joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554734
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x55473c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x554889
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x554792
lea edx, [ebp - 4]
mov eax, dword [0x7a8024]
call fcn.004073b4
cmp ebx, 1
jbe 0x5547c9
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5548a0
call fcn.0040b5bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405584
jmp 0x5547c9
lea eax, [ebp - 4]
mov edx, 0x5548b0
call fcn.00405354
cmp ebx, 1
jbe 0x5547c9
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5548c0
call fcn.0040b5bc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00405584
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 0x18]
call fcn.0040577c
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x554851
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x554801
mov bl, 1
jmp 0x554861
push 0
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040db54
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x7a8938]
call fcn.004073b4
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.0054bce8
mov eax, dword [ebp - 0x1c]
mov cx, word [0x5548c4]
xor edx, edx
call fcn.004375a0
mov bl, 2
jmp 0x554861
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00405310
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554890
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004052e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052e0
ret

Function at 0x554ec8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x554eea
mov edx, ebx
mov eax, dword [0x7a8934]
call fcn.004073b4
jmp 0x554f21
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x554f1a
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
add byte [eax], al
add al, ch
adc al, 6
jmp 0x554f17
jmp 0x554f21
mov eax, ebx
call fcn.004052bc
add esp, 0x160
pop esi
pop ebx
ret
Function at 0x555930
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x555963
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x55595c
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040576c
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x401120]
call fcn.00405f28
xor eax, eax
push ebp
push 0x555af1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x555ab9
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x555b18
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040563c
mov eax, dword [ebp - 0x158]
call fcn.0040577c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x555aad
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x555a92
test al, 2
jne 0x555a92
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x555b18
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.0040552c
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040563c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.0054a898
call fcn.00418934
test al, al
je 0x555a50
or edi, 0xffffffff
jmp 0x555a5f
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0054aa34
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0054a7fc
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.0040552c
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x5559e5
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x5559a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555af8
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.004052e0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x401120]
call fcn.00405de8
lea eax, [ebp - 4]
call fcn.004052bc
ret

Function at 0x556c48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x556cca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x700f0037
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00556da0
mov eax, dword [ebp - 8]
call fcn.00554a80
test al, al
je 0x556c9b
mov eax, dword [ebp - 8]
call fcn.0040577c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x556c9b
and dword [ebp - 4], 0xfffbffff
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x400]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556cd1
lea eax, [ebp - 8]
call fcn.004052bc
ret
Function at 0x556cf0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x14], 0
jne 0x556d3b
push 0x208
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.00556c24
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x556d3b
lea eax, [esp + 0xc]
call fcn.0040ae90
mov ecx, eax
lea edx, [esp + 0xc]
lea eax, [ebx + 0x14]
call fcn.004053ac
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00405310
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x55a7a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x55a803
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040577c
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x55a7db
dec eax
jne 0x55a7ed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov si, 0xff9f
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a80a
lea eax, [ebp - 4]
call fcn.004052bc
ret

Function at 0x55a810
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55a8bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e8], 0
jne 0x55a85e
push 0x465
mov eax, dword [ebp - 4]
call fcn.00478884
mov ecx, eax
mov dl, 1
mov eax, dword [0x556f34]
call fcn.00556fa0
mov edx, dword [ebp - 4]
mov dword [edx + 0x3e8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00557468
lea eax, [ebp - 8]
mov edx, 0x55a8d4
call fcn.00405354
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x55a8a9
test bl, 1
je 0x55a8a2
lea eax, [ebp - 8]
call fcn.004057d4
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.0055a7a4
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x55a886
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a8c6
lea eax, [ebp - 8]
call fcn.004052bc
ret
Function at 0x55b530
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x55b64e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55b621
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040577c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x55b5fe
test byte [ebp - 0x14c], 0x10
jne 0x55b5e1
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040552c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00409ae0
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x55b5a4
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x55b60a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b628
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5613fc
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x56140a
je 0x56140f
jmp 0x561434
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x56142f
lea eax, [ebx + 8]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
mov eax, dword [0x7a87cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x5671d8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x5671f4
cmp dword [esi + 4], 0
je 0x567221
test byte [ebx + 0x55], 1
jne 0x567213
mov eax, ebx
call fcn.004755b4
test eax, eax
jne 0x567213
mov edx, esi
mov eax, ebx
call fcn.0047a5d8
jmp 0x567315
mov edx, esi
mov eax, ebx
call fcn.00476538
jmp 0x567315
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd4]
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x56730e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00478884
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.00473130
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.005671d8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00478884
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567315
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x569534
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x569585
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040577c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x569569
test al, 1
jne 0x56956d
xor ebx, ebx
jmp 0x56956f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56958c
lea eax, [ebp - 4]
call fcn.004052bc
ret

Function at 0x5853ec
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x58540d
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x58540d
xor eax, eax
ret
mov al, 1
ret
Function at 0x592d58
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x592d88
mov eax, ebx
call fcn.0059387c
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x592d81
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x592e00
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x592df2
mov edx, dword [ebx + 8]
test edx, edx
je 0x592dae
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x592dc0
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x592df2
mov edx, dword [ebx + 8]
test edx, edx
je 0x592da0
cmp eax, 3
je 0x592dd4
dec eax
jne 0x592da0
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x592da0
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x592da0
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x592e20
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x592e20
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00592e2c
pop ebx
ret
Function at 0x5baa60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x70470c
test edx, edx
jne 0x5baa70
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x5bab38
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x5baa7c
test ecx, ecx
je 0x5bab55
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x5bab3c
xor eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x5bfce8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x5bfe75
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x5bfd39
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x5bfd4a
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x5bfd60
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x5bfd82
mov ebx, dword [ecx]
test ebx, ebx
jg 0x5bfd76
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x5bfd7a
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x5bfd6a
test di, di
je 0x5bfe75
mov dl, byte [eax + 9]
sub dl, 2
je 0x5bfdab
sub dl, 2
je 0x5bfdcb
sub dl, 4
je 0x5bfe05
sub dl, 8
je 0x5bfe29
jmp 0x5bfe75
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x5bfe75
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x5bfdbb
jmp 0x5bfe75
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x5bfe75
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x5bfdf5
jmp 0x5bfe75
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x5bfe75
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x5bfe15
jmp 0x5bfe75
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x5bfe75
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x5bfe40
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d3144
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
test dl, dl
je 0x5d3169
add esp, 0xfffffff0
call fcn.0040480c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5d324e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7a83dc]
cmp dword [eax], 0
jne 0x5d31d3
lea eax, [ebp - 0x105]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040552c
mov eax, dword [ebp - 0x210]
call fcn.0061e328
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x5d3274
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x5d31f3
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x5d3274
mov eax, dword [0x7a83dc]
mov eax, dword [eax]
call fcn.0040577c
push eax
call sub.kernel32.dll_GetTempFileNameA
push 0xffff
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040552c
mov ecx, dword [ebp - 0x214]
xor edx, edx
mov eax, esi
call fcn.0041ee50
lea eax, [esi + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040552c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3255
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.004052e0
ret

Function at 0x5ea1c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov ecx, dword [edx]
mov eax, ecx
movzx eax, word [eax]
cmp eax, esi
jbe 0x5ea1eb
mov eax, ecx
movzx esi, word [eax + 2]
xor esi, 1
mov eax, dword [eax + 8]
mov dword [edx], eax
jmp 0x5ea1f9
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx esi, word [eax + 2]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov edx, dword [ebx + 8]
test edx, edx
jne 0x5ea2c8
mov ecx, dword [ebx + 0x20]
test ecx, ecx
jne 0x5ea2bb
mov eax, dword [ebx + 0x18]
test byte [eax + 8], 7
jne 0x5ea268
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x5ea23b
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x5ea23b
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x5ea26b
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x5ea254
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.005f123c
mov edi, eax
jmp 0x5ea26b
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x5ea26b
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5ea27c
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x5ea2ad
cmp edi, 0x8f
jle 0x5ea29f
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x5ea2c8
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x5ea2c8
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x5ea2c8
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x5ea1f9
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ea2e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, edx
movzx ecx, word [eax]
mov eax, dword [ebx + 4]
cmp ecx, eax
ja 0x5ea314
mov eax, edx
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 8]
xor esi, 1
mov dword [edx], eax
jmp 0x5ea32b
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x5ea3fa
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x5ea3ed
mov edx, dword [ebx + 0x18]
test byte [edx + 8], 7
jne 0x5ea39a
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x5ea36d
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x5ea36d
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x5ea39d
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x5ea386
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.005f123c
mov edi, eax
jmp 0x5ea39d
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x5ea39d
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5ea3ae
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x5ea3df
cmp edi, 0x8f
jle 0x5ea3d1
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x5ea3fa
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x5ea3fa
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x5ea3fa
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x5ea32b
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x61e304
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040577c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x61e31d
test al, 0x10
jne 0x61e321
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret