joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5146a0
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35e4
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x35e0], eax
cmp dword [0x58b8e0], 0xffffffff
push ebx
mov ebx, dword [esp + 0x35f8]
push esi
mov esi, dword [esp + 0x35f0]
push edi
mov edi, dword [esp + 0x35f8]
jne 0x514747
push 0x4001
push 0x2b4
lea eax, [esp + 0x8c]
push eax
push 0
push 0x557b90
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x88]
mov dword [0x603498], eax
lea eax, [esp + 0x25ec]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x8c]
push eax
push 0
lea eax, [esp + 0x25fc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x88]
mov dword [0x58b8e0], eax
push ebp
push 0x800
push edi
lea eax, [esp + 0x5f8]
push eax
call fcn.004bd090
push 0x800
lea eax, [esp + 0x5f4]
push eax
push eax
call fcn.004a2f60
movzx eax, word [esi]
lea ecx, [esp + 0x5f0]
mov ebp, eax
mov dword [esp + 0x10], 3
test ax, ax
mov dword [esp + 0x14], 0x40000000
mov dword [esp + 0x18], 0
lea eax, [esp + 0x33c]
mov dword [esp + 0x24], ecx
je 0x5147e2
push 0x4011
push 0x2b4
push eax
movzx eax, byte [esp + 0x360c]
shl eax, 4
push eax
mov eax, ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x340]
push 0x800
mov dword [esp + 0x30], eax
lea eax, [esp + 0x15f4]
push esi
push eax
call fcn.004bd090
jmp 0x514840
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x600]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x340]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5f0]
push 0x800
push eax
lea eax, [esp + 0x15f8]
push eax
call fcn.004bd090
lea eax, [esp + 0x15f0]
push eax
call fcn.004a2e00
lea eax, [esp + 0x5f0]
push eax
call fcn.004a2d90
mov dword [esp + 0x24], eax
push 0x66
push dword [0x5933e8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x104d
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [esp + 0x10], 3
lea eax, [esp + 0x15f0]
mov dword [esp + 0x14], edi
test bp, bp
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], eax
pop ebp
je 0x514896
mov ecx, dword [0x58b8e0]
mov dword [esp + 0x28], ecx
jmp 0x51489f
mov eax, dword [0x603498]
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x48]
mov dword [esp + 0x50], 2
push eax
push edi
push 0x1074
push esi
mov dword [esp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
jne 0x5148f6
lea eax, [esp + 0x48]
mov dword [esp + 0x58], 1
push eax
push edi
push 0x102b
push esi
mov dword [esp + 0x64], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x5ff97c]
pop edi
inc eax
mov dword [0x5ff97c], eax
pop esi
pop ebx
cmp eax, 1
jne 0x514922
push 0x4f5
call fcn.004b68d0
push eax
push 2
push dword [0x5933e8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x35e0]
xor ecx, esp
call fcn.0052f708
add esp, 0x35e4
ret 0x10
Function at 0x516d90
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1028
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x61600
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea eax, [esp + 0xc]
push eax
push str.VerInfo
push 0x557ad0
call fcn.004cf5f0
push 1
push 0x800
lea eax, [esp + 0x30]
push eax
call fcn.004a1f20
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.004a0eb0
push 0x800
push str.version.dat
lea eax, [esp + 0x30]
push eax
call fcn.004bd030
push 0x55a9fc
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
push eax
call fcn.00491f50
mov esi, eax
test esi, esi
je 0x516e3d
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0053bd85
push esi
call fcn.005386bd
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x516f06
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x516ed2
lea eax, [esp + 0x20]
push eax
push str.VerInfo
push 0x557ad0
call fcn.004d0490
call fcn.004d00d0
test al, al
jne 0x516ea1
push 0x557d24
lea eax, [esp + 0x2c]
push eax
call fcn.00491f50
mov esi, eax
test esi, esi
je 0x516ea1
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00538b43
push esi
call fcn.005386bd
add esp, 0x14
call fcn.004d00e0
movzx eax, al
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe98
add eax, 0x168
mov dword [0x59340c], eax
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.0052f708
add esp, 0x1028
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push str.VerInfo
push 0x557ad0
mov dword [esp + 0x14], ecx
call fcn.004d0490
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x516f56
cmp dword [esp + 0x10], eax
je 0x516f56
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
call fcn.004d00d0
test al, al
jne 0x516f56
push 0x557d24
lea eax, [esp + 0x2c]
push eax
call fcn.00491f50
mov esi, eax
test esi, esi
je 0x516f56
push esi
push 0xc
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00538b43
push esi
call fcn.005386bd
add esp, 0x14
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub ecx, ecx
push 0xc9
sbb eax, dword [esp + 0x10]
sub ecx, dword [esp + 0xc]
push 0x2a69c000
sbb eax, 0
add ecx, dword [esp + 0x28]
adc eax, 0
push eax
push ecx
call fcn.0052f750
mov dword [0x59340c], eax
test eax, eax
jns 0x516f94
mov dword [0x59340c], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1028
ret
Function at 0x5198a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554461
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.0051a6e0
test al, al
je 0x519904
push 0x65
call fcn.004b68d0
push 0x596
mov esi, eax
call fcn.004b68d0
push 0x30
push esi
push eax
push dword [0x5923dc]
call fcn.004fdf00
jmp 0x519a10
cmp byte [0x5933f4], 0
jne 0x519940
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.0051af20
test al, al
jne 0x519a10
push esi
push 0x201
call fcn.004b68d0
push eax
call fcn.00502bd0
add esp, 8
jmp 0x519a10
push 1
call fcn.004f7750
push 1
push 0x800
push 0x5a5eee
push str.Rar_EX
call fcn.004fca70
test al, al
je 0x519a10
push 0x800
push 0x5b232a
mov ecx, 0x5c2bd0
call fcn.00409950
mov eax, dword [0x5c2bd4]
mov ecx, 0x5b332c
push 0x5578cc
mov dword [0x5ad2c8], eax
call fcn.004bd180
push 0x800
lea eax, [ebp - 0x1010]
mov dword [0x5ac2b4], 2
push eax
push esi
push 0x5a5eee
call fcn.004a25d0
push 0
push 0
mov ecx, 0x5c2bd0
call fcn.00409410
cmp byte [0x5933f7], 0
jne 0x519a10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6345f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x60fa64]
cmp eax, dword [ecx + 4]
jg 0x519a2c
push 0
lea eax, [ebp - 0x1010]
mov ecx, 0x60ba30
push eax
call fcn.00519e10
push 0x60ba30
push 0x10000
push 0x5188c0
call fcn.0053910c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f708
mov esp, ebp
pop ebp
ret 4
push 0x60fa64
call fcn.0052ffcb
add esp, 4
cmp dword [0x60fa64], 0xffffffff
jne 0x5199e6
mov dword [ebp - 4], 0
mov ecx, 0x60ba30
call fcn.00517cf0
push 0x555270
call fcn.0052fdc4
mov dword [ebp - 4], 0xffffffff
push 0x60fa64
call fcn.0052ff80
add esp, 8
jmp 0x5199e6
Function at 0x519c20
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x6060]
mov eax, 0x6060
call fcn.0052f720
push 0xffffffffffffffff
push 0x5544a5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp + 0x605c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x6070]
mov edi, dword [ebp + 0x6068]
mov esi, dword [ebp + 0x606c]
push eax
call fcn.004a2d90
mov edx, esi
mov ebx, eax
lea eax, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x519c80
mov ecx, ebx
sub edx, eax
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x519c97
sub ecx, dword [ebp - 0x10]
sar ecx, 1
lea eax, [ecx + 1]
add eax, edx
cmp eax, 0x1000
jb 0x519cba
xor al, al
jmp 0x519de5
push 0x1000
lea eax, [ebp + 0x5c]
push eax
push ebx
push esi
call fcn.004a25d0
lea ecx, [ebp]
call fcn.004bd0e0
mov dword [ebp - 4], 0
lea eax, [ebp + 0x205c]
push 0x1000
push 0x557718
push eax
push str.ViewerIgnoreModifications
push 0x55824c
call fcn.004cf7c0
cmp word [ebp + 0x205c], 0
je 0x519d17
push 0
push 0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x205c]
push eax
call fcn.004d8950
push 0x800
lea eax, [ebp + 0x405c]
push eax
lea ecx, [ebp]
call fcn.004bd280
test al, al
je 0x519dca
push 0x800
lea eax, [ebp + 0x505c]
push eax
lea eax, [ebp + 0x405c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x519dae
cmp eax, 0x800
jae 0x519dae
lea eax, [ebp + 0x505e]
push 0x56cb4c
push eax
call fcn.00531fcb
mov esi, eax
add esp, 8
test esi, esi
je 0x519d98
xor eax, eax
mov word [esi], ax
add esi, 4
cmp word [esi], ax
jne 0x519d83
mov esi, 0x5578cc
push 5
push edi
lea eax, [ebp + 0x505c]
push eax
call fcn.00496020
test al, al
je 0x519dae
jmp 0x519d9e
lea esi, [ebp + 0x505c]
push 5
lea eax, [ebp + 0x5c]
push eax
push esi
call fcn.00496020
test al, al
jne 0x519e0a
push 0x800
lea eax, [ebp + 0x405c]
push eax
lea ecx, [ebp]
call fcn.004bd280
test al, al
jne 0x519d33
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
test eax, eax
je 0x519de3
push eax
call fcn.00537b6f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x605c]
xor ecx, ebp
call fcn.0052f708
lea esp, [ebp + 0x6060]
pop ebp
ret 0xc
mov bl, 1
jmp 0x519dcc
Function at 0x51af20
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x2054]
push ebx
mov bl, byte [esp + 0x205c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2064]
mov dword [esp + 0x10], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x500
push ebp
mov ebp, dword [esp + 0x2058]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x206c]
test bl, bl
jne 0x51afc6
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
call fcn.004a1db0
test eax, eax
je 0x51afe5
cmp word [eax], 0x2e
jne 0x51aff2
cmp word [eax + 2], 0
jne 0x51aff2
or dword [esp + 0x18], 1
mov dword [esp + 0x3c], 0x557b90
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.004a2d90
cmp eax, esi
jne 0x51b037
push 0x557920
push esi
call fcn.004a0ef0
test al, al
jne 0x51b037
push esi
push str.._s
lea eax, [esp + 0x58]
push 0x1000
push eax
call fcn.00404ce0
lea eax, [esp + 0x60]
add esp, 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 1
push eax
mov byte [0x5933f5], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
jne 0x51b08d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x51b071
test edi, edi
je 0x51b06a
mov dword [edi], esi
mov al, 1
jmp 0x51b135
cmp dword [esp + 0x20], 0
je 0x51b08d
lea eax, [esp + 0x14]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov byte [0x5933f5], 0
test esi, esi
je 0x51b133
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x51b133
test bl, bl
jne 0x51b12f
mov edx, dword [esp + 0x4c]
test edx, edx
je 0x51b0e7
mov ecx, dword [0x6039b0]
mov eax, dword [esp + 0x34]
mov dword [ecx*4 + 0x603970], eax
lea eax, [ecx + 1]
mov dword [ecx*4 + 0x603930], edx
and eax, 0x8000000f
jns 0x51b0e0
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x6039b0], eax
jmp 0x51b129
xor esi, esi
lea esp, [esp]
mov eax, dword [esi + 0x603970]
cmp eax, dword [esp + 0x34]
jne 0x51b121
push 0
push dword [esi + 0x603930]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x51b11d
mov edx, dword [esi + 0x603930]
mov dword [esp + 0x4c], edx
jmp 0x51b121
mov edx, dword [esp + 0x4c]
add esi, 4
cmp esi, 0x40
jl 0x51b0f0
test edi, edi
je 0x51b12f
mov dword [edi], edx
mov al, 1
jmp 0x51b135
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x2044
ret 0x1c
Function at 0x51b4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55464b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x58bb30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
jne 0x51b670
push 2
push 0x558240
push 0x55824c
call fcn.004cf550
mov esi, eax
cmp esi, 3
jne 0x51b564
push edi
push 0x51a8e0
push dword [0x5923dc]
push 0x56cb74
push dword [0x5d2758]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
cmp esi, 0xffffffff
je 0x51b67b
test esi, esi
je 0x51b5a8
push edi
call fcn.0051a6e0
test al, al
je 0x51b5a8
push 0x65
call fcn.004b68d0
push 0x596
mov esi, eax
call fcn.004b68d0
push 0x30
push esi
push eax
push dword [0x5923dc]
call fcn.004fdf00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub esi, 0
je 0x51b670
sub esi, 1
je 0x51b6d8
sub esi, 1
jne 0x51b67b
push str.rarreg.key
push edi
call fcn.004a2d90
push eax
call fcn.004c1160
test eax, eax
je 0x51b67b
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6345f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x60ba2c]
cmp eax, dword [ecx + 4]
jg 0x51b6ed
push 1
push edi
mov ecx, 0x6079f8
call fcn.00519e10
mov al, byte [ebp + 0xc]
push 0
push 0x6079f8
xor al, 1
movzx eax, al
push eax
push 0
push 0
push edi
push 0
call fcn.0051af20
test al, al
jne 0x51b692
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x607a00]
mov esi, eax
cmp edx, 0xffffffff
je 0x51b64d
push edx
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x607a00], 0xffffffff
mov ecx, 0x60ba1c
call fcn.004ba160
cmp esi, 0x4c7
je 0x51b67b
push 0
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.00519580
test al, al
jne 0x51b67b
push dword [ebp + 0xc]
push edi
mov ecx, ebx
call fcn.0051a010
mov byte [ebx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 0xc], 0
je 0x51b6b1
push 0x6079f8
push 0x10000
push 0x5188c0
call fcn.0053910c
add esp, 0xc
jmp 0x51b67b
mov eax, dword [0x607a00]
cmp eax, 0xffffffff
je 0x51b6cc
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x607a00], 0xffffffff
mov ecx, 0x60ba1c
call fcn.004ba160
jmp 0x51b67b
mov esi, dword [ebp + 0xc]
mov ecx, ebx
push 0
push esi
push edi
call fcn.00519580
test al, al
jne 0x51b67b
push esi
jmp 0x51b673
push 0x60ba2c
call fcn.0052ffcb
add esp, 4
cmp dword [0x60ba2c], 0xffffffff
jne 0x51b5fc
mov dword [ebp - 4], 0
mov ecx, 0x60ba1c
call fcn.004b9f00
mov byte [ebp - 4], 0
push 0x5551d0
call fcn.0052fdc4
mov dword [ebp - 4], 0xffffffff
push 0x60ba2c
call fcn.0052ff80
add esp, 8
jmp 0x51b5fc
Function at 0x522ed0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push 0x633990
mov esi, ecx
call fcn.00482960
mov ebx, dword [esp + 0xc]
mov dword [esi + 0x1e0], 0x12345678
mov dword [esi + 0x1e4], 0x23456789
mov dword [esi + 0x1e8], 0x34567890
mov cl, byte [ebx]
test cl, cl
je 0x522f64
push edi
mov eax, 0x12345678
mov edi, 0x23456789
mov edx, 0x34567890
movsx ecx, cl
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x633990]
movzx ecx, al
add ecx, edi
mov dword [esi + 0x1e0], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 0x1e4], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x633990]
mov dword [esi + 0x1e8], edx
mov cl, byte [ebx]
test cl, cl
jne 0x522f16
pop edi
pop esi
pop ebx
ret 4

Function at 0x522f70
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x5b3504], 0
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, dword [esp + 0x10]
je 0x523052
push ebx
mov ebx, ecx
imul ebx, eax
cmp byte [esi + 4], 0
je 0x522fbe
push ebx
push edi
lea eax, [esi + 8]
push eax
call fcn.004e9b50
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
pop ebx
push 0
push eax
push ecx
push edi
mov ecx, esi
call fcn.005217b0
pop edi
pop esi
ret 0xc
push ebp
mov ebp, edi
test ebx, ebx
je 0x523050
lea esp, [esp]
movsx eax, byte [ebp]
lea ebp, [ebp + 1]
mov ecx, dword [esi + 0x1e0]
xor eax, ecx
mov edx, dword [esi + 0x1e8]
mov edi, edx
movzx eax, al
and edi, 0xfffd
shr ecx, 8
or edi, 2
xor ecx, dword [eax*4 + 0x633990]
movzx eax, cl
add eax, dword [esi + 0x1e4]
imul eax, eax, 0x8088405
mov dword [esi + 0x1e0], ecx
inc eax
mov dword [esi + 0x1e4], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x633990]
mov eax, edi
xor eax, 1
mov dword [esi + 0x1e8], edx
imul eax, edi
shr eax, 8
xor byte [ebp - 1], al
sub ebx, 1
jne 0x522fd0
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
pop ebp
pop ebx
push 0
push eax
push ecx
push edi
mov ecx, esi
call fcn.005217b0
pop edi
pop esi
ret 0xc
Function at 0x52c9c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x50
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov esi, dword [esp + 0x58]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52ca0a
test al, 0x10
jne 0x52c9f5
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x52ca0a
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0052f708
add esp, 0x50
ret 4
xor eax, eax
mov dword [esp + 0x10], 0x557718
mov dword [esp + 0x28], eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x64b7ac]
mov dword [esp + 0x14], 0x557718
mov dword [esp + 0x18], 0x557718
mov dword [esp + 0x1c], 0x557718
mov dword [esp + 0x20], 0x557718
mov dword [esp + 0x24], 0x557718
mov dword [esp + 0x50], 0x11
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x48], 2
call fcn.004bed70
mov ecx, dword [esp + 0x54]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x50
ret 4
Function at 0x53a2d9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x634858]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53a319
cmp byte [ebx], 0xa
jne 0x53a319
or byte [eax + edi + 0x28], 4
jmp 0x53a31e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x53a41c
mov al, byte [edx]
cmp al, 0x1a
je 0x53a3fe
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x53a34d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x53a372
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x53a37c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x53a32f
jmp 0x53a41c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53a3f9
cmp dword [ebp - 0xc], 0
je 0x53a3f9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x634858]
test byte [eax + edi + 0x28], 0x48
je 0x53a3d3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x53a3be
mov byte [esi], dl
jmp 0x53a3cf
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x634858]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x53a41c
cmp byte [ebp - 1], 0xa
jne 0x53a3e2
cmp esi, ebx
jne 0x53a3e2
mov byte [esi], 0xa
jmp 0x53a41b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0053a27b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x53a41c
mov byte [esi], 0xd
jmp 0x53a41b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x634858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x53a418
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x53a41c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x53a425
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x634858]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53a468
cmp word [esi], dx
jne 0x53a468
or byte [edi + eax + 0x28], 4
jmp 0x53a46d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x53a5c0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x53a5a0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x53a4af
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x53a4e5
cmp eax, edx
jae 0x53a4f1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x53a487
jmp 0x53a5c0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53a59c
cmp dword [ebp - 0x14], 0
je 0x53a59c
mov eax, dword [ebx*4 + 0x634858]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x53a574
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x53a53d
mov word [esi], cx
jmp 0x53a570
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x634858]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x634858]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x634858]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x53a5c0
pop ebx
cmp word [ebp - 4], bx
jne 0x53a585
cmp esi, dword [ebp + 0xc]
jne 0x53a585
mov word [esi], bx
jmp 0x53a5bd
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0053a27b
add esp, 0x10
cmp word [ebp - 4], bx
je 0x53a5c0
push 0xd
jmp 0x53a5b9
mov ecx, dword [ebx*4 + 0x634858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x53a5b7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x53a5c0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret