joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53eb90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x53ec6b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53ec0a
call ebx
cmp eax, 3
jne 0x53ebf1
push edi
call fcn.0053ef90
mov esi, eax
add esp, 4
test esi, esi
jne 0x53ebe5
call fcn.004c80f2
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x53ec0a
call ebx
push eax
call fcn.0053ead0
push esi
call fcn.005de59f
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x53ec63
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x53ec2a
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x53ec31
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.005de59f
add esp, 4
cmp edi, 0xffffffff
jne 0x53ec53
call ebx
push eax
call fcn.0053ead0
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.004c8763
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x53ecff
push dword [esp + 0x1c]
push ebp
push edi
call fcn.005f8523
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x53ed86
call fcn.004c80f2
cmp dword [eax], 0xd
jne 0x53ecde
test ebp, 0x100
je 0x53ecde
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53ecb4
call ebx
push eax
call fcn.0053ead0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x53eccb
call fcn.004c80f2
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.004c80f2
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.004c80f2
cmp dword [eax], 2
jne 0x53ed86
push edi
call fcn.0053ef90
mov esi, eax
add esp, 4
test esi, esi
je 0x53ebd2
push dword [esp + 0x1c]
push ebp
push esi
call fcn.005f85c9
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x53ed76
call fcn.004c80f2
cmp dword [eax], 0xd
jne 0x53ed76
test ebp, 0x100
je 0x53ed76
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x53ed4c
call ebx
push eax
call fcn.0053ead0
add esp, 4
push esi
call fcn.005de59f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x53ed6b
call fcn.004c80f2
push esi
mov dword [eax], 0x15
call fcn.005de59f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.004c80f2
mov dword [eax], 0xd
push esi
call fcn.005de59f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x53ed90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x53eda7
call fcn.004c80f2
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x53ee18
push eax
call fcn.004c86f9
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x53ee13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x53eded
call fcn.004c80f2
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x53ee18
cmp eax, 5
jne 0x53ee06
call fcn.004c80f2
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0053ead0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x53f1a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x53f1b7
call fcn.004c80f2
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.004c86f9
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x53f201
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x53f1f4
call fcn.004c80f2
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0053ead0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x56b5d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x69668c], 0
push esi
push edi
jne 0x56b68c
mov byte [0x69668c], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x69778c], eax
inc esi
cmp esi, 0x100
jb 0x56b5e8
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
not eax
test edi, edi
je 0x56b6ba
mov esi, dword [esp + 0xc]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x69778c]
sub edi, 1
jne 0x56b6a0
pop edi
not eax
pop esi
ret
Function at 0x56cbc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x696e90], 0
push ebx
push esi
push edi
jne 0x56ccd7
mov byte [0x696e90], 1
xor esi, esi
nop dword [eax]
xor eax, eax
mov edx, esi
shrd edx, eax, 1
mov ecx, esi
and ecx, 1
shr eax, 1
or ecx, 0
je 0x56cbff
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x56cc1a
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x56cc35
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x56cc50
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x56cc6b
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x56cc86
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x56cca1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x56ccbc
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x696690], ecx
mov dword [esi*8 + 0x696694], eax
inc esi
cmp esi, 0x100
jb 0x56cbe0
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x56cd15
mov esi, dword [esp + 0x10]
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x696690]
xor edx, dword [ecx*8 + 0x696694]
sub edi, 1
jne 0x56ccf0
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x584780
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x5847a0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x5847a0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x5847a0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x597010
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov ecx, dword [edi + 0x18]
cmp ecx, 0xc
jle 0x59702d
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], ecx
jge 0x5970ed
lea esi, [edi + 0x44]
nop dword [eax + eax]
mov dl, byte [esi]
test dl, dl
jne 0x5970bf
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x59705b
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x59706b
push dword [ecx + 0x38]
push 1
push 1
push esi
call fcn.005f668a
add esp, 0x10
cmp eax, 1
jne 0x597146
mov al, byte [esi]
test al, al
je 0x597137
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x597098
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x5970a7
push dword [edx + 0x38]
push eax
push 1
push ebp
call fcn.005f668a
add esp, 0x10
mov dl, byte [esi]
mov ecx, eax
movzx eax, dl
cmp ecx, eax
jne 0x597146
mov al, byte [ebp]
mov byte [ebp], 2
jmp 0x5970cd
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
dec dl
movzx eax, al
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jl 0x597040
mov eax, dword [esp + 0x18]
movzx ecx, word [ecx*2 + 0x648df0]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x59712d
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x59712d
cmp ecx, 0xc
jge 0x59712d
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
mov eax, 0x70
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret
pop esi
pop ebp
mov eax, 0x66
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret

Function at 0x5974b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5974cf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5974e3
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.005f668a
add esp, 0x10
cmp eax, 1
jne 0x597539
mov al, byte [esp + 0xc]
lea ecx, [edi + 0x44]
test al, al
je 0x597545
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
mov byte [ecx], al
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x597517
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x59752e
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.005f668a
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x597559
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [ecx], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x597570
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x59758f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5975a3
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.005f668a
add esp, 0x10
cmp eax, 1
jne 0x5975f9
mov cl, byte [esp + 0xc]
test cl, cl
je 0x597605
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5975d7
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5975ee
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.005f668a
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x59760f
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x5979e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5979f8
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
push esi
push esi
call fcn.00597b80
add esp, 8
test eax, eax
je 0x5979f4
lea eax, [esi + 4]
push eax
push esi
call fcn.00597b80
add esp, 8
test eax, eax
je 0x5979f4
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x597a30
push 3
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x597a44
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 3
push 1
push eax
call fcn.005f668a
add esp, 0x10
cmp eax, 3
je 0x597a66
push dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
call fcn.005982e0
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop esi
ret
mov dl, byte [esp + 8]
movzx ecx, dl
mov eax, ecx
shr eax, 4
and eax, 7
inc eax
push ebx
mov dword [esi + 8], eax
mov bl, dl
movzx eax, byte [esp + 0xd]
shr bl, 3
mov dword [esi + 0xc], eax
and bl, 1
mov al, byte [esp + 0xe]
mov byte [esi + 0x10], al
push edi
test dl, dl
jns 0x597b63
and ecx, 7
mov eax, 1
inc ecx
shl eax, cl
push 0
push eax
call fcn.00598390
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x597ac2
pop edi
pop ebx
mov dword [esi + 0x40], 0x6d
pop esi
ret
mov byte [eax + 8], bl
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x597b6a
xor edi, edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x597aed
push 3
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x597b01
push dword [ecx + 0x38]
lea eax, [esp + 0x14]
push 3
push 1
push eax
call fcn.005f668a
add esp, 0x10
mov ecx, dword [esi + 0x14]
cmp eax, 3
jne 0x597b46
mov ecx, dword [ecx + 0xc]
inc ebx
movzx eax, byte [esp + 0x10]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x11]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x12]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x597ad4
pop edi
pop ebx
mov eax, 1
pop esi
ret
push ecx
call fcn.005982e0
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
mov eax, 1
pop esi
ret

Function at 0x597b80
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x597b9e
push 2
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x597bb2
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 2
push 1
push eax
call fcn.005f668a
add esp, 0x10
cmp eax, 2
je 0x597bc2
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov ax, word [esp + 8]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], ecx
mov eax, 1
ret
Function at 0x597be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x4c
call fcn.005de594
mov esi, eax
add esp, 4
test esi, esi
jne 0x597c0f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x597d30
pop edi
mov dword [eax], 0x6d
xor eax, eax
pop esi
add esp, 8
ret
push 0x4c
push 0
push esi
call fcn.004d6ec0
push 0x614c
push 1
call fcn.005de5ba
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x597c4d
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x597c3c
mov dword [eax], 0x6d
push esi
call fcn.005de59f
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push 0x614c
push 0
push edi
call fcn.004d6ec0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [esi + 0x48], edi
mov dword [edi + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], 0
mov dword [edi + 0x38], 0
mov dword [edi], 8
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x597c9b
push 6
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x597caf
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 6
push 1
push eax
call fcn.005f668a
add esp, 0x10
cmp eax, 6
je 0x597cc4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x597cef
mov dword [eax], 0x66
jmp 0x597cef
push 3
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
push str.GIFVER
call fcn.005de5d0
add esp, 0xc
test eax, eax
je 0x597d06
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x597cef
mov dword [eax], 0x67
push edi
call fcn.005de59f
push esi
call fcn.005de59f
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.005979e0
add esp, 4
test eax, eax
jne 0x597d38
push edi
call fcn.005de59f
push esi
call fcn.005de59f
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x597d30
mov dword [eax], 0x68
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov dword [esi + 0x40], 0
cmp byte [esp + 0xb], 0x39
sete al
mov byte [edi + 0x6148], al
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x5a54b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x5a5568
lea eax, [esp + 0x18]
push eax
push esi
push 2
call fcn.005c5260
add esp, 0xc
test eax, eax
jne 0x5a5568
lea eax, [esp + 4]
push eax
push esi
push 0x17
call fcn.005c5260
add esp, 0xc
test eax, eax
jne 0x5a5568
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x5a54f5
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.005c5df0
add esp, 0xc
test eax, eax
je 0x5a5529
sub eax, esi
push eax
push 0x2e
push esi
call fcn.005c5df0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x5a552b
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x5a555e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.005b1450
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x5a5540
pop edi
movzx eax, bl
pop ebx
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x5a8cc0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x5a8cda
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x649e3c
push esi
call fcn.004d11d0
add esp, 8
test eax, eax
je 0x5a8d22
test ebp, ebp
je 0x5a8d13
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x5a8d48
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5a8d48
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x5a8dff
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a8d65
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x690b90]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5a8df5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5a8df5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a8d97
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a8db0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x5a8dc0
test ebp, ebp
je 0x5a8dec
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x690b94]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x690b94]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x5a8f80
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
je 0x5a8fc3
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5a8fb7
mov eax, dword [esp]
cmp al, 2
jne 0x5a8fb1
shr eax, 8
cmp al, 2
je 0x5a8fc3
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
call fcn.005c9eb0
test eax, eax
jne 0x5a91c5
push esi
push edi
push str.kernel32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x5a8ff0
mov dword [0x696f78], esi
jmp 0x5a9128
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push edi
call ebp
push 0x649e3c
push str.iphlpapi.dll
mov ebx, eax
call fcn.004d11d0
add esp, 8
test eax, eax
je 0x5a9040
test ebx, ebx
je 0x5a902e
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5a9103
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x5a9103
test ebx, ebx
je 0x5a9065
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x5a9065
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5a9103
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x5a90fd
lea ecx, [ebp + 0xd]
push ecx
call dword [0x690b90]
mov edi, eax
add esp, 4
test edi, edi
je 0x5a90f3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5a90f3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a90a0
sub ecx, edx
mov eax, 0x5c
mov word [ecx + edi], ax
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a90b7
sub ecx, edx
mov edx, str.iphlpapi.dll
sub ecx, edx
add ecx, edi
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x5a90d0
test ebx, ebx
je 0x5a90ea
push 8
push 0
push edi
call ebx
jmp 0x5a90f1
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x690b94]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x696f78], esi
test esi, esi
je 0x5a9126
push str.if_nametoindex
push esi
call ebp
mov ecx, dword [0x696f74]
test eax, eax
cmovne ecx, eax
mov dword [0x696f74], ecx
pop ebp
pop ebx
push 0x9c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004d6ec0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 8], 0x9c
mov dword [esp + 0xc], 6
mov dword [esp + 0x10], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x28], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop edi
pop esi
test eax, eax
je 0x5a91bc
push 0x697b8c
mov byte [0x697b94], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret
mov byte [0x697b94], 0
xor eax, eax
add esp, 0x190
ret