joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3e60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi]
sub esp, 0x98
cmp eax, 0xffffffff
push ebx
push edi
je 0x5e400b
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5e3e8f
mov dword [esp + 0xc], eax
jmp 0x5e3e9b
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], edx
mov edx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esi + 0xc], 0
call ebx
mov eax, dword [esp + 0x18]
or eax, 0xff000000
cmp eax, 0xff334449
jne 0x5e3f98
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x20]
push ecx
push 6
lea edx, [esp + 0x14]
push edx
push eax
call ebx
cmp dword [esp + 0x1c], 0
je 0x5e3f98
cmp byte [esp + 8], 0xff
jae 0x5e3f98
cmp byte [esp + 9], 0xff
jae 0x5e3f98
mov dl, byte [esp + 0xa]
cmp dl, 0x80
jae 0x5e3f98
cmp byte [esp + 0xb], 0x80
jae 0x5e3f98
mov cl, byte [esp + 0xc]
cmp cl, 0x80
jae 0x5e3f98
mov al, byte [esp + 0xd]
cmp al, 0x80
jae 0x5e3f98
movzx edi, dl
movzx edx, byte [esp + 0xb]
shl edi, 7
add edi, edx
shl edi, 7
movzx ecx, cl
add edi, ecx
movzx edx, al
shl edi, 7
add edi, edx
cmp edi, dword [esi + 4]
jae 0x5e3f98
push 1
mov eax, edi
cdq
push 0
push edx
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
add edi, 0xa
add dword [esi + 0xc], edi
push eax
call ebx
cmp dword [esp + 0x14], 0
je 0x5e3f98
mov ecx, dword [esp + 0x18]
or ecx, 0xff000000
cmp ecx, 0xff334449
je 0x5e3ed5
mov edi, dword [esi + 4]
mov edx, dword [esi]
xor eax, eax
push eax
push eax
push eax
sub edi, 0x80
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esi + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
sub eax, edi
push 0x80
lea edx, [esp + 0x2c]
mov dword [esi + 8], eax
mov eax, dword [esi]
push edx
push eax
call ebx
cmp dword [esp + 0x14], 0x80
jne 0x5e3ff4
push 3
lea ecx, [esp + 0x24]
push 0x712cd8
push ecx
call fcn.0069d18d
add esp, 0xc
test eax, eax
jne 0x5e3ff4
add dword [esi + 0x10], 0xffffff80
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esi + 0x10]
mov dword [esi + 8], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e9f00
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, ecx
cmp word [esi + 0x20], 0
lea ebx, [esi + 0x20]
mov dword [esi], 0x7142fc
je 0x5e9f5a
mov eax, dword [esi + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x5e9f3b
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x14]
push ecx
call edi
push 3
lea edx, [esi + 0x228]
push edx
push ebx
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.005f7350
Function at 0x5ec0d0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
mov dword [esi], 0
mov edx, 0x3e8
mov byte [esp + 0x10], 0
xor ebx, ebx
jmp 0x5ec0f0
movzx eax, word [ebp]
lea ecx, [eax - 0x30]
add ebp, 2
cmp cx, 9
ja 0x5ec12e
movzx eax, cx
imul eax, edx
cmp edx, 0x3e8
jl 0x5ec119
lea eax, [eax + edi*8]
add eax, edi
add dword [esi], eax
add edi, eax
jmp 0x5ec0f0
add dword [esi], eax
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
jmp 0x5ec0f0
cmp ax, 0x3a
jne 0x5ec156
add ebx, 1
cmp ebx, 3
jne 0x5ec143
lea edx, [ebx + 0x61]
xor edi, edi
jmp 0x5ec0f0
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
mov dword [esi], ecx
xor edi, edi
jmp 0x5ec0f0
test ax, ax
je 0x5ec184
cmp ax, 0x2e
jne 0x5ec170
cmp edx, 0x3e8
jl 0x5ec0f0
mov edx, 0x64
jmp 0x5ec0f0
cmp ax, 0x2d
jne 0x5ec0f0
mov byte [esp + 0x10], 1
jmp 0x5ec0f0
cmp byte [esp + 0x10], 0
pop edi
pop ebp
pop ebx
je 0x5ec194
mov edx, dword [esi]
neg edx
mov dword [esi], edx
ret 4
Function at 0x5f3970
Capabilities:
Clear file content
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
push ebx
mov dword [edi + 8], eax
mov al, byte [ebp + 8]
push esi
xor esi, esi
test al, al
mov dword [edi], 0x6dc414
mov dword [edi + 0xe], 0xffffffff
mov dword [edi + 4], esi
mov byte [edi + 0xc], al
mov byte [edi + 0xd], 0
jne 0x5f39a9
mov byte [edi + 0xd], 1
mov byte [edi + 0xc], 1
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
push ecx
mov word [edi + 0x12], si
mov dword [edi], 0x71490c
lea ebx, [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebx], eax
jne 0x5f39d8
or byte [edi + 0xd], 1
mov eax, dword [ebp + 0xc]
movzx edx, byte [ebp + 8]
imul edx, eax
mov dword [edi + 0x18], edx
movzx edx, ax
mov dword [edi + 0x14], eax
movzx eax, byte [edi + 0xc]
add dx, dx
add dx, dx
push eax
mov dword [edi + 4], esi
mov esi, dword [edi + 8]
add dx, dx
lea eax, [esp + 0x14]
call fcn.005d5eb0
push ebx
mov esi, 0xffffffd9
lea ecx, [esp + 0x14]
call fcn.005f73f0
cmp dword [edi + 4], 0
jle 0x5f3a67
push ebx
call fcn.00496ff0
mov ecx, dword [edi + 0x18]
imul ecx, dword [edi + 4]
mov esi, eax
mov eax, dword [ebx]
lea edx, [esp + 8]
push edx
push eax
add esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5f3a46
mov dword [esp + 0xc], eax
jmp 0x5f3a52
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], ecx
cmp esi, eax
jbe 0x5f3a58
mov esi, eax
mov edx, dword [ebx]
xor eax, eax
push eax
push eax
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebx], 0xffffffff
mov eax, edi
jne 0x5f3a7b
or byte [edi + 0xd], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5f3ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push ecx
push ecx
xor eax, eax
push ecx
push eax
mov dword [edi], 0x71490c
mov eax, dword [edi + 0x1c]
lea ebx, [edi + 0x1c]
push eax
call ebp
movzx edx, word [edi + 0x14]
movzx ecx, byte [edi + 0xc]
mov esi, dword [edi + 8]
add dx, dx
add dx, dx
add dx, dx
push ecx
lea eax, [esp + 0x1c]
call fcn.005d5eb0
mov esi, dword [edi + 0x18]
imul esi, dword [edi + 4]
push ebx
lea ecx, [esp + 0x1c]
call fcn.005f73f0
mov edx, dword [edi + 0x18]
imul edx, dword [edi + 4]
test dl, 1
je 0x5f3b44
push 2
xor ecx, ecx
push ecx
xor eax, eax
push ecx
push eax
mov eax, dword [ebx]
push eax
call ebp
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebx]
cmp ebx, 0xffffffff
je 0x5f3b52
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0x6dc414
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f3de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
push edi
mov dword [esi], 0x714918
je 0x5f3e60
cmp dword [esi + 0x2c], 0
je 0x5f3e55
cmp dword [esi + 0x3c], 0
je 0x5f3e55
push 0x20
lea edi, [esi + 0x20]
push edi
push eax
call sub.MSACM32.dll_acmStreamConvert
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x3c]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x14]
push ecx
push edx
push eax
call ebx
mov ecx, dword [esi + 0x44]
add dword [esi + 0x7c], ecx
test dword [esi + 0x24], 0x20000
je 0x5f3e55
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x78]
push 0
push edi
push ecx
mov dword [esi + 0x30], edx
mov dword [esi + 0x40], eax
call sub.MSACM32.dll_acmStreamUnprepareHeader
mov edx, dword [esi + 0x1c]
push 0
push edx
call sub.MSACM32.dll_acmStreamClose
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
lea edi, [esi + 0x14]
je 0x5f3eac
test byte [esi + 0x7c], 1
je 0x5f3e87
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x24], 0
call ebx
xor ecx, ecx
push ecx
push ecx
xor eax, eax
push ecx
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [esi + 0x80], 0
jne 0x5f3eac
mov edx, dword [esi + 0x7c]
mov eax, dword [esi + 0x18]
call fcn.005d5fd0
mov ecx, dword [esi + 0x3c]
push ecx
call fcn.0069c8fa
mov edx, dword [esi + 0x2c]
push edx
call fcn.0069c8fa
mov eax, dword [esi + 0x18]
push eax
call fcn.0069c8fa
mov edi, dword [edi]
add esp, 0xc
cmp edi, 0xffffffff
je 0x5f3ed8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi], 0x6dc414
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f4130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ebx
lea edi, [esp + 0x10]
call fcn.004ad1c0
mov ecx, str..wff
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5f417a
test dx, dx
je 0x5f4176
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x5f417a
add eax, 4
add ecx, 4
test dx, dx
jne 0x5f4154
xor eax, eax
jmp 0x5f417f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5f41cd
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5f41cd
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
mov ecx, 0x101
lea edi, [esp + 0x14]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.005d47e0
cmp word [esp + 0x10], 0
jbe 0x5f41cd
cmp dword [esp + 0x14], 0
jle 0x5f41cd
cmp byte [esp + 0x12], 0
jbe 0x5f41cd
mov edi, dword [ebp + 8]
mov ecx, 0x101
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f57f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, eax
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
bswap eax
push 4
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
push edx
push eax
call ebx
movzx ecx, word [esi + 4]
mov dh, cl
push 0
mov dl, ch
lea ecx, [esp + 0x18]
push ecx
push 2
movzx eax, dx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
push edx
push eax
call ebx
movzx ecx, word [esi + 6]
mov dh, cl
push 0
mov dl, ch
lea ecx, [esp + 0x18]
push ecx
push 2
movzx eax, dx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
push edx
push eax
call ebx
mov ecx, dword [esi + 8]
push 0
shl ecx, 8
lea edx, [esp + 0x18]
push edx
bswap ecx
push 3
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [edi]
push eax
push ecx
call ebx
mov edx, dword [esi + 0xc]
push 0
shl edx, 8
lea eax, [esp + 0x18]
push eax
bswap edx
push 3
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
movzx eax, byte [esi + 0x14]
sub eax, 1
cdq
mov ecx, eax
mov eax, dword [esi + 0x10]
mov ebx, edx
cdq
shld edx, eax, 3
add eax, eax
add eax, eax
add eax, eax
or ecx, eax
movzx eax, byte [esi + 0x15]
or ebx, edx
shld ebx, ecx, 5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
shl ecx, 5
sub eax, 1
cdq
or ecx, eax
shl ecx, 4
or ecx, dword [esi + 0x1a]
xor edx, edx
or edx, dword [esi + 0x16]
push 0
bswap ecx
lea eax, [esp + 0x18]
push eax
bswap edx
mov dword [esp + 0x20], ecx
push 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
mov ecx, dword [edi]
push 0
lea eax, [esp + 0x18]
push eax
push 0x10
add esi, 0x1e
push esi
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f5920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push esi
xor ecx, ecx
push ecx
push ecx
mov esi, eax
push ecx
mov eax, 0xc
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
shl ecx, 8
lea edx, [esp + 0x10]
push edx
bswap ecx
push 3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [edi]
push eax
push ecx
call ebx
mov edx, dword [esi + 0xc]
push 0
shl edx, 8
lea eax, [esp + 0x10]
push eax
bswap edx
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
movzx eax, byte [esi + 0x14]
sub eax, 1
cdq
mov ecx, eax
mov eax, dword [esi + 0x10]
mov ebx, edx
cdq
shld edx, eax, 3
add eax, eax
add eax, eax
add eax, eax
or ecx, eax
movzx eax, byte [esi + 0x15]
or ebx, edx
shld ebx, ecx, 5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
shl ecx, 5
sub eax, 1
cdq
or ecx, eax
shl ecx, 4
or ecx, dword [esi + 0x1a]
xor edx, edx
or edx, dword [esi + 0x16]
push 0
bswap ecx
lea eax, [esp + 0x10]
push eax
bswap edx
mov dword [esp + 0x18], ecx
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
push 0
lea eax, [esp + 0x10]
push eax
push 0x10
add esi, 0x1e
mov ecx, dword [edi]
push esi
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f5b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 8], edi
jle 0x5f5c10
cmp dword [esi + 4], edi
je 0x5f5c10
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
bswap eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push 4
lea edx, [esp + 0x1c]
push edx
push ecx
call ebx
cmp dword [esi + 8], edi
mov dword [esp + 0x10], edi
jle 0x5f5c10
mov dword [esp + 0xc], edi
jmp 0x5f5b72
mov esi, edx
mov eax, dword [esi + 4]
add eax, dword [esp + 0xc]
push 0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ax, word [eax + 0x10]
bswap ecx
mov dword [esp + 0x2c], ecx
bswap edx
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x4c], ax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [esp + 0x2c], edx
push 8
lea edx, [esp + 0x30]
push edx
push ecx
call ebx
push 0
lea edx, [esp + 0x20]
push edx
bswap esi
mov dword [esp + 0x38], esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push 8
lea eax, [esp + 0x38]
push eax
bswap edi
push ecx
mov dword [esp + 0x40], edi
call ebx
mov dx, word [esp + 0x44]
mov ah, dl
push 0
mov al, dh
lea edx, [esp + 0x24]
push edx
push 2
movzx ecx, ax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi]
push eax
push ecx
call ebx
mov eax, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add dword [esp + 0xc], 0x12
add eax, 1
cmp eax, dword [edx + 8]
mov dword [esp + 0x10], eax
jl 0x5f5b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f5c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push esi
push 1
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x5f5c4c
xor ecx, ecx
jmp 0x5f5c54
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x105], eax
push edx
mov eax, edi
mov dword [edi + 0x109], ecx
call fcn.005f6680
mov bl, al
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 0x46]
lea esi, [edi + 0x36]
push ecx
mov byte [edi + 0x51], bl
mov dword [edi + 0x53], eax
call fcn.005f6710
movzx eax, bl
sub eax, 0
je 0x5f5ceb
sub eax, 1
je 0x5f5cc2
sub eax, 2
jne 0x5f5d2a
mov edx, dword [edi + 0x98]
mov al, byte [edi + 0x52]
mov byte [edx + 7], al
mov cl, byte [edi + 0x52]
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 0x98]
push eax
add cl, 1
push edi
mov byte [edx + 0x4011d], cl
call fcn.005f6230
jmp 0x5f5d2a
mov ecx, dword [edi + 0x98]
mov dl, byte [edi + 0x52]
mov byte [ecx + 7], dl
mov al, byte [edi + 0x52]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi + 0x98]
push edx
add al, 1
push edi
mov byte [ecx + 0x4011d], al
call fcn.005f60f0
jmp 0x5f5d2a
xor al, al
cmp byte [edi + 0x50], al
jbe 0x5f5d0f
mov edx, dword [edi + 0x98]
mov bl, byte [edi + 0x52]
movzx ecx, al
imul ecx, ecx, 0x40116
add al, 1
mov byte [ecx + edx + 7], bl
cmp al, byte [edi + 0x50]
jb 0x5f5cf2
cmp byte [edi], 2
jbe 0x5f5d20
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.005f5e20
jmp 0x5f5d2a
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.005f5fd0
mov ecx, 0x20
cmp dword [esi + 0xc], ecx
je 0x5f5d58
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
shr eax, 3
add eax, dword [esi]
bswap edx
mov dword [esi + 8], edx
mov dword [eax], edx
mov eax, ecx
sub eax, dword [esi + 0xc]
mov dword [esi + 0xc], ecx
add dword [esi + 4], eax
mov dword [esi + 8], 0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 7
shr ecx, 3
call fcn.005d9480
mov ebx, dword [ebp + 8]
mov word [edi + 0xa1], ax
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebx]
add edx, 7
shr edx, 3
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi]
push edx
mov dword [esi + 4], 0
call fcn.005d4700
mov ax, word [edi + 0xa1]
mov ch, al
push 0
mov cl, ah
lea eax, [esp + 0x14]
push eax
push 2
movzx edx, cx
mov word [edi + 0xa1], cx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
xor eax, eax
push ecx
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x5f5e00
mov dword [esp + 0x14], eax
sub eax, dword [edi + 0x105]
mov dword [edi + 0x10d], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
sub eax, dword [edi + 0x105]
mov ecx, dword [esp + 0x14]
pop esi
mov dword [esp + 0x10], ecx
mov dword [edi + 0x10d], eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5f73f0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
sub esp, 0x30
lea eax, [esi + 0x26]
mov dword [esp + 4], eax
mov al, byte [ecx + 2]
movzx dx, al
push edi
movzx edi, word [ecx + 0xe]
movzx eax, al
imul eax, edi
mov word [esp + 0x1a], dx
mov edx, dword [ecx + 4]
imul eax, edx
shr eax, 3
mov dword [esp + 0x20], eax
movzx eax, word [ecx + 0xe]
movzx cx, byte [ecx + 2]
mov dword [esp + 0x1c], edx
mov dx, ax
shr dx, 3
imul dx, cx
mov ecx, dword [esp + 0x38]
push 0
mov word [esp + 0x28], dx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [ecx]
mov word [esp + 0x2e], ax
push 0x2e
lea eax, [esp + 0x10]
push eax
push edx
mov dword [esp + 0x18], 0x46464952
mov dword [esp + 0x20], 0x45564157
mov dword [esp + 0x24], 0x20746d66
mov dword [esp + 0x28], 0x12
mov word [esp + 0x2c], 1
mov word [esp + 0x3c], 0
mov dword [esp + 0x3e], 0x61746164
mov dword [esp + 0x42], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
add esp, 0x30
ret 4

Function at 0x5f74a0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
sub esp, 0x30
mov cl, byte [eax + 2]
movzx dx, cl
push esi
movzx esi, word [eax + 0xe]
movzx ecx, cl
imul ecx, esi
mov word [esp + 0x1a], dx
mov edx, dword [eax + 4]
imul ecx, edx
mov dword [esp + 0x20], ecx
movzx ecx, word [eax + 0xe]
movzx ax, byte [eax + 2]
mov dword [esp + 0x1c], edx
mov dx, cx
shr dx, 3
imul dx, ax
mov eax, dword [esp + 0x38]
push 0
mov word [esp + 0x2a], cx
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [eax + 0x18]
mov word [esp + 0x2c], dx
push 0x2e
lea edx, [esp + 0x10]
push edx
push ecx
mov dword [esp + 0x18], 0x46464952
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0x45564157
mov dword [esp + 0x24], 0x20746d66
mov dword [esp + 0x28], 0x12
mov word [esp + 0x2c], 1
mov word [esp + 0x3c], 0
mov dword [esp + 0x3e], 0x61746164
mov dword [esp + 0x42], 0xffffffd9
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
add esp, 0x30
ret 4
Function at 0x604550
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, eax
call fcn.004c90f0
cmp eax, 0x2bc00000
jae 0x60456c
mov eax, 1
pop esi
add esp, 0x24
ret
cmp esi, 0xd
je 0x604585
cmp esi, 1
je 0x604585
cmp esi, 2
je 0x604585
cmp esi, 0x14
je 0x604585
cmp esi, 0x1c
jne 0x604562
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x7b6eec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x736614], 0
jne 0x6045b8
push 0x7b6eec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
pop esi
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
cmp esi, 0xd
sete cl
add ecx, 1
cmp dword [0x736614], 1
jne 0x60461d
test eax, eax
jge 0x6045fe
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
jg 0x604609
push 0x7b6eec
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x24
ret
mov esi, dword [esp + 0x18]
add esi, 0xffffffff
cmp ecx, esi
jle 0x604632
push 0x7b6eec
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x24
ret
test eax, eax
jl 0x604609
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
mov esi, ecx
jg 0x604632
mov esi, eax
push 0x7b6eec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x24
ret

Function at 0x6056d0
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
xor ebp, ebp
test byte [0x7b8078], 1
jne 0x6056fb
or dword [0x7b8078], 1
push esi
mov esi, 0x7b7e70
mov word [0x7b7e70], bp
call fcn.004ac170
pop esi
push 0x6bc0cc
push ebx
push edi
mov eax, 0x7b7e70
call fcn.004ad3a0
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
xor ecx, ecx
cmp ax, bp
lea edx, [ebx + 2]
je 0x60573f
cmp ecx, 0x103
jae 0x60573f
mov word [edi + ecx*2 + 0x208], ax
movzx eax, word [edx]
add ecx, 1
add edx, 2
cmp ax, bp
jne 0x605721
mov word [edi + ecx*2 + 0x208], bp
pop ebp
mov eax, edi
pop ebx
ret 4