joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8d78
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e8efa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004e916c
mov eax, ebx
call fcn.0042daf4
dec al
je 0x4e8dbc
dec al
je 0x4e8dc2
jmp 0x4e8dc8
mov byte [ebp - 0x77], 2
jmp 0x4e8dcc
mov byte [ebp - 0x77], 1
jmp 0x4e8dcc
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042da80
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4e8e19
cmp edi, 0x20000000
jne 0x4e8e25
mov dword [ebp - 0x88], 0x40000000
jmp 0x4e8e2f
mov eax, edi
call fcn.0042d318
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.0042dabc
test al, 1
je 0x4e8e41
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042dabc
test al, 2
je 0x4e8e53
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042dabc
test al, 4
je 0x4e8e65
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042dabc
test al, 8
je 0x4e8e77
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.0042da0c
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040d9fc
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.0042db24
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042d810
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x4e8ed4
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004e9198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8f01
lea eax, [ebp - 0x94]
call fcn.00405264
ret
Function at 0x4e9ea0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0x5619d4
xor eax, eax
push ebp
push 0x4ea026
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x589468], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ea009
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4ea034
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4e9efb
cmp dword [ebx], 0x20
jae 0x4e9efb
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4e9f27
push 0x4ea044
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4e9ff2
cmp dword [ebx], 0x20
jae 0x4e9ff2
xor eax, eax
mov dword [ebx], eax
jmp 0x4e9ff2
mov byte [0x589468], 2
lea eax, [ebp - 8]
mov edx, 0x4ea05c
call fcn.004052fc
lea eax, [ebp - 8]
call fcn.00405784
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405734
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4e9ff2
mov eax, ebx
call fcn.00402ecc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e9feb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405734
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4e9fd5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4ea06c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4e9fd5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov byte [0x589468], al
cmp byte [0x589468], 0
jne 0x4e9fd5
mov byte [0x589468], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9ff2
mov eax, dword [ebp - 0x10]
call fcn.00402efc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea010
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4ff85c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
call fcn.004ff828
cmp dword [0x5898fc], 0
jne 0x4ff878
cmp dword [0x5898f8], 0
je 0x4ff888
fld qword [ebp + 8]
fcomp dword [0x4ff928]
fnstsw ax
sahf
jbe 0x4ff8b2
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4ff896
call fcn.004ff828
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x4ff891
jmp 0x4ff91e
fld qword [ebp + 8]
fcomp dword [0x4ff92c]
fnstsw ax
sahf
jbe 0x4ff91e
fld qword [ebp + 8]
fdiv dword [0x4ff930]
fstp qword [ebp + 8]
wait
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
jmp 0x4ff913
call fcn.004ff828
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fild qword [0x5898f8]
fdivp st(1)
fstp xword [ebp - 0x10]
wait
fld xword [ebp - 0x10]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x4ff8e4
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ffa48
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x561d7c
mov esi, eax
cmp ecx, 1
jb 0x4ffb51
test edx, edx
jne 0x4ffa65
xor esi, esi
jmp 0x4ffb51
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4ffb2d
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x4ffa71
test ecx, ecx
je 0x4ffb4c
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x4ffb31
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret
Function at 0x503bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, eax
mov eax, dword [ebx + 0x60]
mov esi, eax
lea edi, [esp + 4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [esp + 0x14]
test edx, edx
jns 0x503be7
call fcn.00404334
xor ecx, ecx
mov eax, dword [ebx + 0x78]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x503c30
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x503c28
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x503204]
call fcn.00406548
inc edi
dec esi
jne 0x503c0f
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx esi, word [esp + 0xc]
test esi, esi
jle 0x503cad
mov edx, dword [0x503204]
mov eax, 0x3c
call fcn.00406534
mov dword [esp], eax
mov edx, dword [esp]
mov ecx, 0x2e
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esp]
movzx ecx, word [eax + 0x1c]
mov eax, dword [esp]
lea edx, [eax + 0x30]
mov eax, dword [ebx + 0x78]
call fcn.004ff760
mov eax, dword [esp]
movzx edx, word [eax + 0x1e]
mov cx, 1
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esp]
movzx ecx, word [eax + 0x20]
mov eax, dword [esp]
lea edx, [eax + 0x34]
mov eax, dword [ebx + 0x78]
call fcn.004ff760
mov eax, dword [esp]
mov edx, dword [eax + 0x30]
mov ecx, dword [esp]
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0x3c]
dec esi
jne 0x503c39
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
movzx edx, word [esp + 0xc]
cmp eax, edx
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x51a7d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x51a85f
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0xffffffffffffff80
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x51a841
push 0
lea eax, [ebp - 4]
push eax
push 0x80
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51a841
cmp dword [ebp - 4], 0x80
jne 0x51a841
lea eax, [ebp - 8]
mov edx, esi
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 8]
mov edx, 0x51a878
call fcn.00405680
je 0x51a845
xor eax, eax
jmp 0x51a847
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a866
lea eax, [ebp - 8]
call fcn.00405264
ret

Function at 0x51b398
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x51b44e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0xa
push ebx
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51b430
cmp dword [ebp - 4], 0xa
jne 0x51b430
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 8]
mov edx, 0x51b468
call fcn.00405680
jne 0x51b430
cmp byte [ebx + 4], 0xff
jae 0x51b430
cmp byte [ebx + 3], 2
jne 0x51b400
test byte [ebx + 5], 0x3f
je 0x51b418
cmp byte [ebx + 3], 3
jne 0x51b40c
test byte [ebx + 5], 0x1f
je 0x51b418
cmp byte [ebx + 3], 4
jne 0x51b430
test byte [ebx + 5], 0xf
jne 0x51b430
test byte [ebx + 6], 0x80
jne 0x51b430
test byte [ebx + 7], 0x80
jne 0x51b430
test byte [ebx + 8], 0x80
jne 0x51b430
test byte [ebx + 9], 0x80
je 0x51b434
xor eax, eax
jmp 0x51b436
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b455
lea eax, [ebp - 8]
call fcn.00405264
ret
Function at 0x51bce0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51beaf
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51be94
mov eax, dword [ebp - 4]
call fcn.0051bafc
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51be94
xor eax, eax
push ebp
push 0x51be8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 6
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51bd93
cmp dword [ebp - 0x10], 6
jne 0x51bd93
mov al, byte [ebp - 0x16]
add al, 0xbf
sub al, 0x1a
jb 0x51bd97
xor eax, eax
jmp 0x51bd99
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51be65
movzx esi, byte [ebp - 0x13]
shl esi, 0x10
xor eax, eax
mov al, byte [ebp - 0x12]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x11]
add esi, eax
test esi, esi
jbe 0x51be5d
lea edx, [esi + 1]
lea eax, [ebp - 0x1c]
call fcn.004058c0
mov eax, dword [ebp - 0x1c]
call fcn.00405534
push eax
lea eax, [ebp - 0x1c]
call fcn.0040578c
xor ecx, ecx
pop edx
call fcn.00403a38
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x1c]
call fcn.0040578c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51be1d
cmp esi, dword [ebp - 0x10]
je 0x51be21
xor eax, eax
jmp 0x51be23
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51be65
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.0051bb34
pop ecx
cmp edi, ebx
ja 0x51bd68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51be94
cmp byte [ebp - 5], 0
jne 0x51be8c
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51beb6
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405288
ret
Function at 0x51bec0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c099
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c07e
mov eax, dword [ebp - 4]
call fcn.0051bafc
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c07e
xor eax, eax
push ebp
push 0x51c077
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 0xa
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51bf73
cmp dword [ebp - 0x10], 0xa
jne 0x51bf73
mov al, byte [ebp - 0x1a]
add al, 0xbf
sub al, 0x1a
jb 0x51bf77
xor eax, eax
jmp 0x51bf79
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c04f
movzx esi, byte [ebp - 0x16]
shl esi, 0x18
xor eax, eax
mov al, byte [ebp - 0x15]
shl eax, 0x10
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x14]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x13]
add esi, eax
test esi, esi
jbe 0x51c047
lea edx, [esi + 2]
lea eax, [ebp - 0x20]
call fcn.004058c0
mov eax, dword [ebp - 0x20]
call fcn.00405534
push eax
lea eax, [ebp - 0x20]
call fcn.0040578c
xor ecx, ecx
pop edx
call fcn.00403a38
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x20]
call fcn.0040578c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51c007
cmp esi, dword [ebp - 0x10]
je 0x51c00b
xor eax, eax
jmp 0x51c00d
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c04f
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1a]
mov ecx, 4
call fcn.00405354
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0051bb34
pop ecx
cmp edi, ebx
ja 0x51bf48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c07e
cmp byte [ebp - 5], 0
jne 0x51c076
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c0a0
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405288
ret
Function at 0x52f0f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x52f117
mov ecx, edi
mov dl, 1
mov eax, dword [0x52decc]
call fcn.0052df30
mov dword [edi + 0x294], eax
jmp 0x52f220
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x52f158
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x52f14d
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.0052e6a0
jmp 0x52f18e
xor edx, edx
mov eax, edi
call fcn.0052e6a0
jmp 0x52f18e
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x52f185
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.0052e6a0
jmp 0x52f18e
mov dl, 0x64
mov eax, edi
call fcn.0052e6a0
cmp byte [edi + 0x22b], 0
je 0x52f1a0
cmp byte [edi + 0x22a], 0
je 0x52f1b2
cmp byte [edi + 0x22b], 0
jne 0x52f1bd
cmp byte [edi + 0x22a], 0x64
jne 0x52f1bd
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x52f1ed
mov eax, dword [0x56368c]
mov eax, dword [eax]
call fcn.0047b92c
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x52f1ed
cmp byte [edi + 0x224], 0
jne 0x52f1ed
cmp byte [edi + 0x2a0], 0
je 0x52f1bd
test bl, bl
jne 0x52f207
cmp byte [edi + 0x224], 0
jne 0x52f207
cmp byte [edi + 0x2a0], 0
je 0x52f119
cmp byte [edi + 0x2a0], 0
jne 0x52f219
cmp byte [edi + 0x224], 0
jne 0x52f220
mov eax, edi
call fcn.0052f514
pop edi
pop esi
pop ebx
ret

Function at 0x531994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x531a34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004052b8
mov eax, dword [ebp - 4]
call fcn.00405534
test eax, eax
jle 0x531a0a
mov dword [ebp - 8], eax
mov ebx, 1
mov eax, edi
call fcn.0040578c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [edi]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0x7ab8
add ax, 0x6a2f
mov esi, eax
inc ebx
dec dword [ebp - 8]
jne 0x5319d5
lea edx, [ebp - 0xc]
mov eax, dword [edi]
call fcn.0052099c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004052b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531a3b
lea eax, [ebp - 0xc]
call fcn.00405264
ret
Function at 0x53936c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5393ef
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5393d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00539318
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5393d9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x539be0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x539be8
push ebx
push esi
push edi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x539dca
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
call fcn.00403400
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0x41
jb 0x539d9a
cmp byte [ebp - 1], 0x5a
ja 0x539d9a
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.004038e4
mov edx, 0x539dd8
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.004038b4
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004054d8
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x539d9a
lea eax, [ebp - 0x1c]
call fcn.00499ac0
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov edx, 0x539de4
call fcn.0040d6dc
mov eax, dword [ebp - 8]
call fcn.0040d5b8
test al, al
jne 0x539c6a
push 0x539df4
push 0x539dfc
mov ecx, dword [0x564668]
mov dl, 1
mov eax, dword [0x41f1ac]
call fcn.00424634
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x539cdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00424430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539ce3
mov eax, dword [ebp - 0x10]
call fcn.004043f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539dd1
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405288
lea eax, [ebp - 0x1c]
call fcn.00405264
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405288
ret

Function at 0x539e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x539f12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x539e94
mov ebx, 3
jmp 0x539e99
mov ebx, 1
mov eax, dword [0x5631b4]
cmp byte [eax], 0
je 0x539ecb
push ebx
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00405c10
push eax
push 0x539f20
mov eax, dword [0x56368c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x539efc
push ebx
push 0
push 0
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
call fcn.004054fc
mov eax, dword [ebp - 4]
call fcn.00405734
push eax
push 0x539f2c
mov eax, dword [0x56368c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539f19
lea eax, [ebp - 4]
call fcn.00405264
ret
Function at 0x53a494
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405fd0
lea eax, [ebp + 0x14]
call fcn.00405fd0
lea eax, [ebp + 0x10]
call fcn.00405fd0
lea eax, [ebp + 0xc]
call fcn.00405fd0
xor eax, eax
push ebp
push 0x53a5b8
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x53a4e9
mov eax, esi
call fcn.00461bb0
mov ebx, eax
mov eax, dword [0x5631b4]
cmp byte [eax], 0
je 0x53a520
push edi
mov eax, dword [ebp + 0xc]
call fcn.00405c10
push eax
mov eax, dword [ebp + 0x10]
call fcn.00405c10
push eax
mov eax, dword [ebp + 0x14]
call fcn.00405c10
push eax
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
jmp 0x53a577
push edi
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.004054fc
mov eax, dword [ebp - 8]
call fcn.00405734
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004054fc
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x14]
call fcn.004054fc
mov eax, dword [ebp - 0x10]
call fcn.00405734
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004054fc
mov eax, dword [ebp - 0x14]
call fcn.00405734
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jg 0x53a588
mov ecx, eax
mov edx, dword [ebp + 0x14]
mov eax, esi
call fcn.0053a2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a5bf
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405288
lea eax, [ebp - 4]
call fcn.004059bc
lea eax, [ebp + 0xc]
mov edx, 3
call fcn.004059d4
ret