joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bedc5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5beedd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5beedd
mov eax, dword [esi + 0x3c]
push eax
call fcn.005f591a
mov esi, eax
test esi, esi
je 0x5beedd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x5beedd
mov ecx, esi
call fcn.005bed50
cmp edi, eax
jge 0x5beedd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x5bee63
mov dword [esp + 0x34], 1
jmp 0x5beebe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x5beedd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.005be300
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x5c5dad
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x603e78
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x5c5dc3
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.005cb230
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.005cb5a0
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.005c5e30
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x6f5b70
call fcn.005cb430
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x5cac60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x5cacac
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x5cacac
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x5cac96
push eax
call ebp
test ax, ax
jl 0x5caca4
inc esi
add edi, 4
cmp esi, 6
jb 0x5cac88
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.005ca960
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5cea60
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x5ceac0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x5ceac0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x5ceac0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x5ceac0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x5cead0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x5d1ff0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x71db84]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5d2003
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5d2044
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x71dc2c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5d2076
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d207a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5d206b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5d2098
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d209c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5d208d
xor ecx, ecx
mov eax, 0x71db94
xor ebx, ebx
mov bl, byte [ecx + 0x71dc3c]
cmp byte [esp + ebx + 0x14], 0
je 0x5d20c7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x71dc54]
cmp byte [esp + ebx + 0x14], 0
je 0x5d20de
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5d20ae
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5d2037
lea edx, [esp + 0x84]
push edx
call fcn.005d2120
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5d3a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x5d3a86
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x5d3a86
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x5d3a67
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x5d4280
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x5d42b8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x5d4f50
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.005d50a0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x5d4f70
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x5d4f51
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.005d50a0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x5d4f70
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x5d4fa0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x5d4ff7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x5d500d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.005d5030
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x5d5030
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x5d50c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x5d5109
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x5d5750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6045f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005d5130
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005d51b0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005d51b0
lea ecx, [esi + 0xc]
call fcn.005f3e7b
lea ecx, [esi + 0x10]
call fcn.005f3e7b
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005d7d30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005d7d30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005d7d30
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005f3ef0
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005f3ef0
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x5d6578
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x604818
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x5d6588
call fcn.005d6aa0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x5d666b
cmp byte [edi], 0
je 0x5d666b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x5d65ad
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.005d4f50
test eax, eax
jne 0x5d65cd
push 0x71f960
lea ecx, [esi + 0x38]
call fcn.005f402d
jmp 0x5d666b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.005d4fa0
test eax, eax
jne 0x5d65fc
mov ecx, esi
call fcn.005d50a0
push edi
add esi, 0x38
push 0x71f93c
push esi
call fcn.005f1529
add esp, 0xc
jmp 0x5d666b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.005d7320
test eax, eax
je 0x5d6664
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.005d6740
test eax, eax
jne 0x5d6680
push edi
lea eax, [esi + 0x38]
push 0x71f918
push eax
call fcn.005f1529
add esp, 0xc
mov ecx, esi
call fcn.005d6aa0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5d6728
mov ecx, dword [0x7200e8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.005f1529
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.005d5050
test eax, eax
jne 0x5d66ea
push 0x71f8fc
lea ecx, [esi + 0x38]
call fcn.005f402d
jmp 0x5d66fa
push 0xfa
mov ecx, esi
call fcn.005d7320
test eax, eax
jne 0x5d6717
mov ecx, esi
call fcn.005d6aa0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.005f3ef0
jmp 0x5d666b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.005f3ef0
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x5d8a50
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, dword [esp + 0x110]
push esi
call fcn.005d4b20
add esp, 4
test eax, eax
jne 0x5d8adb
cmp byte [esi + 1], 0x3a
jne 0x5d8a79
mov al, byte [esi + 2]
test al, al
je 0x5d8a88
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push esi
call ebx
test eax, eax
je 0x5d8a96
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5d8ab1
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
cmp eax, 3
jne 0x5d8adb
push 0x5c
push esi
call fcn.005e3f44
add esp, 8
test eax, eax
je 0x5d8adb
mov cl, byte [eax + 1]
test cl, cl
jne 0x5d8aea
dec eax
cmp eax, esi
jb 0x5d8adb
cmp byte [eax], 0x5c
je 0x5d8ae6
dec eax
cmp eax, esi
jae 0x5d8ad1
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
cmp eax, esi
jb 0x5d8adb
test eax, eax
je 0x5d8adb
push edi
mov edi, eax
sub edi, esi
lea eax, [esp + 0xc]
push edi
push esi
push eax
call fcn.005e518a
lea ecx, [esp + 0x18]
mov byte [esp + edi + 0x18], 0
push ecx
call fcn.005d8a50
add esp, 0x10
test eax, eax
pop edi
je 0x5d8adb
push 0
push esi
call ebx
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x5da530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x604c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005da0f0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.005da160
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.005da460
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.005da110
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x5dbf10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x5dbf2b
cmp ebx, 8
jg 0x5dbf2b
mov eax, 1
jmp 0x5dbf2d
xor eax, eax
mov esi, dword [esp + 0x14]
push str.bad_pack_level
push eax
push esi
call fcn.005da790
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x5dbf64
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x6f7cda]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x6f7cd8]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x6f7cdc]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x6f7cde]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x5dbfc5
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x5dbfd1
cmp ebx, 8
jl 0x5dbfd1
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x5dc04a
cmp eax, 0xffffffff
je 0x5dc04a
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x5dc015
push esi
call fcn.005dc260
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x5dc01d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5dd2e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5dd2eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5dd3ee
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x6f7d28]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6f7d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6f7d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6f7d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6f7d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6f7d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6f7d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x6f7d28]
xor eax, edx
inc ecx
dec edi
jne 0x5dd306
pop edi
test esi, esi
je 0x5dd410
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x6f7d28]
xor eax, edx
inc ecx
dec esi
jne 0x5dd3f2
pop esi
pop ebx
not eax
ret
Function at 0x5dd5d0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x5dd5ee
mov eax, 0x1000000
pop esi
add esp, 0x50
ret
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x5dd608
mov eax, 0x200
pop esi
add esp, 0x50
ret
mov eax, dword [esp + 0x20]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x5dd61c
mov ebp, 1
test al, 2
je 0x5dd623
or ebp, 2
test al, 4
je 0x5dd62a
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x5dd634
or ebp, 0x10
test al, 0x20
je 0x5dd63b
or ebp, 0x20
test ecx, ecx
je 0x5dd647
or ebp, 0x40000000
jmp 0x5dd64d
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x5dd65d
or ebp, 0x800000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x5dd70b
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x6c]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x64], 0x54ad
jne 0x5dd70b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x5dd70b
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x2c]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x5dd705
cmp eax, 0x454e
je 0x5dd705
cmp eax, 0x454c
je 0x5dd705
cmp eax, 0x4550
jne 0x5dd70b
or ebp, 0x400000
mov eax, dword [esp + 0x68]
pop ebx
test eax, eax
je 0x5dd716
mov dword [eax], ebp
mov eax, dword [esp + 0x68]
test eax, eax
je 0x5dd724
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov esi, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test esi, esi
je 0x5dd78e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push edx
call edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.005dd510
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.005dd510
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.005dd510
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x70]
test esi, esi
je 0x5dd7d1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x64]
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
and edx, 0xffff
and eax, 0xffff
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x5dd9b0
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x5dda00
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x5dd9dc
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x5dda28
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x5dde50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x5ddeba
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x5ddf0b
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x5dde76
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.005dd2e0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x5ddf04
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5ddf0b
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.005dd2e0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x5e5144
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5e5164
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005e42aa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5e5187
test byte [esp + 8], 2
je 0x5e5187
call fcn.005e431d
mov dword [eax], 0xd
call fcn.005e4326
mov dword [eax], 5
jmp 0x5e5160
xor eax, eax
ret