joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1f09
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x616198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov eax, dword [0x69cfe8]
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
push ecx
lea ecx, [esp + 0x20]
call fcn.005eb756
lea edx, [esp + 0x38]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x34], 2
call fcn.005ebb1a
mov eax, dword [esp + 0xc]
mov eax, dword [eax - 8]
cmp eax, 2
jle 0x4f20a7
lea ecx, [esp + 0x18]
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.005e7b3e
mov eax, dword [eax]
push 0x67e59c
push eax
call fcn.005cf1ee
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.005eb9e1
test bl, bl
je 0x4f20a7
push str.Unknown_error
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
call fcn.005eba4f
push 0x676ee0
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.005eba4f
mov edx, dword [0x6a20f0]
lea ecx, [esp + 8]
add edx, 0x2ae0
mov byte [esp + 0x30], 4
push edx
call fcn.005eb756
mov bl, 5
push 0x3e
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.005e7bb6
cmp eax, 0xffffffff
je 0x4f201c
mov ecx, dword [esp + 8]
lea edx, [esp + 0x20]
mov ecx, dword [ecx - 8]
sub ecx, eax
sub ecx, 2
push ecx
push edx
lea ecx, [esp + 0x10]
call fcn.005e7ac2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.005ebb1a
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
jmp 0x4f2035
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4f2035
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
call fcn.005ebb1a
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.005eb756
mov ecx, esi
call fcn.004f2120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
dec eax
push ecx
mov dword [esp + 0x18], eax
push eax
push edx
lea eax, [esp + 0x28]
push str._s__Line__d:__s
push eax
call fcn.005e7f5e
add esp, 0x14
lea ecx, [esp + 8]
mov byte [esp + 0x30], 4
call fcn.005eb9e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.005eb9e1
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.005eb9e1
call fcn.005f1868
test eax, eax
je 0x4f20bb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x4f20bf
xor eax, eax
jmp 0x4f20c2
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x1c]
push 0x30
push str.Error
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.005eb9e1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.005eb9e1
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 4

Function at 0x4f50a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4f6240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6167d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x69cfe8]
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 0x78]
push esi
push esi
push 0x188
push ecx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ebp, [edi + 0x5c]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.004f16f0
mov edx, dword [edi + 0xb0]
mov ebx, dword [edx + 0x2a70]
cmp ebx, esi
je 0x4f631f
mov eax, ebx
mov ebx, dword [ebx]
mov esi, dword [eax + 8]
test esi, esi
je 0x4f6313
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str._s_n_s_n_s_n_s
push ecx
call fcn.005e7f5e
add esp, 0x18
mov ecx, edi
push esi
call fcn.004f64f0
test eax, eax
je 0x4f630f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
push edx
push eax
mov ecx, ebp
call fcn.004f1670
push esi
push eax
mov ecx, ebp
call fcn.004f1710
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4f630f
inc dword [esp + 0x18]
inc dword [esp + 0x10]
test ebx, ebx
jne 0x4f62a8
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4f632b
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc4]
jmp 0x4f635d
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
setle al
push eax
push 2
mov ecx, edi
call fcn.005ef08e
mov ecx, eax
call fcn.005ef33c
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 0x78]
push 0
push ecx
push 0x186
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4fc3a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], 2
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4fc40f
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
call fcn.005eb9e1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.005eb9e1
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.005eb9e1
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x30]
push str.____
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.005ebc76
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 3
call fcn.005ebc10
push 0x67522c
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 4
push eax
call fcn.005ebc76
lea ecx, [esp + 0x28]
lea edx, [esp + 4]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 5
call fcn.005ebc10
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 6
call fcn.005ebb1a
lea ecx, [esp + 4]
mov byte [esp + 0x20], 5
call fcn.005eb9e1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call fcn.005eb9e1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.005eb9e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.005eb9e1
lea eax, [esp + 0x2c]
lea ecx, [esi + 0x2ae0]
push eax
call fcn.005ebb1a
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.005eb756
lea ecx, [esi + 0x60]
call fcn.004f1cf0
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x20], 1
call fcn.005eb9e1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.005eb9e1
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc

Function at 0x4fc7d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x617608
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ecx + 0x64]
push str._tblNotificationMessages
push esi
mov dword [esp + 0x14], 0
call fcn.00563060
push 0xffffd8ef
push esi
call fcn.005631e0
mov eax, dword [esp + 0x24]
push eax
push esi
call fcn.00563060
mov ecx, dword [esp + 0x30]
push ecx
push esi
call fcn.00563060
push 0xfffffffffffffffd
push esi
call fcn.005633a0
push 0xfffffffffffffffe
push esi
call fcn.00562a30
add esp, 0x30
lea ecx, [esp + 0x14]
call fcn.005eb9e1
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 8
Function at 0x4fc860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617647
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov eax, dword [0x69cfe8]
mov esi, dword [ecx + 0x64]
mov dword [esp + 0x14], 1
mov dword [esp + 4], eax
push str._tblNotificationMessages
push esi
mov byte [esp + 0x1c], 2
call fcn.00563060
push 0xffffd8ef
push esi
call fcn.005631e0
mov ecx, dword [esp + 0x30]
push ecx
push esi
call fcn.00563060
push 0xfffffffffffffffe
push esi
call fcn.005631e0
push 0xffffffffffffffff
push esi
call fcn.00562e40
add esp, 0x28
lea ecx, [esp + 4]
push eax
call fcn.005ebb6a
push 0xfffffffffffffffe
push esi
call fcn.00562a30
push 0xfffffffffffffffe
push esi
call fcn.00562a30
mov esi, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.005eb756
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.005eb9e1
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x4fe850
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6178a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
xor ebx, ebx
push 0x4b90
mov dword [edi], 0x64
mov dword [esp + 0x2c], ebx
mov dword [ebp], 0x32
call fcn.005eb722
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov byte [esp + 0x28], 1
je 0x4fe8ac
mov ecx, eax
call fcn.004e89c0
mov esi, eax
jmp 0x4fe8ae
xor esi, esi
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x28], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x44], eax
call fcn.005f1868
cmp eax, ebx
je 0x4fe8ce
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x4fe8d0
xor eax, eax
mov edx, dword [esi]
push ebx
push 0x270f
push eax
lea eax, [esp + 0x1c]
mov ecx, 0x64
push eax
push 0x40000000
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
push str.VideoWindow
push ebx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [edx + 0x54]
test eax, eax
je 0x4fe96a
push ebx
mov ecx, esi
call fcn.005ef2fa
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005eb756
mov ecx, esi
call fcn.004ea7f0
mov ecx, dword [esi + 0x3c]
push ebx
call fcn.005ef33c
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x10]
push eax
call fcn.004ecea0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [ebp], edx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
cmp esi, ebx
je 0x4fe95e
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 4]
cmp dword [esp + 0x3c], ebx
je 0x4fe977
add dword [ebp], 0x19
jmp 0x4fe977
cmp esi, ebx
je 0x4fe977
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x24
Function at 0x4ff880
Capabilities:
Access peb ldr_data
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x617a92
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
push 0x6a1e40
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0
call fcn.005eba4f
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 1
call fcn.0041a860
mov eax, dword [0x69cfe8]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
push 1
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.NONE
mov byte [esp + 0x13c], 3
call fcn.005eba4f
push ecx
mov byte [esp + 0x13c], 4
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InstallerLocation
call fcn.005eba4f
push ecx
mov byte [esp + 0x140], 5
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
call fcn.005eba4f
push 3
lea ecx, [esp + 0x28]
mov byte [esp + 0x144], 3
call fcn.0041b2a0
test eax, eax
je 0x4ff9be
mov edx, dword [esp + 0xc]
push str.NONE
push edx
call fcn.005cf4d3
add esp, 8
test eax, eax
je 0x4ff9be
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4ff9be
push 0x6723a0
lea ecx, [esp + 0x10]
call fcn.005e7fba
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.005eb756
push 0x67a500
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 6
call fcn.005ebdbd
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4ff9ad
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
call fcn.005ebb1a
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 3
call fcn.005eb9e1
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4ffa75
push str.msi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4ffa75
lea edx, [esp + 0x20]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x4ffa6e
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
call fcn.005eba4f
push 0x5c
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 7
call fcn.005e7bb6
cmp eax, 0xffffffff
je 0x4ffa5d
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.005e7b3e
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x130], 8
call fcn.005ebb1a
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 7
call fcn.005eb9e1
push 0x6723a0
lea ecx, [esp + 8]
call fcn.005e7fba
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 3
call fcn.005eb9e1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 4]
mov eax, dword [edx - 8]
test eax, eax
jne 0x4ffaac
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 8]
call fcn.005ebb6a
push 0x6723a0
lea ecx, [esp + 8]
call fcn.005e7fba
mov esi, dword [esp + 0x134]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005eb756
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 2
call fcn.005eb9e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 1
call fcn.0041a890
lea ecx, [esp + 4]
mov byte [esp + 0x12c], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0x124]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x12c
ret
Function at 0x506d00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x618505
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov eax, dword [0x69cfe8]
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov edx, dword [esp + 0x12c]
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
mov dword [esp + 0x12c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x506db7
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x506db7
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x14]
push edx
call esi
cmp byte [esp + eax + 0x13], 0x5c
jne 0x506da9
lea eax, [esp + 0x14]
push eax
call esi
mov byte [esp + eax + 0x13], 0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 8]
call fcn.005ebb6a
mov esi, dword [esp + 0x128]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005eb756
mov dword [esp + 0x10], 1
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 8

Function at 0x506f83
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x61851a
call fcn.005d261c
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi]
mov dword [ebp - 0x14], ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], ebx
je 0x507025
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x507025
push 0x360
call fcn.005eb722
pop ecx
mov ecx, eax
mov dword [ebp - 0x1c], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x506fd4
call fcn.005070be
jmp 0x506fd6
xor eax, eax
push eax
mov byte [ebp - 4], bl
push dword [esi]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, ebx
jne 0x507000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x667d7c
push eax
call fcn.005d0fb1
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esi + 4]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ecx + 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00507041
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x50b09b
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
xor edx, edx
mov al, 1
shl al, cl
inc ecx
dec edx
cmp edx, 0xfffffff8
mov byte [ecx + 0x6a2277], al
mov byte [edx + 0x6b32b8], al
not al
mov byte [ecx + 0x6b22a7], al
jg 0x50b09f
xor ecx, ecx
mov dl, cl
mov al, cl
shl dl, 4
shr al, 4
xor al, dl
and al, 0xf
xor al, dl
mov dl, al
shl dl, 2
shr al, 2
xor al, dl
and al, 0x33
xor al, dl
mov dl, al
add dl, dl
shr al, 1
xor al, dl
and al, 0x55
xor al, dl
mov byte [ecx + 0x6a2118], al
inc ecx
cmp ecx, 0x100
jl 0x50b0c0
push ebx
push ebp
push esi
push edi
push 7
mov esi, 0x6a2238
pop edi
mov edx, 0xff
mov ecx, edi
xor eax, eax
sar edx, cl
or bl, 0xff
mov ecx, eax
shl bl, cl
and bl, dl
mov byte [esi + eax], bl
inc eax
cmp eax, 8
jl 0x50b110
dec edi
add esi, 8
cmp edi, 0xffffffff
jg 0x50b105
xor esi, esi
mov eax, esi
xor ecx, ecx
shl eax, 3
lea edi, [eax + 0x6b22b7]
mov ebp, edi
xor edx, edx
inc edx
shl edx, cl
test esi, edx
setne dl
mov byte [ebp], dl
inc ecx
dec ebp
cmp ecx, 8
jl 0x50b13c
lea ecx, [eax + 0x6b22b2]
xor edx, edx
mov dh, byte [ecx + 1]
mov dl, byte [ecx]
movzx ebx, byte [ecx - 1]
movzx ecx, byte [ecx - 2]
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax + 0x6b22b6]
mov dword [eax + 0x6b2ab0], edx
mov ch, byte [edi]
movzx edx, byte [eax + 0x6b22b5]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x6b22b4]
shl ecx, 8
or ecx, edx
inc esi
cmp esi, 0x100
mov dword [eax + 0x6b2ab4], ecx
jl 0x50b12d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x50fcd6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x10]
dec ecx
je 0x50fdb4
dec ecx
je 0x50fd74
dec ecx
je 0x50fd5a
dec ecx
je 0x50fd3c
dec ecx
je 0x50fd02
xor eax, eax
jmp 0x50fdc7
test byte [eax + 0x14c], 1
je 0x50fcfb
mov edi, dword [ebp + 0xc]
push edi
push 0
push dword [ebp + 8]
call fcn.005d2a00
mov eax, dword [esi + 4]
add esp, 0xc
add dword [eax + 0x1c], edi
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
cmp ecx, edx
ja 0x50fd31
mov ecx, edx
mov dword [eax + 0x20], ecx
xor eax, eax
inc eax
jmp 0x50fdc7
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
push 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
jmp 0x50fdc7
mov ecx, dword [eax + 0x130]
test ecx, ecx
je 0x50fcfb
push dword [eax + 0x14c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
jmp 0x50fdc7
cmp byte [eax + 0x129], 0
mov edi, dword [ebp + 0xc]
mov edx, dword [eax + 0x1c]
je 0x50fd88
mov ecx, dword [eax + 0x20]
jmp 0x50fd8b
mov ecx, dword [eax + 0x18]
sub ecx, edx
cmp ecx, edi
jae 0x50fd93
mov edi, ecx
test edi, edi
jbe 0x50fdb0
mov eax, dword [eax + 0x14]
push edi
add eax, edx
push eax
push dword [ebp + 8]
call dword [0x6a2224]
mov eax, dword [esi + 4]
add esp, 0xc
add dword [eax + 0x1c], edi
mov eax, edi
jmp 0x50fdc7
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005d1068
add esp, 0x10
pop edi
pop esi
leave
ret 8
Function at 0x51009f
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esi], ebx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x10]
dec ecx
je 0x510111
dec ecx
je 0x5100ff
dec ecx
je 0x5100e5
dec ecx
je 0x5100c5
dec ecx
je 0x510107
xor al, al
jmp 0x510135
cmp byte [eax + 0x129], bl
je 0x5100d6
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [edi + 4]
push ebx
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x510131
mov ecx, dword [eax + 0x140]
cmp ecx, ebx
je 0x5100c1
push esi
push dword [eax + 0x14c]
call ecx
test eax, eax
setne al
jmp 0x510135
cmp byte [eax + 0x129], bl
je 0x51010c
mov eax, dword [eax + 0x20]
jmp 0x510131
mov eax, dword [eax + 0x18]
jmp 0x510131
cmp byte [eax + 0x129], bl
je 0x510122
push dword [eax + 8]
call fcn.005d31e0
pop ecx
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push dword [eax + 0x10]
call fcn.005d3156
pop ecx
mov dword [esi], eax
mov al, 1
pop edi
pop esi
pop ebx
ret 4

Function at 0x51014d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp byte [eax + 0x129], 0
je 0x51017b
mov ecx, dword [eax + 0x10]
dec ecx
je 0x510247
dec ecx
je 0x510202
dec ecx
je 0x5101de
dec ecx
je 0x5101a3
dec ecx
je 0x510182
xor al, al
jmp 0x510263
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
add dword [eax + 0x1c], ecx
mov edi, dword [edi + 4]
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
cmp eax, ecx
ja 0x51019b
mov eax, ecx
mov dword [edi + 0x20], eax
jmp 0x510243
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
imul esi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push 0
push ecx
push esi
push dword [ebp + 8]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [ebp - 4], esi
jne 0x5101d7
test al, al
je 0x5101d7
xor eax, eax
inc eax
jmp 0x510263
xor eax, eax
jmp 0x510263
mov ecx, dword [eax + 0x134]
test ecx, ecx
je 0x51017b
push dword [eax + 0x14c]
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call ecx
test eax, eax
setne al
jmp 0x510263
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
imul esi, dword [ebp + 0x10]
lea edx, [ecx + esi]
cmp edx, dword [eax + 0x18]
jae 0x51017b
mov eax, dword [eax + 0x14]
push esi
push dword [ebp + 8]
add eax, ecx
push eax
call dword [0x6a2224]
mov eax, dword [edi + 4]
add esp, 0xc
add dword [eax + 0x1c], esi
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
cmp ecx, edx
ja 0x510240
mov ecx, edx
mov dword [eax + 0x20], ecx
mov al, 1
jmp 0x510263
push dword [eax + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005d3346
sub eax, dword [ebp + 0x10]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc