joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5181c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x5181fd
test esi, esi
je 0x5181fd
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x5181fd
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x518205
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov dword [edi], eax
mov al, byte [esi + 4]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x5181f7
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5188c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7e3e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x518a3a
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebx
test eax, eax
je 0x518a3a
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x51891f
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov eax, dword [0x643498]
test al, 1
jne 0x51895e
or eax, 1
mov dword [0x643498], eax
mov byte [ebp - 4], 1
call fcn.00517b30
push 0x5a9fd0
call fcn.00551ad4
add esp, 4
mov byte [ebp - 4], 0
push 0x641a58
call ebx
test eax, eax
je 0x51897d
call fcn.00480850
add eax, 8
lea ecx, [ebp - 0x14]
push eax
call fcn.0040c280
mov esi, dword [ebp - 0x14]
or ebx, 0xffffffff
cmp dword [esi - 0xc], 0
jle 0x518a06
push edi
lea ecx, [ebp - 0x10]
call fcn.0040c2d0
mov byte [ebp - 4], 2
call fcn.00480850
lea ecx, [eax + 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5189a5
sub ecx, edx
sar ecx, 1
je 0x5189d3
push edi
call fcn.00480850
add eax, 0x210
push eax
lea eax, [ebp - 0x10]
push str.__s__s_
push eax
call fcn.00422de0
add esp, 0x10
sub esp, 8
push dword [ebp - 0x10]
push esi
call fcn.00517a10
mov byte [ebp - 4], 0
mov ecx, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5189ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 1
jmp 0x518a08
xor edi, edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x518a26
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x519810
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8008
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x5199c4
push 0x63ce44
push 0x100
call fcn.005527e9
xor ebx, ebx
mov dword [ebp - 0x34], 0x5be2fc
add esp, 8
mov dword [ebp - 0x30], ebx
test eax, eax
je 0x519876
mov ebx, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x51988b
mov esi, dword [edi + 4]
sub esi, dword [edi]
jmp 0x51988d
xor esi, esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0
call fcn.0051bbf0
mov ecx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x5198ac
test eax, eax
je 0x5198b8
test edi, edi
je 0x5198b8
push eax
mov ecx, edi
call fcn.00442450
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0x100
push ebx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x51999a
mov edx, dword [ebp + 0xc]
nop
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5199bd
test edi, edi
je 0x51993d
mov edx, dword [edi + 4]
xor eax, eax
sub edx, dword [edi]
mov dword [ebp - 0x18], ecx
add dword [ebp - 0x18], esi
adc eax, dword [ebp - 0x1c]
test eax, eax
jb 0x519928
ja 0x51991a
cmp dword [ebp - 0x18], edx
jbe 0x519928
lea eax, [esi + ecx]
mov ecx, edi
push eax
call fcn.00442450
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
push ecx
add eax, esi
push ebx
push eax
call fcn.00559410
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
add esi, ecx
adc eax, 0
mov dword [ebp - 0x1c], eax
test edx, edx
je 0x519969
push ecx
push eax
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x28]
call edx
add esp, 0x24
test eax, eax
je 0x51999a
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0x100
push ebx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [ebp + 0xc]
test eax, eax
jne 0x5198f0
xor esi, esi
test ebx, ebx
je 0x5199a9
push ebx
call fcn.005527f2
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 1
jmp 0x51999c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5199e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x519acf
test esi, esi
je 0x519acf
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.00519690
test eax, eax
je 0x519ab1
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x519ab1
mov ecx, ebx
call fcn.0051b8a0
mov ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
cmp edx, 3
je 0x519a6d
cmp edx, 4
je 0x519ab1
cmp edx, 5
je 0x519ab1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x519a7d
lea eax, [ebp - 0x18]
push eax
call fcn.00409fc0
sub esp, 8
mov edx, ebx
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00519af0
add esp, 0x14
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00409f80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
xor esi, esi
call fcn.00409f80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51ba40
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x2c], 0
push 0x200
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.00442450
mov edi, dword [ebp + 8]
mov ecx, ebx
push 5
mov eax, dword [edi]
mov dword [edi + 4], eax
lea eax, [esp + 0x18]
push eax
call fcn.0051b8f0
mov esi, dword [esp + 0x14]
push 0xa
push 0
push esi
call fcn.005530a4
mov ebx, eax
add esp, 0xc
mov eax, edx
lea edx, [esi - 0x10]
mov dword [esp + 0x14], eax
lea ecx, [edx + 0xc]
or esi, 0xffffffff
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x51bac5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x51bacd
test ebx, ebx
je 0x51bad5
push ebx
mov ecx, edi
call fcn.00442450
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x18]
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x51bb0f
cmp dword [eax], 0
je 0x51bb0f
push 0
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
push 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetSetFilePointer]
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x10]
mov ebx, dword [esp + 0x2c]
push ecx
push 0x200
push ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x51bbce
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x51bbe8
mov edx, dword [edi + 4]
xor eax, eax
sub edx, dword [edi]
mov ebx, ecx
add ebx, esi
adc eax, dword [esp + 0x14]
test eax, eax
jb 0x51bb84
ja 0x51bb75
cmp ebx, edx
jbe 0x51bb84
lea eax, [esi + ecx]
mov ecx, edi
push eax
call fcn.00442450
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
add eax, esi
push ecx
push ebx
push eax
call fcn.00559410
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x1c], 0
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
mov eax, dword [eax + 0x10]
adc dword [esp + 0x14], 0
push ecx
push 0x200
push ebx
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x51bb50
xor esi, esi
test ebx, ebx
je 0x51bbdd
push ebx
call fcn.00551995
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, 1
jmp 0x51bbd0
Function at 0x51d0f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a84c9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x60f520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.4555_6P6677_7a7777777878888859d99:_:_:8:O::_7_____7_N_e____G_S__.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0041b090
mov dword [esi + 8], eax
mov ecx, esi
mov dword [esi + 4], esi
mov dword [esi + 0x10], 0
call fcn.0051e180
lea eax, [esi + 0x14]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push 0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x51d188
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x51d180
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x51d188
push eax
call fcn.0040c390
mov byte [ebp - 4], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041b090
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], vtable.__.1.0
xorps xmm0, xmm0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
movdqu xmmword [esi + 0x48], xmm0
movq qword [esi + 0x58], xmm0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0x8ca0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
xor eax, eax
mov byte [ebp - 4], 3
mov dword [esi + 0x78], 0
mov dword [ebp - 0x10], 0x547
cmp eax, 0x51d5e0
je 0x51d222
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 8]
call fcn.00447520
mov dword [eax], 0x51d5e0
xor eax, eax
mov dword [ebp - 0x10], 0x548
cmp eax, 0x51d5e0
je 0x51d244
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 8]
call fcn.00447520
mov dword [eax], 0x51d5e0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x38]
push eax
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x24]
mov ecx, 1
test eax, eax
cmove eax, ecx
sub esp, 8
mov dword [ebp - 0x24], eax
lea ecx, [esi + 0x34]
add eax, 2
push eax
push esi
call fcn.0051dad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51dbd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x51dc60
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x30]
mov ecx, edi
push 0
call fcn.0051de60
mov esi, dword [edi + 0xc]
dec esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x51dc3e
test esi, esi
js 0x51dc69
cmp esi, dword [edi + 0xc]
jge 0x51dc69
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x51dc32
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
dec esi
jns 0x51dc04
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x40], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x51e180
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x51e26e
push 0x2c
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.00559380
push 0x800
lea eax, [ebp - 0x808]
mov dword [ebp - 0x838], 0x30
push 0
push eax
mov dword [ebp - 0x824], 0x400000
call fcn.00559380
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Q360SoftMgrMsgDelegateWnd_d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00429e70
add esp, 0x10
mov dword [ebp - 0x830], 0x44afd0
lea eax, [ebp - 0x808]
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [ebp - 0x824]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x810]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x51e282
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055199a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0055199a
mov esp, ebp
pop ebp
ret

Function at 0x51e2a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push ecx
mov edi, ecx
call fcn.0051e940
cmp dword [ebp + 0xc], 0
jne 0x51e2c4
mov eax, dword [ebp + 8]
test eax, eax
je 0x51e2c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov edx, dword [edi]
mov byte [ecx + edx], cl
inc ecx
cmp ecx, 0x100
jl 0x51e2c6
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x51e329
push ebx
push esi
mov dword [ebp - 4], 0
xor ebx, ebx
xor edx, edx
mov esi, dword [edi]
mov eax, ebx
div dword [ebp + 0xc]
movzx eax, byte [edx + ecx]
add eax, dword [ebp - 4]
movzx edx, byte [esi + ebx]
add edx, eax
and edx, 0x800000ff
jns 0x51e30c
dec edx
or edx, 0xffffff00
inc edx
mov cl, byte [esi + ebx]
mov al, byte [esi + edx]
mov byte [esi + ebx], al
inc ebx
mov byte [esi + edx], cl
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edx
cmp ebx, 0x100
jl 0x51e2e6
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x51e340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0xc]
call fcn.00469800
mov edx, dword [ebp - 0xc]
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x51e3be
inc esi
and esi, 0x800000ff
jns 0x51e371
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [edx + esi]
add edi, eax
and edi, 0x800000ff
jns 0x51e387
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edx + edi]
mov cl, byte [edx + esi]
mov byte [edx + esi], al
mov byte [edx + edi], cl
movzx ecx, byte [edx + esi]
movzx eax, byte [edx + edi]
add ecx, eax
and ecx, 0x800000ff
jns 0x51e3ae
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edx]
mov ecx, dword [ebp + 8]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x51e360
pop edi
pop esi
pop ebx
test edx, edx
je 0x51e3ce
push edx
call fcn.00551995
add esp, 4
mov esp, ebp
pop ebp
ret 8
Function at 0x51e640
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8610
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x51e68d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x51e80f
test esi, esi
je 0x51e80f
xor edi, edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x48], 0x1524645
mov byte [ebp - 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 0x42], 0x22
mov ecx, 0xff
mov dword [ebp - 0x3e], edi
div ecx
mov eax, dword [0x5b7124]
movdqu xmm0, xmmword [str._CX_ENCRYPT_FORMAT_]
mov ecx, dword [ebp - 0x10]
inc dl
mov dword [ebp - 0x2a], eax
lea eax, [ebp - 0x48]
push eax
push esi
mov byte [ebp - 0x43], dl
movdqu xmmword [ebp - 0x3a], xmm0
call fcn.0051e840
test eax, eax
je 0x51e811
push edi
push edi
mov edi, dword [ebp - 0x42]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub ebx, edi
mov dword [ebp - 0x24], 0x5be2fc
push ebx
mov dword [ebp - 0x14], ebx
call fcn.00550341
push ebx
mov edi, eax
push 0
push edi
mov dword [ebp - 0x20], edi
call fcn.00559380
add esp, 0x10
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x51e807
push ebx
push 0
push edi
call fcn.00559380
add esp, 0xc
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 0x44]
test al, al
jne 0x51e79b
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov edi, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x51e811
cmp al, 1
jne 0x51e807
cmp dword [ebp - 0x3e], ebx
mov edi, ebx
mov eax, dword [ebp - 0x10]
cmovb edi, dword [ebp - 0x3e]
push edi
push dword [ebp - 0x20]
mov ecx, dword [eax]
call fcn.0051e340
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp - 0x20]
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.0051e340
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ebp - 0x43]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
sub eax, ebx
push eax
mov dword [edi], eax
lea eax, [ebx + ecx]
push eax
push ecx
call fcn.00551fe0
mov eax, dword [edi]
push ebx
mov ebx, dword [ebp - 0x20]
add eax, ebx
push 0
push eax
call fcn.00559380
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov edi, 1
mov dword [eax], ebx
jmp 0x51e811
lea ecx, [ebp - 0x24]
call fcn.0043aa50
xor edi, edi
test esi, esi
je 0x51e81c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51e840
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x51e929
test esi, esi
je 0x51e929
lea ecx, [ebp - 0x28]
call fcn.0051e3e0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0x22
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x51e929
cmp dword [ebp - 0x2c], 0x22
jne 0x51e929
cmp byte [ebp - 0x28], 0x45
jne 0x51e929
cmp byte [ebp - 0x27], 0x46
jne 0x51e929
cmp byte [ebp - 0x26], 0x52
jne 0x51e929
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x22]
cmp eax, edx
jb 0x51e929
mov ecx, dword [ebp - 0x1e]
add ecx, edx
cmp eax, ecx
jb 0x51e929
cmp byte [ebp - 0x25], 1
jg 0x51e929
mov ecx, dword [ebx]
lea eax, [ebp - 0x1a]
push 0x14
push eax
call fcn.0051e340
push 0x14
push str._CX_ENCRYPT_FORMAT_
lea eax, [ebp - 0x1a]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNA]
test eax, eax
jne 0x51e929
movdqu xmm0, xmmword [ebp - 0x28]
mov ax, word [ebp - 8]
pop edi
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ebp - 0x18]
movdqu xmmword [esi + 0x10], xmm0
mov word [esi + 0x20], ax
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055199a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055199a
mov esp, ebp
pop ebp
ret 8

Function at 0x521e90
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], vtable.99999:_:H:Q::.0
xorps xmm0, xmm0
mov dword [ecx + 0x18], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
movdqu xmmword [ecx + 0x5c], xmm0
movdqu xmmword [ecx + 0x6c], xmm0
movdqu xmmword [ecx + 0x7c], xmm0
movdqu xmmword [ecx + 0x8c], xmm0
mov byte [ecx + 0x5c], 0x80
ret
Function at 0x521ff0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x522010
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x522053
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.00521f20
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00521f20
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
dec edi
jne 0x522080
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movdqu xmmword [ebx], xmm0
pop edi
movdqu xmmword [ebx + 0x10], xmm0
pop esi
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.0055199a
mov esp, ebp
pop ebp
ret 4