joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afaf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ec]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4afc97
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x224]
mov eax, dword [ebx + 0x10]
call fcn.0041be00
cmp byte [ebp + 8], 0
je 0x4afb4d
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.0041bcd0
jmp 0x4afb5b
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.0041bcd0
mov eax, dword [ebx + 0x10]
call fcn.0041bdf8
dec eax
jle 0x4afba1
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.0041bcc8
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.0041bdf8
push eax
push 0x12200
call 0x4078f4
mov edx, eax
mov eax, edi
call fcn.0041bd90
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov bx, 0xffcf
call fcn.00403360
test al, al
je 0x4afbea
test esi, esi
jne 0x4afbea
inc dword [ebp - 0xc]
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x4afc20
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1ec]
call fcn.0041cb9c
push eax
call 0x4079dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x566ea4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x566f96
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00566070
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409c4c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00567718
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409b28
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0056778c
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566f9d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403d9c
ret
Function at 0x566fa4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x5670a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00566070
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x56706c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409c4c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00567718
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409b28
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0056778c
jmp 0x56707e
xor edx, edx
mov eax, ebx
call fcn.00567718
xor edx, edx
mov eax, ebx
call fcn.0056778c
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5670ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403d9c
ret
Function at 0x567a58
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0041489c
cmp eax, 0x16
jge 0x567a8f
mov eax, dword [ebp - 8]
call fcn.0041489c
test eax, eax
jne 0x567ba1
mov byte [ebp - 9], 1
jmp 0x567ba1
mov eax, dword [ebp - 8]
call fcn.0041489c
mov edx, 0x10015
call fcn.00565e28
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
neg edx
mov cx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.004027b0
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x567b9a
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
je 0x567aeb
call fcn.00403910
jmp 0x567ba1
mov eax, dword [ebp - 0x14]
sub eax, 0x16
xor edx, edx
jmp 0x567b19
dec eax
test eax, eax
jl 0x567b05
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + eax], 0x50
jne 0x567af7
test eax, eax
jl 0x567b21
mov edx, dword [ebp - 0x10]
add edx, eax
cmp dword [edx], 0x6054b50
je 0x567b19
dec eax
xor edx, edx
test eax, eax
jl 0x567b21
test edx, edx
je 0x567af8
test edx, edx
jne 0x567b2c
call fcn.00403910
jmp 0x567ba1
mov eax, dword [ebp - 4]
add eax, 4
mov cx, word [edx + 4]
mov word [eax + 4], cx
mov cx, word [edx + 6]
mov word [eax + 6], cx
mov cx, word [edx + 8]
mov word [eax + 8], cx
mov cx, word [edx + 0xa]
mov word [eax + 0xa], cx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov dx, word [edx + 0x14]
mov word [eax + 0x14], dx
mov eax, dword [ebp - 8]
call fcn.0041489c
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x18]
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567ba1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004027c8
ret
mov al, byte [ebp - 9]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56d258
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x154]
mov edx, ebx
mov eax, edi
call fcn.0056d47c
mov esi, eax
mov dword [edi + 0x154], esi
and esi, 0xff
add dword [edi + 0x158], esi
imul esi, dword [edi + 0x158], 0x8088405
inc esi
mov dword [edi + 0x158], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x15c]
mov eax, edi
call fcn.0056d47c
mov dword [edi + 0x15c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x56d2cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
movzx esi, cx
dec esi
test esi, esi
jl 0x56d2f2
inc esi
mov eax, edi
call fcn.0056d2b0
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0056d258
inc ebx
dec esi
jne 0x56d2dc
pop edi
pop esi
pop ebx
ret
Function at 0x56d380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x56d3f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0056d2f8
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0056d2b0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0056d258
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x56d3c0
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d3fc
lea eax, [ebp - 4]
call fcn.00403d78
ret
Function at 0x56de48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56dfe3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x56df9f
mov eax, dword [ebp - 4]
call fcn.0056f32c
cmp ebx, eax
jge 0x56df9f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, ebx
call fcn.005641a4
mov edx, dword [0x5669b4]
call fcn.00403314
mov esi, eax
mov eax, esi
call fcn.00567684
test al, al
je 0x56df95
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x56df89
xor eax, eax
push ebp
push 0x56df82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0056e358
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x37]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0x1b]
movzx eax, word [ebp - 0x19]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
movzx esi, word [ebp - 0x17]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404324
mov eax, dword [ebp - 8]
call fcn.004041c4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0056e144
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56dfcd
mov eax, dword [ebp - 4]
call fcn.0056e3d4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a190
jmp 0x56dfcd
mov eax, dword [ebp - 8]
call fcn.00403d78
jmp 0x56dfcd
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
push eax
push 0
lea edx, [ebp - 0x44]
mov eax, 0xb3
call fcn.00409694
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x41061c]
call fcn.0040ce20
call fcn.00403870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56dfea
lea eax, [ebp - 0x44]
call fcn.00403d78
ret
Function at 0x5719e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a58], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a54], 0
jne 0x571a28
mov eax, dword [ebp + 8]
mov word [eax - 0x1a58], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a54], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb54]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.004080bc
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x5c59aa]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5e], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x5c59a8]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a60], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
movzx eax, word [eax*8 + 0x5c59ac]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a64], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x5c59ae]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a66], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
cmp eax, 2
jg 0x571acc
mov eax, dword [esi]
mov eax, dword [eax + 0x22c]
or word [eax + 8], 4
jmp 0x571ade
cmp eax, 8
jl 0x571ade
mov eax, dword [esi]
mov eax, dword [eax + 0x22c]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fa], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1100], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x41c]
mov eax, dword [esi]
mov edx, dword [eax + 0xb4c]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a56], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a56], 0
je 0x571b36
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a56], 0xffff
jne 0x571b4e
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5b], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a56], 0
jmp 0x571bb2
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5b], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a56], 0x106
jae 0x571b70
mov eax, dword [ebp + 8]
push eax
call fcn.00571810
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a68], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb4c]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a68]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a68], ax
inc ebx
cmp bx, 2
jne 0x571b7e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5b56a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x5b56b8
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x5b56cc
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret

Function at 0x5b73d4
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x5b73fa
jmp 0x5b7510
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x5b741a
jmp 0x5b7510
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005b9f1c
add esp, 4
mov dword [0x5cd098], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x5b7467
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x5b7487
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x5b7464
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5b74ef
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.005b9a47
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
jmp 0x5b74a3
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b9ae4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
jmp 0x5b9af0
mov dword [ebp - 8], 0xffffffff
jmp 0x5b9afa
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
jmp 0x5b9b20
mov dword [ebp - 0xc], 0
jmp 0x5b9b2c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x5b9c14
jmp 0x5b9b39
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
jmp 0x5b9b52
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x5b9c0f
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x5b9b82
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x5b9b82
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x5b9c0f
jmp 0x5b9b85
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
jmp 0x5b9b90
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.005b9f1c
add esp, 4
jmp 0x5b9ba1
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x5b9bde
mov dword [0x5cd2c2], 1
mov dword [ebp - 0x10], 0
jmp 0x5b9bc1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x5b9bdc
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x5b9bbe
jmp 0x5b9be8
mov dword [0x5cd2c2], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x5b9bf8
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x5b9c14
jmp 0x5b9b29
jmp 0x5b9c17
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
jmp 0x5b9c2c
mov eax, dword [ebp - 8]
jmp 0x5b9c31
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b9d79
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
jmp 0x5b9d85
mov dword [ebp - 4], 0xffffffff
jmp 0x5b9d8f
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
jmp 0x5b9da8
mov dword [ebp - 8], 0
jmp 0x5b9db4
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x5b9dcf
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x5b9db1
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x5b9e25
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x5b9e25
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x5b9e25
jmp 0x5b9dee
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
jmp 0x5b9df9
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.005b9f1c
add esp, 4
jmp 0x5b9e0a
cmp dword [ebp + 0xc], 0
je 0x5b9e19
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x5b9e1c
mov dword [ebp - 4], 0xa
jmp 0x5b9e35
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
jmp 0x5b9e38
mov eax, dword [ebp - 4]
jmp 0x5b9e3d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5ba457
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x5ba52c
cmp dword [ebp - 8], 0
jne 0x5ba52c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.005b9f1c
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x5ba4e4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x5ba506
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x5ba4e1
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
jmp 0x5ba53e
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret