joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56aa13
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x64006c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
push ecx
mov eax, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x56aa6b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x1c]
push edi
call fcn.0054fa0f
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x56aa8d
push str.Error_accept__ing_server_connect
push ebx
call fcn.0054f0a4
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x56aaf8
push str.Connection_accepted_from_server_n
push ebx
call fcn.0054f17a
and dword [edi + 0x284], 0xfffff7ff
push 1
push esi
mov dword [edi + 0x1ac], esi
call fcn.005735db
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x610], 0
je 0x56aaf6
push 1
push ebx
call fcn.00542a7e
push 1
push esi
push dword [ebx + 0x614]
call dword [ebx + 0x610]
push 0
push ebx
mov esi, eax
call fcn.00542a7e
add esp, 0x1c
test esi, esi
je 0x56aaf6
push edi
call fcn.0056ae96
pop ecx
push 0x2a
jmp 0x56aa8a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c2344
mov esp, ebp
pop ebp
ret

Function at 0x56c9ca
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x56c9f6
push str.Couldnt_set_desired_mode
push edx
call fcn.0054f0a4
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x56ca4a
cmp ecx, 0xc8
je 0x56ca0d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0054f17a
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x56ca1e
push edi
call fcn.0056c777
pop ecx
jmp 0x56ca46
cmp eax, 0x14
jne 0x56ca2b
push edi
call fcn.0056b923
jmp 0x56ca1b
cmp eax, 0x15
jne 0x56ca34
push 0xd
jmp 0x56ca3b
cmp eax, 0x16
jne 0x56ca48
push 0xe
push 1
push edi
call fcn.0056c372
add esp, 0xc
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x576f4e
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x576f5e
sub esi, ecx
cmp esi, 0x7fffffff
jbe 0x576f77
push 0x1b
pop eax
jmp 0x57703d
push edi
test esi, esi
je 0x576f88
lea eax, [esi + esi]
push eax
call dword [0x6662b4]
jmp 0x576f93
push 0x61e4b8
call dword [0x6662c0]
mov edi, eax
pop ecx
test edi, edi
jne 0x576fa2
push 0x1b
pop eax
jmp 0x57703c
xor edx, edx
mov ecx, edx
test esi, esi
je 0x576fb9
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], dl
inc ecx
cmp ecx, esi
jb 0x576faa
push 0xf0000000
push 1
push edx
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x57702a
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x57701f
push 0
lea eax, [esi + esi]
mov dword [ebp - 0xc], 0x10
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x6662b8]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x577043
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x64006c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0xf0000000
inc ebx
mov dword [ebp - 0x28], eax
push ebx
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 8
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x577087
xor al, al
jmp 0x577119
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.00577129
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0057a050
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop edi
test eax, eax
jne 0x5770e0
xor bl, bl
jmp 0x57710c
mov ecx, dword [ebp + 8]
push dword [ebp - 0x1c]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push eax
push esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004c2344
mov esp, ebp
pop ebp
ret
Function at 0x57b0a5
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6662b4]
mov edi, eax
pop ecx
test edi, edi
je 0x57b191
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x57b10e
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x57b114
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x57b189
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
sub ebx, 1
jne 0x57b12e
mov ebx, dword [ebp - 8]
jmp 0x57b189
push 1
push 0x60d787
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x60d788
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x57b16b
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x597894
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp byte [edi + 0xe5], 2
jne 0x597917
push dword [edi + 0x14]
push dword [edi + 0x10]
push str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
call fcn.00581357
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x597914
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
push ecx
push esi
push 1
push 0xffffffffffffffff
push eax
push dword [edi + 0xc]
call fcn.005b5d57
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x597909
push ebx
push dword [ebp + 8]
call fcn.00583ca3
