joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568478
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
mov esi, dword [ebp + 8]
push 0x104
mov dword [ebp - 0x23c], esi
push eax
mov dword [ebp - 0x238], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, eax
cmp eax, 0x208
jae 0x4f9c2a
sub esp, 0x18
xor ecx, ecx
mov edx, esp
mov word [ebp + eax - 0x21c], cx
xor eax, eax
mov dword [ebp - 0x240], esp
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], 7
mov word [edx], ax
lea eax, [ebp - 0x21c]
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f9b63
sub eax, edi
mov ecx, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004079c0
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00484e80
mov dword [ebp - 4], 0
xor eax, eax
push 0xb
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 0
push str.msiexec.exe
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.004079c0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.00446980
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.00407c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00520c02
mov esp, ebp
pop ebp
ret 4
call fcn.005212a0
int3
Function at 0x4fa320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5685c8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
call fcn.004eaea0
test al, al
jne 0x4fa461
mov ecx, esi
call fcn.004eb2f0
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004eaea0
test al, al
jne 0x4fa461
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.0052a479
mov edi, eax
add esp, 4
and eax, 0xff000000
cmp eax, 0xd000000
je 0x4fa431
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x18], 8
mov ecx, dword [eax + 0x74]
mov eax, dword [ecx]
mov edx, dword [eax]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push edi
call edx
mov edx, eax
lea ecx, [ebp - 0x5c]
call fcn.00486950
mov ecx, eax
mov byte [ebp - 4], 2
mov eax, dword [ecx + 0x10]
add eax, eax
cmp dword [ecx + 0x14], 8
jb 0x4fa409
mov ecx, dword [ecx]
push 0
lea edx, [ebp - 0x64]
push edx
push eax
push ecx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00407c80
jmp 0x4fa44e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0052a479
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.004eb2f0
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.004eaea0
test al, al
je 0x4fa397
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00407c80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00407c80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00520c02
mov esp, ebp
pop ebp
ret 4

Function at 0x4fac20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568780
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4fac7d
mov dword [ebp - 4], 0
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x4fac6f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x509e70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
cmp dword [ebp + 8], 0
je 0x50a029
push ebx
mov ebx, dword [esp + 0x1c]
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x24], eax
jb 0x509e9a
mov esi, dword [ebx]
lea edi, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x509eb9
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x509ea8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
and eax, edx
mov ebp, dword [ebp + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [esp + 0x1c], edx
mov esi, edx
mov dword [esp + 0x10], eax
nop word [eax + eax]
cmp edx, ebp
jne 0x509ee8
mov eax, ebp
jmp 0x509eec
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x509f58
cmp dword [ebx + 0x14], 8
lea edi, [esi + 8]
mov edx, ebx
jb 0x509efd
mov edx, dword [ebx]
cmp dword [edi + 0x14], 8
mov ecx, edi
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
jb 0x509f0e
mov ecx, dword [edi]
cmp eax, dword [esp + 0x24]
jne 0x509f21
push eax
call fcn.00406f00
add esp, 4
test eax, eax
je 0x509f2d
mov esi, dword [esi]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
jmp 0x509ee0
cmp dword [edi + 0x14], 8
jb 0x509f35
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x509f3d
mov ebx, dword [ebx]
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x14]
jne 0x509f58
push eax
mov edx, edi
mov ecx, ebx
call fcn.00406f00
add esp, 4
test eax, eax
je 0x509f5a
mov esi, ebp
pop ebx
cmp esi, ebp
je 0x50a029
mov edi, dword [esp + 0x1c]
add esi, 0x20
cmp edi, esi
je 0x509f83
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x509f78
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.004079c0
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
cmp ecx, eax
je 0x509f9f
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x509f98
mov eax, dword [eax]
push edx
push eax
call fcn.004079c0
lea eax, [esi + 0x30]
lea ecx, [edi + 0x30]
cmp ecx, eax
je 0x509fbb
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x509fb4
mov eax, dword [eax]
push edx
push eax
call fcn.004079c0
mov eax, dword [esi + 0x48]
lea ecx, [edi + 0x50]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
lea eax, [esi + 0x50]
cmp ecx, eax
je 0x509fe3
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x509fdc
mov eax, dword [eax]
push edx
push eax
call fcn.004079c0
lea eax, [esi + 0x68]
lea ecx, [edi + 0x68]
cmp ecx, eax
je 0x509fff
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x509ff8
mov eax, dword [eax]
push edx
push eax
call fcn.004079c0
sub esi, 0xffffff80
lea ecx, [edi + 0x80]
cmp ecx, esi
je 0x50a01e
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x50a017
mov esi, dword [esi]
push eax
push esi
call fcn.004079c0
pop edi
pop esi
mov al, 1
pop ebp
add esp, 8
ret 0xc
pop edi
pop esi
xor al, al
pop ebp
add esp, 8
ret 0xc
Function at 0x50ed00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 0
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x50ed31
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x50ed20
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x50f9d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d636
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x10]
lea ecx, [esi + 8]
mov dword [ebp + 8], esi
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi], eax
mov al, byte [edi + 0x14]
mov byte [esi + 4], al
lea eax, [edi + 0x18]
push eax
call fcn.0050faf0
mov dword [ebp - 4], 0
movq xmm0, qword [edi + 0x24]
movq qword [esi + 0x14], xmm0
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x1c], eax
movq xmm0, qword [edi + 0x30]
movq qword [esi + 0x20], xmm0
mov eax, dword [edi + 0x38]
mov dword [esi + 0x28], eax
movq xmm0, qword [edi + 0x3c]
movq qword [esi + 0x2c], xmm0
mov eax, dword [edi + 0x44]
mov dword [esi + 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x512ac0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x512cdb
cmp eax, 0x7c
je 0x512cdb
cmp eax, 0x29
jne 0x512b01
cmp dword [esi + 0x10], 0
jne 0x512cdb
cmp eax, eax
jne 0x512b01
test dword [esi + 0x50], 0x10000000
je 0x512ce8
jmp 0x512c94
cmp eax, 0x2e
jne 0x512b60
push 5
lea ecx, [esi + 0x24]
call fcn.00512d40
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x512b54
cmp word [eax], 0x5c
jne 0x512b4f
lea ecx, [eax + 2]
cmp ecx, edx
je 0x512b4f
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x512b3b
movzx edi, word [ecx]
cmp edi, 0x28
je 0x512b4d
cmp edi, 0x29
je 0x512b4d
test dl, 0x10
jne 0x512b4f
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x512b4d
cmp edx, 0x7d
jne 0x512b4f
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.00510c90
jmp 0x512cc6
cmp eax, 0x5c
jne 0x512bbf
mov ecx, esi
call fcn.00512a70
test byte [esi + 0x50], 0x80
je 0x512bb3
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x512b91
push 4
lea ecx, [esi + 0x24]
call fcn.00512d40
mov ecx, esi
call fcn.00512a70
jmp 0x512ccd
cmp eax, 0x42
jne 0x512bb3
push 4
lea ecx, [esi + 0x24]
call fcn.00512d40
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00512a70
jmp 0x512ccd
mov ecx, esi
call fcn.00513e40
jmp 0x512cc6
cmp eax, 0x5b
jne 0x512c20
mov ecx, esi
call fcn.00512a70
lea ecx, [esi + 0x24]
call fcn.005156c0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x512bec
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00512a70
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x512c0a
cmp eax, 0x5d
jne 0x512c0a
push eax
lea ecx, [esi + 0x24]
call fcn.00515790
mov ecx, esi
call fcn.00512a70
mov ecx, esi
call fcn.00515250
cmp dword [esi + 0x4c], 0x5d
jne 0x512cef
jmp 0x512cbf
cmp eax, 0x28
jne 0x512c50
mov ecx, esi
call fcn.00512a70
mov ecx, esi
call fcn.00514020
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x512ce8
mov ecx, esi
call fcn.00512a70
test bl, bl
je 0x512ccd
jmp 0x512cc6
cmp eax, 0x5e
jne 0x512c68
push 2
lea ecx, [esi + 0x24]
call fcn.00512d40
mov ecx, esi
call fcn.00512a70
jmp 0x512ccd
cmp eax, 0x24
jne 0x512c80
push 3
lea ecx, [esi + 0x24]
call fcn.00512d40
mov ecx, esi
call fcn.00512a70
jmp 0x512ccd
cmp eax, 0x2a
je 0x512ce1
cmp eax, 0x2b
je 0x512ce1
cmp eax, 0x3f
je 0x512ce1
cmp eax, 0x7b
je 0x512ce1
cmp eax, 0x7d
jne 0x512ca4
test dword [esi + 0x50], 0x10000000
je 0x512cf6
jmp 0x512cb2
cmp eax, 0x5d
jne 0x512cb2
test dword [esi + 0x50], 0x10000000
je 0x512cef
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00514290
mov ecx, esi
call fcn.00512a70
mov ecx, esi
call fcn.00514130
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x512ad3
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.00510c80
push 5
call fcn.00510c80
push 4
call fcn.00510c80
push 6
call fcn.00510c80
int3
Function at 0x5185a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x24c], eax
add eax, eax
cmp eax, 0x208
jae 0x518805
sub esp, 0x18
xor ecx, ecx
mov edx, esp
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x25c], esp
mov dword [edx + 0x10], ecx
lea ecx, [ebp - 0x218]
mov dword [edx + 0x14], 7
lea esi, [ecx + 2]
mov word [edx], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x518620
sub ecx, esi
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.004079c0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00484e80
mov dword [ebp - 4], 1
xor eax, eax
push 7
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 0
push str.msi.dll
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.004079c0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00446980
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00407c80
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x248]
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x258]
sar eax, 1
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x230]
push eax
call fcn.00485a90
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x51871a
mov eax, dword [eax]
mov esi, dword [sym.imp.msi.dll_MsiMessageBoxW]
lea ecx, [ebp - 0x24c]
push 0
push 0
push ecx
push 0
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.00407c80
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x258]
inc eax
push ecx
push eax
call fcn.0048e5a0
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00485a90
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x518777
mov eax, dword [eax]
push 0
push 0
lea ecx, [ebp - 0x24c]
push ecx
push edi
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.00407c80
mov esi, dword [ebp - 0x24c]
xor edx, edx
mov edi, dword [ebp - 0x258]
xor eax, eax
cmp eax, esi
jae 0x5187c2
movzx ecx, word [edi + eax*2]
cmp ecx, 0x2e
je 0x5187bc
lea edx, [edx + edx*4]
add edx, edx
add edx, 0xffffffd0
add edx, ecx
inc eax
cmp eax, 3
jb 0x5187a5
lea esi, [edx + edx*4]
add esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x258]
call fcn.0048e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00407c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00520c02
mov esp, ebp
pop ebp
ret
call fcn.005212a0
int3
Function at 0x519570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], 0
lea esi, [ecx + 2]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5195e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004079c0
mov dword [ebp - 4], 1
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x519631
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x519620
mov eax, dword [ebx + 0x4c]
and eax, edx
mov edx, dword [ebx + 0x40]
mov ebx, dword [ebx + 0x38]
mov dword [ebp - 0x38], edx
mov ecx, dword [edx + eax*8]
lea eax, [eax*8 + 4]
mov dword [ebp - 0x34], ecx
mov esi, ecx
mov dword [ebp - 0x3c], eax
cmp ecx, ebx
jne 0x519659
mov eax, ebx
jmp 0x51965e
mov eax, dword [eax + edx]
mov eax, dword [eax]
cmp esi, eax
je 0x5196c9
cmp dword [ebp - 0x14], 8
lea edi, [esi + 8]
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
mov ecx, edi
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x40], eax
jb 0x519680
mov ecx, dword [edi]
cmp eax, dword [ebp - 0x18]
jne 0x519692
push eax
call fcn.00406f00
add esp, 4
test eax, eax
je 0x51969f
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
jmp 0x519651
cmp dword [edi + 0x14], 8
jb 0x5196a7
mov edi, dword [edi]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x40]
jne 0x5196c9
push eax
mov edx, edi
call fcn.00406f00
add esp, 4
test eax, eax
je 0x5196cb
mov esi, ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c80
mov eax, dword [ebp - 0x44]
cmp esi, dword [eax + 0x38]
jne 0x519701
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], 1
jmp 0x51971e
mov ecx, dword [ebp - 0x2c]
add esi, 0x20
push esi
call fcn.00406d00
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00520c02
mov esp, ebp
pop ebp
ret 8
Function at 0x51a8a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56eaf8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov ebx, ecx
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x51a9cb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x51a9dd
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push 0x5c
push dword [ebx]
call fcn.0052266c
add esp, 8
or edi, 0xffffffff
test eax, eax
je 0x51a99e
sub eax, dword [ebx]
sar eax, 1
cmp eax, edi
je 0x51a99e
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040ba30
mov byte [ebp - 4], 2
lea ebx, [esi - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x51a980
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x51a971
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x51a971
call fcn.0040be70
mov dword [ebp - 0x14], eax
mov ecx, edi
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x51a969
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x14]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
jmp 0x51a980
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.004143c0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x51a99e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi - 0xc], 0
je 0x51a9af
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.0051a6a0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x51a9cb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004143a0
int3
Function at 0x51c700
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [0x5d0074]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x51c737
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00520c02
add esp, 0x20
ret
push esi
push 0x14
push 0x595838
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x51c794
lea eax, [esp + 8]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x51c791
cmp dword [esp + 0xc], 4
je 0x51c7ab
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x51c7ab
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00520c02
add esp, 0x20
ret
push esi
call edi
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
pop edi
xor ecx, esp
call fcn.00520c02
add esp, 0x20
ret

Function at 0x51fd56
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x51fd7b
xor eax, eax
jmp 0x51fdd7
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x51fda8
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x51fda8
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x51fe5c
cmp dword [edi + 0x4c], 0
je 0x51fdd1
mov ecx, edi
call fcn.0051f9ab
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x51fde7
push dword [edi + 0x4c]
push ebx
call fcn.0051f5e5
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x51fdd6
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00520c02
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x57129c]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x51fdd1
cmp eax, 1
jle 0x51fe2f
cmp eax, 3
jne 0x51fdd1
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x51fdc3
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x51fe4c
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0052e8e1
add esp, 0x10
cmp esi, eax
jne 0x51fdd1
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x51fdd1
mov ax, bx
jmp 0x51fdd6

Function at 0x537efb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00537bbe
Function at 0x537f06
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00537d3f