joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508cf0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
call fcn.00508cbc
cmp dword [0x58b2b0], 0
jne 0x508d0c
cmp dword [0x58b2ac], 0
je 0x508d1c
fld qword [ebp + 8]
fcomp dword [0x508dbc]
fnstsw ax
sahf
jbe 0x508d46
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x508d2a
call fcn.00508cbc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x508d25
jmp 0x508db2
fld qword [ebp + 8]
fcomp dword [0x508dc0]
fnstsw ax
sahf
jbe 0x508db2
fld qword [ebp + 8]
fdiv dword [0x508dc4]
fstp qword [ebp + 8]
wait
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
jmp 0x508da7
call fcn.00508cbc
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fild qword [0x58b2ac]
fdivp st(1)
fstp xword [ebp - 0x10]
wait
fld xword [ebp - 0x10]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x508d78
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x508edc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x562d90
mov esi, eax
cmp ecx, 1
jb 0x508fe5
test edx, edx
jne 0x508ef9
xor esi, esi
jmp 0x508fe5
xor eax, 0xffffffff
cmp ecx, 8
jb 0x508fc1
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x508f05
test ecx, ecx
je 0x508fe0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x508fc5
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret
Function at 0x50d054
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, eax
mov eax, dword [ebx + 0x60]
mov esi, eax
lea edi, [esp + 4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [esp + 0x14]
test edx, edx
jns 0x50d07b
call fcn.00404334
xor ecx, ecx
mov eax, dword [ebx + 0x78]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x50d0c4
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x50d0bc
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x50c698]
call fcn.00406548
inc edi
dec esi
jne 0x50d0a3
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx esi, word [esp + 0xc]
test esi, esi
jle 0x50d141
mov edx, dword [0x50c698]
mov eax, 0x3c
call fcn.00406534
mov dword [esp], eax
mov edx, dword [esp]
mov ecx, 0x2e
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esp]
movzx ecx, word [eax + 0x1c]
mov eax, dword [esp]
lea edx, [eax + 0x30]
mov eax, dword [ebx + 0x78]
call fcn.00508bf4
mov eax, dword [esp]
movzx edx, word [eax + 0x1e]
mov cx, 1
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esp]
movzx ecx, word [eax + 0x20]
mov eax, dword [esp]
lea edx, [eax + 0x34]
mov eax, dword [ebx + 0x78]
call fcn.00508bf4
mov eax, dword [esp]
mov edx, dword [eax + 0x30]
mov ecx, dword [esp]
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0x3c]
dec esi
jne 0x50d0cd
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
movzx edx, word [esp + 0xc]
cmp eax, edx
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x51ae88
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x51af13
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0xffffffffffffff80
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x51aef5
push 0
lea eax, [ebp - 4]
push eax
push 0x80
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51aef5
cmp dword [ebp - 4], 0x80
jne 0x51aef5
lea eax, [ebp - 8]
mov edx, esi
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 8]
mov edx, 0x51af2c
call fcn.00405680
je 0x51aef9
xor eax, eax
jmp 0x51aefb
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51af1a
lea eax, [ebp - 8]
call fcn.00405264
ret

Function at 0x51ba4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x51bb02
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0xa
push ebx
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51bae4
cmp dword [ebp - 4], 0xa
jne 0x51bae4
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 8]
mov edx, 0x51bb1c
call fcn.00405680
jne 0x51bae4
cmp byte [ebx + 4], 0xff
jae 0x51bae4
cmp byte [ebx + 3], 2
jne 0x51bab4
test byte [ebx + 5], 0x3f
je 0x51bacc
cmp byte [ebx + 3], 3
jne 0x51bac0
test byte [ebx + 5], 0x1f
je 0x51bacc
cmp byte [ebx + 3], 4
jne 0x51bae4
test byte [ebx + 5], 0xf
jne 0x51bae4
test byte [ebx + 6], 0x80
jne 0x51bae4
test byte [ebx + 7], 0x80
jne 0x51bae4
test byte [ebx + 8], 0x80
jne 0x51bae4
test byte [ebx + 9], 0x80
je 0x51bae8
xor eax, eax
jmp 0x51baea
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51bb09
lea eax, [ebp - 8]
call fcn.00405264
ret
Function at 0x51c394
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c563
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c548
mov eax, dword [ebp - 4]
call fcn.0051c1b0
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c548
xor eax, eax
push ebp
push 0x51c541
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 6
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51c447
cmp dword [ebp - 0x10], 6
jne 0x51c447
mov al, byte [ebp - 0x16]
add al, 0xbf
sub al, 0x1a
jb 0x51c44b
xor eax, eax
jmp 0x51c44d
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c519
movzx esi, byte [ebp - 0x13]
shl esi, 0x10
xor eax, eax
mov al, byte [ebp - 0x12]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x11]
add esi, eax
test esi, esi
jbe 0x51c511
lea edx, [esi + 1]
lea eax, [ebp - 0x1c]
call fcn.004058c0
mov eax, dword [ebp - 0x1c]
call fcn.00405534
push eax
lea eax, [ebp - 0x1c]
call fcn.0040578c
xor ecx, ecx
pop edx
call fcn.00403a38
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x1c]
call fcn.0040578c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51c4d1
cmp esi, dword [ebp - 0x10]
je 0x51c4d5
xor eax, eax
jmp 0x51c4d7
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c519
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 3
call fcn.00405354
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.0051c1e8
pop ecx
cmp edi, ebx
ja 0x51c41c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c548
cmp byte [ebp - 5], 0
jne 0x51c540
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c56a
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405288
ret
Function at 0x51c574
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c74d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c732
mov eax, dword [ebp - 4]
call fcn.0051c1b0
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51c732
xor eax, eax
push ebp
push 0x51c72b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 0xa
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51c627
cmp dword [ebp - 0x10], 0xa
jne 0x51c627
mov al, byte [ebp - 0x1a]
add al, 0xbf
sub al, 0x1a
jb 0x51c62b
xor eax, eax
jmp 0x51c62d
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c703
movzx esi, byte [ebp - 0x16]
shl esi, 0x18
xor eax, eax
mov al, byte [ebp - 0x15]
shl eax, 0x10
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x14]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x13]
add esi, eax
test esi, esi
jbe 0x51c6fb
lea edx, [esi + 2]
lea eax, [ebp - 0x20]
call fcn.004058c0
mov eax, dword [ebp - 0x20]
call fcn.00405534
push eax
lea eax, [ebp - 0x20]
call fcn.0040578c
xor ecx, ecx
pop edx
call fcn.00403a38
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x20]
call fcn.0040578c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51c6bb
cmp esi, dword [ebp - 0x10]
je 0x51c6bf
xor eax, eax
jmp 0x51c6c1
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x51c703
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1a]
mov ecx, 4
call fcn.00405354
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0051c1e8
pop ecx
cmp edi, ebx
ja 0x51c5fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c732
cmp byte [ebp - 5], 0
jne 0x51c72a
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c754
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405288
ret
Function at 0x52fb28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x52fb4f
mov ecx, edi
mov dl, 1
mov eax, dword [0x52e904]
call fcn.0052e968
mov dword [edi + 0x294], eax
jmp 0x52fc58
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x52fb90
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x52fb85
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.0052f0d8
jmp 0x52fbc6
xor edx, edx
mov eax, edi
call fcn.0052f0d8
jmp 0x52fbc6
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x52fbbd
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.0052f0d8
jmp 0x52fbc6
mov dl, 0x64
mov eax, edi
call fcn.0052f0d8
cmp byte [edi + 0x22b], 0
je 0x52fbd8
cmp byte [edi + 0x22a], 0
je 0x52fbea
cmp byte [edi + 0x22b], 0
jne 0x52fbf5
cmp byte [edi + 0x22a], 0x64
jne 0x52fbf5
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x52fc25
mov eax, dword [0x5646b4]
mov eax, dword [eax]
call fcn.0047b92c
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x52fc25
cmp byte [edi + 0x224], 0
jne 0x52fc25
cmp byte [edi + 0x2a0], 0
je 0x52fbf5
test bl, bl
jne 0x52fc3f
cmp byte [edi + 0x224], 0
jne 0x52fc3f
cmp byte [edi + 0x2a0], 0
je 0x52fb51
cmp byte [edi + 0x2a0], 0
jne 0x52fc51
cmp byte [edi + 0x224], 0
jne 0x52fc58
mov eax, edi
call fcn.0052ff4c
pop edi
pop esi
pop ebx
ret

Function at 0x5323f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x532490
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004052b8
mov eax, dword [ebp - 4]
call fcn.00405534
test eax, eax
jle 0x532466
mov dword [ebp - 8], eax
mov ebx, 1
mov eax, edi
call fcn.0040578c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [edi]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0x7ab8
add ax, 0x6a2f
mov esi, eax
inc ebx
dec dword [ebp - 8]
jne 0x532431
lea edx, [ebp - 0xc]
mov eax, dword [edi]
call fcn.00521094
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004052b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532497
lea eax, [ebp - 0xc]
call fcn.00405264
ret
Function at 0x539f20
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x539fa3
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x539f86
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00539ecc
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539f8d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x53a794
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x53a79c
push ebx
push esi
push edi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x53a97e
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
call fcn.00403400
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0x41
jb 0x53a94e
cmp byte [ebp - 1], 0x5a
ja 0x53a94e
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.004038e4
mov edx, 0x53a98c
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.004038b4
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004054d8
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x53a94e
lea eax, [ebp - 0x1c]
call fcn.00499be8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov edx, 0x53a998
call fcn.0040d6dc
mov eax, dword [ebp - 8]
call fcn.0040d5b8
test al, al
jne 0x53a81e
push 0x53a9a8
push 0x53a9b0
mov ecx, dword [0x565668]
mov dl, 1
mov eax, dword [0x41f1ac]
call fcn.00424634
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x53a890
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00424430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a897
mov eax, dword [ebp - 0x10]
call fcn.004043f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a985
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405288
lea eax, [ebp - 0x1c]
call fcn.00405264
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405288
ret

Function at 0x53aa60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x53ab02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5641d8]
cmp byte [eax], 0
je 0x53aab0
mov eax, dword [ebp + 8]
mov al, byte [eax - 5]
call fcn.004976f8
push eax
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00405c10
push eax
push 0x53ab0c
mov eax, dword [0x5646b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x53aaec
mov eax, dword [ebp + 8]
mov al, byte [eax - 5]
call fcn.004976f8
push eax
push 0
push 0
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.004054fc
mov eax, dword [ebp - 4]
call fcn.00405734
push eax
push 0x53ab18
mov eax, dword [0x5646b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ab09
lea eax, [ebp - 4]
call fcn.00405264
ret
Function at 0x53b070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405fd0
lea eax, [ebp + 0x14]
call fcn.00405fd0
lea eax, [ebp + 0x10]
call fcn.00405fd0
lea eax, [ebp + 0xc]
call fcn.00405fd0
xor eax, eax
push ebp
push 0x53b194
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x53b0c5
mov eax, esi
call fcn.00461bb0
mov ebx, eax
mov eax, dword [0x5641d8]
cmp byte [eax], 0
je 0x53b0fc
push edi
mov eax, dword [ebp + 0xc]
call fcn.00405c10
push eax
mov eax, dword [ebp + 0x10]
call fcn.00405c10
push eax
mov eax, dword [ebp + 0x14]
call fcn.00405c10
push eax
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
jmp 0x53b153
push edi
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.004054fc
mov eax, dword [ebp - 8]
call fcn.00405734
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004054fc
mov eax, dword [ebp - 0xc]
call fcn.00405734
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x14]
call fcn.004054fc
mov eax, dword [ebp - 0x10]
call fcn.00405734
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004054fc
mov eax, dword [ebp - 0x14]
call fcn.00405734
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jg 0x53b164
mov ecx, eax
mov edx, dword [ebp + 0x14]
mov eax, esi
call fcn.0053ae9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b19b
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405288
lea eax, [ebp - 4]
call fcn.004059bc
lea eax, [ebp + 0xc]
mov edx, 3
call fcn.004059d4
ret
Function at 0x557be0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov byte [ebp - 1], dl
push eax
mov al, byte [ebp - 1]
push eax
mov al, byte [ebp + 8]
push eax
mov ecx, dword [0x5646b4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x557124]
call fcn.00557438
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x557c82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004782f0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x88]
mov eax, dword [0x5646b4]
mov eax, dword [eax]
call fcn.0047b5b0
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x557c4f
mov eax, dword [0x5646b4]
mov eax, dword [eax]
call fcn.0047b92c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x2fa], 0
jne 0x557c6c
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
imul edx, esi, 0x3e8
cmp eax, edx
jl 0x557c43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557c89
mov eax, dword [ebp - 8]
call fcn.004043f8
ret
Function at 0x5597c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x559998
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x564044], 0
mov eax, dword [0x5641d8]
cmp byte [eax], 0
je 0x559823
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x20]
mov eax, dword [0x564444]
mov eax, dword [eax]
call fcn.0048fe7c
mov eax, dword [ebp - 0x20]
call fcn.00405c10
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
jmp 0x559854
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x24]
mov eax, dword [0x5646b4]
mov eax, dword [eax]
call fcn.0047c1a8
mov eax, dword [ebp - 0x24]
call fcn.00405734
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x55997a
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
call fcn.0055977c
mov esi, eax
lea eax, [esi + 0x400]
cmp edi, eax
jbe 0x559974
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x1b]
xor ecx, ecx
mov edx, 0xc
call fcn.00403a38
push 0
lea eax, [ebp - 4]
push eax
push 0xb
lea eax, [ebp - 0x1b]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
mov edx, 0x5599a8
lea eax, [ebp - 0x1b]
call fcn.0040da24
test eax, eax
jne 0x5598cb
mov byte [0x564044], 1
mov dword [0x564048], esi
jmp 0x559974
push 2
push 0
push 0xfffffffffffffff6
push ebx
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xf]
xor ecx, ecx
mov edx, 0xb
call fcn.00403a38
push 0
lea eax, [ebp - 4]
push eax
push 0xa
lea eax, [ebp - 0xf]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
mov edx, 0x5599b4
lea eax, [ebp - 0xf]
call fcn.0040da24
test eax, eax
jne 0x55993d
push 2
push 0
push 0xfffffffffffffff2
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x564048
push ebx
call sub.kernel32.dll_ReadFile_1
sub edi, dword [0x564048]
mov dword [0x564048], edi
mov byte [0x564044], 1
jmp 0x559974
mov edx, 0x5599c0
lea eax, [ebp - 0xf]
call fcn.0040da24
test eax, eax
jne 0x559974
push 2
push 0
push 0xfffffffffffffff2
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x564048
push ebx
call sub.kernel32.dll_ReadFile_1
mov byte [0x564044], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55999f
lea eax, [ebp - 0x24]
call fcn.00405264
lea eax, [ebp - 0x20]
call fcn.004059bc
ret