push dword [ebp + 8]
lea ebx, [eax - 0x64]
neg ebx
sbb ebx, ebx
inc ebx
call fcn.0057b6c7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x597908
mov byte [edi + 0xe5], bl
pop ebx
push dword [ebp - 4]
call fcn.0058157f
pop ecx
jmp 0x597917
push 7
pop esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x597d58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebx]
mov eax, edi
mov ecx, dword [ebx + 4]
or eax, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], ecx
je 0x597ebf
mov eax, edi
xor esi, esi
and eax, 1
mov dword [ebp - 0xc], esi
or eax, esi
jne 0x597dac
mov ebx, ecx
inc esi
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x597d89
mov dword [ebp - 0xc], esi
and dword [ebp - 8], 0
xor edx, edx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
dec eax
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, dword [ebp - 4]
or edx, ecx
jne 0x597dfd
mov ebx, dword [ebp - 4]
mov esi, eax
inc dword [ebp - 8]
xor edx, edx
dec esi
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x597dd7
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 8]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x597ebf
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
mov eax, dword [eax + 0x24]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
call fcn.005b15c8
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x597ec1
mov edi, dword [ebp - 0x14]
add edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 8], edi
jge 0x597e7d
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [ebx + 0x14]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x597e4a
push dword [ebp - 0xc]
mov eax, ebx
call dword [eax + 0x10]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp + 0x20]
pop ecx
test esi, esi
je 0x597e99
cmp esi, 0x65
je 0x597e99
mov eax, esi
jmp 0x597ec1
xor ecx, ecx
cmp esi, 0x65
sete cl
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
test ecx, ecx
jle 0x597ebf
mov esi, dword [ebp + 0x1c]
mov eax, edi
mov edx, dword [ebp - 4]
add dword [esi], ecx
call fcn.0053cc60
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a75c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
movsx edx, word [ebx + 0x4c]
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebx + edx*4 + 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ax, word [ebx + edx*2 + 0x4e]
cmp ax, word [ecx + 0x12]
jae 0x5a77a0
cmp byte [ebx + 0x49], 1
jne 0x5a77a0
mov esi, dword [ebx + edx*4 + 0x78]
movzx ecx, ax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2]
movzx eax, byte [eax + ecx*2 + 1]
shl edi, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x5a7648
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
call fcn.005a88fb
pop ecx
pop ecx
test eax, eax
jne 0x5a77a3
push ebx
push dword [ebx + 0x3c]
push dword [ebp - 0xc]
call fcn.005a320a
add esp, 0xc
test eax, eax
jne 0x5a77a3
cmp dword [ebx + 0x10], eax
jne 0x5a7676
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebp - 4]
call fcn.0059afa6
add esp, 0x10
push dword [esi + 0x44]
call fcn.005b8054
pop ecx
test eax, eax
jne 0x5a77a3
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.005887ce
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0x10]
push esi
call fcn.0058c378
mov eax, dword [ebp - 8]
add esp, 0x1c
test eax, eax
jne 0x5a77a3
cmp byte [esi + 5], al
jne 0x5a774f
movsx eax, word [ebx + 0x4c]
mov edx, dword [ebx + eax*4 + 0x78]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], edx
movzx ecx, word [edx + 0x12]
mov eax, dword [ebx + eax*4 + 0x7c]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 0x40]
movzx ebx, byte [eax + ecx*2 - 2]
movzx eax, byte [eax + ecx*2 - 1]
shl ebx, 8
or ebx, eax
movzx eax, word [edx + 0x14]
and ebx, eax
add ebx, dword [edx + 0x38]
push ebx
push edx
call fcn.00587d97
movzx edi, ax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x50]
mov eax, dword [ebp - 4]
push dword [eax + 0x44]
call fcn.005b8054
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
lea eax, [edi + 4]
push esi
push eax
lea eax, [ebx - 4]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call fcn.0059ad61
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push edi
movzx eax, word [ecx + 0x12]
dec eax
push eax
push ecx
call fcn.0058c378
mov eax, dword [ebp - 8]
add esp, 0x38
test eax, eax
jne 0x5a77a3
mov ebx, dword [ebp + 8]
push ebx
call fcn.00585e42
mov edi, eax
pop ecx
test edi, edi
jne 0x5a779c
movsx ecx, word [ebx + 0x4c]
mov esi, dword [ebp - 0x14]
cmp ecx, esi
jle 0x5a7795
movzx ecx, word [ebx + 0x4c]
movsx eax, cx
mov edx, dword [ebx + eax*4 + 0x78]
lea eax, [ecx - 1]
push edx
mov word [ebx + 0x4c], ax
call fcn.005a1dca
movsx eax, word [ebx + 0x4c]
pop ecx
cmp eax, esi
jg 0x5a7767
push ebx
call fcn.00585e42
mov edi, eax
pop ecx
test edi, edi
jne 0x5a779c
push ebx
call fcn.0059c62f
pop ecx
mov eax, edi
jmp 0x5a77a3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a7971
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x28]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp + 0x28], ebx
cmp byte [esi + 0x49], 4
mov eax, dword [esi]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jne 0x5a79a0
mov eax, dword [esi + 0x44]
jmp 0x5a7b26
push esi
push dword [esi + 0x3c]
push eax
call fcn.005a320a
add esp, 0xc
test eax, eax
jne 0x5a7b26
xor edx, edx
push edi
mov edi, dword [ebp + 0x14]
cmp dword [esi + 0x10], edx
jne 0x5a79fd
push edx
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0059afa6
add esp, 0x10
test byte [esi + 0x48], 2
je 0x5a79fd
xor edx, edx
cmp edi, edx
jl 0x5a79fd
jg 0x5a79e3
cmp dword [ebp + 0x10], edx
jbe 0x5a79fd
mov eax, dword [ebp + 0x10]
mov ecx, edi
sub eax, 1
sbb ecx, edx
cmp dword [esi + 0x18], eax
jne 0x5a79fd
cmp dword [esi + 0x1c], ecx
jne 0x5a79fd
or ebx, 0xffffffff
mov dword [ebp + 0x28], ebx
test ebx, ebx
jne 0x5a7a23
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x24]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0058777d
add esp, 0x18
test eax, eax
jne 0x5a7b25
mov ebx, dword [ebp + 0x28]
movsx eax, word [esi + 0x4c]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
mov edi, dword [esi + eax*4 + 0x78]
push dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [eax + 0x50]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push eax
push edi
call fcn.0058de01
mov ecx, eax
add esp, 0x24
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x5a7b23
movsx ecx, word [esi + 0x4c]
movzx edx, word [esi + ecx*2 + 0x4e]
mov eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x5a7b2c
push dword [edi + 0x44]
call fcn.005b8054
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x5a7b23
mov eax, dword [edi + 0x40]
mov ebx, dword [ebp - 4]
movzx ecx, byte [eax + ebx*2]
movzx eax, byte [eax + ebx*2 + 1]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
cmp byte [edi + 5], 0
jne 0x5a7ab4
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov dword [edx], eax
lea eax, [ebp + 0x28]
push eax
push ecx
push edi
call fcn.005887ce
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
movzx eax, word [ebp + 0x28]
push eax
push ebx
push edi
call fcn.0058c378
mov ecx, dword [ebp + 8]
add esp, 0x1c
test ecx, ecx
jne 0x5a7b23
mov eax, ebx
xor ebx, ebx
lea ecx, [ebp + 8]
push ecx
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
push edi
call fcn.0059ad61
mov ecx, dword [ebp + 8]
xor eax, eax
add esp, 0x1c
mov word [esi + 0x2c], ax
test ecx, ecx
jne 0x5a7b23
cmp byte [edi + 1], al
je 0x5a7b23
and byte [esi + 0x48], 0xfd
push esi
call fcn.00585e42
pop ecx
mov ecx, eax
movsx eax, word [esi + 0x4c]
mov eax, dword [esi + eax*4 + 0x78]
mov byte [eax + 1], bl
mov byte [esi + 0x49], bl
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jns 0x5a7ade
xor ebx, ebx
cmp word [edi + 0x12], bx
jbe 0x5a7ae0
lea eax, [edx + 1]
mov word [esi + ecx*2 + 0x4e], ax
movzx eax, ax
jmp 0x5a7ae0
Function at 0x5ae489
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x5ae49e
xor eax, eax
jmp 0x5ae584
push edi
push 0
push 8
push dword [ebp + 8]
call fcn.005aaaa1
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xc], edi
test edi, edi
je 0x5ae583
test byte [ebp + 0x10], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x5ae4d2
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x5ae4d2
add eax, eax
cmp eax, dword [esi]
jl 0x5ae4cc
imul eax, eax, 0x18
push ebx
push 0
push eax
push dword [ebp + 8]
call fcn.005aaaa1
mov ebx, eax
add esp, 0xc
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x5ae4ff
push edi
push dword [ebp + 8]
call fcn.005aaa51
pop ecx
pop ecx
xor eax, eax
jmp 0x5ae582
and dword [ebp - 4], 0
cmp dword [esi], 0
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
jle 0x5ae580
mov edi, dword [ebp - 8]
lea eax, [ebx + 0x10]
mov dword [ebp + 0xc], eax
sub ebx, edi
push 0
push dword [ebp + 0x10]
push dword [edi]
push dword [ebp + 8]
call fcn.0058d84a
mov dword [ebx + edi], eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.005aacb0
mov ecx, dword [ebp + 0xc]
mov dword [ecx - 0xc], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.005aacb0
mov ecx, dword [ebp + 0xc]
lea edi, [edi + 0x18]
add esp, 0x20
mov dword [ecx - 8], eax
mov al, byte [edi - 0xc]
and dword [ecx], 0xfffffffe
mov byte [ecx - 4], al
mov eax, dword [edi - 8]
xor eax, dword [ecx]
and eax, 2
xor dword [ecx], eax
mov eax, dword [edi - 4]
mov dword [ecx + 4], eax
add ecx, 0x18
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], eax
cmp eax, dword [esi]
jl 0x5ae519
mov edi, dword [ebp - 0xc]
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401b50
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x41e494]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x41825c
mov dword [ebp - 0x808], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x401bac
push 0x41b074
push 0x400
push 0x420d48
call fcn.00406d38
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406d29
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push esi
push ecx
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.00406d38
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0x420d48
call fcn.00406d38
mov ecx, dword [ebp - 0x808]
add esp, 0x18
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x41b0e0
push 0x400
push 0x420d48
call fcn.00407b0d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
push 0x420d48
call esi
cmp eax, 0xffffffff
je 0x401c18
test al, 0x10
jne 0x401c65
push 0
push 0x420d48
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401c4f
push 0x41b074
push 0x400
push 0x420d48
call fcn.00406d38
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406d29
mov esp, ebp
pop ebp
ret
push 0x420d48
call esi
or eax, 2
push eax
push 0x420d48
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406d29
mov esp, ebp
pop ebp
ret

Function at 0x401c80
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, 0x41b074
mov eax, 0x420d48
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401cb6
test dx, dx
je 0x401cb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401cb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401c90
xor eax, eax
jmp 0x401cbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401cd7
push 0x41b074
push 0x400
push 0x421548
call fcn.00406d38
add esp, 0xc
ret
push esi
push 0x420d48
push 0x400
push 0x421548
call fcn.00406d38
push 0x41b0f4
push 0x400
push 0x421548
call fcn.00407b0d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x421548
call esi
cmp eax, 0xffffffff
je 0x401d19
test al, 0x10
jne 0x401d59
push 0
push 0x421548
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401d43
push 0x41b074
push 0x400
push 0x421548
call fcn.00406d38
add esp, 0xc
pop esi
ret
push 0x421548
call esi
or eax, 2
push eax
push 0x421548
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x401d60
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, 0x41b074
mov eax, 0x420d48
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401d96
test dx, dx
je 0x401d92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401d96
add eax, 4
add ecx, 4
test dx, dx
jne 0x401d70
xor eax, eax
jmp 0x401d9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401db7
push 0x41b074
push 0x400
push 0x421d48
call fcn.00406d38
add esp, 0xc
ret
push esi
push 0x420d48
push 0x400
push 0x421d48
call fcn.00406d38
push 0x41b100
push 0x400
push 0x421d48
call fcn.00407b0d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x421d48
call esi
cmp eax, 0xffffffff
je 0x401df9
test al, 0x10
jne 0x401e39
push 0
push 0x421d48
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401e23
push 0x41b074
push 0x400
push 0x421d48
call fcn.00406d38
add esp, 0xc
pop esi
ret
push 0x421d48
call esi
or eax, 2
push eax
push 0x421d48
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x401e40
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, 0x41b074
mov eax, 0x420d48
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401e76
test dx, dx
je 0x401e72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401e76
add eax, 4
add ecx, 4
test dx, dx
jne 0x401e50
xor eax, eax
jmp 0x401e7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401e97
push 0x41b074
push 0x400
push 0x422548
call fcn.00406d38
add esp, 0xc
ret
push esi
push 0x420d48
push 0x400
push 0x422548
call fcn.00406d38
push 0x41b10c
push 0x400
push 0x422548
call fcn.00407b0d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x422548
call esi
cmp eax, 0xffffffff
je 0x401ed9
test al, 0x10
jne 0x401f19
push 0
push 0x422548
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401f03
push 0x41b074
push 0x400
push 0x422548
call fcn.00406d38
add esp, 0xc
pop esi
ret
push 0x422548
call esi
or eax, 2
push eax
push 0x422548
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret