, edx
jmp 0x53c4b8
xor edi, edi
mov eax, edi
add esp, 8
jmp 0x53c474
Function at 0x53c4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
cmp ebx, edi
je 0x53c506
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x53c520
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [ecx + 0x20]
push esi
push esi
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, esi
je 0x53c508
jmp 0x53c50a
xor ebx, ebx
mov edi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x19]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x53c5c1
mov ebx, eax
cmp eax, 3
je 0x53c5a9
cmp ebx, 1
ja 0x53c5c1
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.0051d534
add esp, 0x10
cmp eax, esi
jne 0x53c5c1
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x53c52e
mov ebx, dword [ebp + 8]
jmp 0x53c508
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.0051d534
add esp, 0x10
cmp eax, esi
je 0x53c5a1
xor edi, edi
dec edi
jmp 0x53c50a

Function at 0x53c620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x53c64b
push dword [ecx + 0x20]
push edi
push 2
push eax
call fcn.0051d534
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
test edi, edi
jle 0x53c687
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x30]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x14]
call ebx
cmp ax, 0xffff
je 0x53c689
inc edi
mov edx, dword [ebp + 0xc]
cmp edx, edi
mov eax, dword [ebp + 8]
jne 0x53c657
mov edi, edx
jmp 0x53c689
xor edi, edi
mov eax, edi
add esp, 8
jmp 0x53c644
Function at 0x53c690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
movzx esi, word [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x53c6dd
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x53c6f5
lea eax, [ebp - 0x1a]
push dword [ecx + 0x20]
push 1
push 2
push eax
call fcn.0051d534
add esp, 0x10
cmp eax, 1
je 0x53c6df
xor esi, esi
dec esi
jmp 0x53c6df
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x1a]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x53c6d8
mov ebx, eax
cmp eax, 3
je 0x53c783
cmp ebx, 1
ja 0x53c6d8
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.0051d534
add esp, 0x10
cmp eax, esi
jne 0x53c6d8
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x53c703
movzx esi, word [ebp + 8]
jmp 0x53c6df
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.0051d534
add esp, 0x10
cmp eax, esi
jne 0x53c6d8
jmp 0x53c77a
Function at 0x550150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.00503d75
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x5501a0
push ecx
push ecx
call fcn.00511ef0
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x55018f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x5516f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004de4e0
test al, al
jne 0x55170e
mov ecx, esi
call fcn.004de4e0
test al, al
je 0x551713
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.005561a0
Function at 0x5557d0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x170
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e60a0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x555836
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x555842
xor ebx, ebx
jmp 0x555858
test al, al
jns 0x555848
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004e6100
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x556040
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x7b
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004dea80
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.004e60a0
mov ecx, edi
call fcn.004de4e0
test al, al
jne 0x5560ba
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.004de4e0
test al, al
je 0x5560da
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.004e6100
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x5560e5
mov eax, dword [ebx + 4]
cmp eax, 0x103
ja 0x5560ba
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5560f7
mov eax, dword [edi + 4]
cmp eax, 0x103
ja 0x5560ba
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x88
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004dea80
add esp, 0x10
mov ecx, ebx
push 0x606cf0
push esi
mov esi, edi
call fcn.00482c90
cmp byte [edi + 0xb], 0
jns 0x556141
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x556153
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x556196
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x556182
mov eax, edi
and eax, 1
je 0x556182
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.00482d90
jmp 0x5560bc
xor ebx, ebx
jmp 0x556188
Function at 0x5561a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x40b
push str..._.._base_files_file_util_win.cc
push str.MoveUnsafe
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e60a0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x556208
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x556230
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004e6100
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov ecx, edx
test dl, dl
jns 0x556240
mov ecx, dword [esi + 4]
cmp ecx, 0x103
ja 0x556210
mov ecx, esi
test dl, dl
jns 0x556250
mov ecx, dword [esi]
mov edx, edi
test al, al
jns 0x556258
mov edx, dword [edi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x556212
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push edi
call fcn.0045b500
add esp, 4
test al, al
jne 0x55628b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x556210
push esi
push edi
call fcn.005562a0
add esp, 8
test al, al
jne 0x556212
jmp 0x55627f

Function at 0x556710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x556782
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x556786
cmp byte [ebp + 0xc], 0
je 0x556762
cmp byte [esi + 4], 0
je 0x5567d7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.0045d900
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x556734
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x5567ac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5567b0
xor ebx, ebx
jmp 0x55676c
mov eax, dword [esi]
jmp 0x556798
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x5567de
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x556762
mov edi, dword [ebp - 0x14]
jmp 0x556762
mov eax, dword [esi]
jmp 0x556756
mov eax, dword [esi]
jmp 0x5567c3