joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65271060
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x114
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x124]
mov ebp, ecx
push ebx
push ebx
push esi
mov dword [ebp], 0x6529c558
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ebx
call fcn.652677a0
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
je 0x652710cf
push eax
call fcn.65267760
lea edx, [esp + 0x1c]
add esp, 4
mov dword [ebp + 4], 0xffffffff
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x652710c0
jmp 0x65271193
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.65267b80
add esp, 0xc
call fcn.6527ba86
mov dword [eax], ebx
cmp byte [esp + 0x18], bl
jne 0x65271193
cmp dword [esp + 0x128], ebx
je 0x65271180
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
push str.SoftwareODBCODBC.INIODBC_File_DSN
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65271180
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x6529c520
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x65271156
push edi
lea edi, [esp + 0x1c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x65271165
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x65271193
push 0x104
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.65268020
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.6526d310
add esp, 4
mov dword [ebp + 0x10], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x114
ret 0xc
Function at 0x65272ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push edi
push 0
mov esi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x9c]
dec eax
push 0
mov dword [esp + 0x1c], eax
dec ecx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0xa0]
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x65273045
mov byte [ebx], 0
mov byte [edi], 0
pop edi
pop esi
pop ebx
pop ecx
ret 0x10
mov eax, dword [esi + 0xa0]
inc eax
pop edi
mov dword [esi + 0xa0], eax
pop esi
pop ebx
pop ecx
ret 0x10

Function at 0x65273460
Capabilities:
Check if file exists

Disassembly:
mov dword [esp + 8], pe_nt_image_headers32
jmp fcn.65267750

Function at 0x65273b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi + 0xe]
mov eax, dword [edi]
test cl, 1
mov cl, byte [eax]
lea esi, [ebp + 2]
je 0x65273b78
mov dl, byte [edi + 0x10]
add dl, 0x3b
xor cl, dl
inc eax
test cl, cl
je 0x65273b66
mov byte [esi], cl
mov cl, byte [eax]
add dl, 0x3b
inc esi
xor cl, dl
inc eax
test cl, cl
jne 0x65273b57
sub esi, ebp
sub esi, 2
mov byte [edi + 0x10], dl
mov word [ebp], si
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret
inc eax
test cl, cl
je 0x65273b8a
lea ecx, [ecx]
mov byte [esi], cl
mov cl, byte [eax]
inc esi
inc eax
test cl, cl
jne 0x65273b80
sub esi, ebp
sub esi, 2
mov word [ebp], si
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret

Function at 0x65275080
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
mov cl, byte [esi + 0x16]
add edx, eax
cmp eax, edx
jae 0x652750a5
push ebx
mov bl, byte [eax]
add cl, 0x3b
xor bl, cl
mov byte [eax], bl
inc eax
cmp eax, edx
jb 0x65275096
pop ebx
mov byte [esi + 0x16], cl
pop esi
ret

Function at 0x652750b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x10]
push ebx
movzx ebx, word [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov ebp, ecx
shr ecx, 2
push edi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + eax]
cmp eax, ecx
jae 0x652750fa
nop
mov bl, byte [eax]
add dl, 0x3b
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x652750e0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [eax + 0x10], dl
pop ebx
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [ecx + 0x10], dl
pop ebx
ret
Function at 0x65276df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
push edi
call fcn.652792f0
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x40], eax
xor eax, eax
push eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x70], eax
call fcn.65279370
mov ebp, dword [esp + 0x90]
lea ecx, [esp + 0x1c]
mov ebx, 1
mov dword [esp + 0x14], ecx
mov eax, dword [esi + 0x18]
mov cx, word [eax + 4]
mov word [esi + 0x22], cx
mov cl, byte [esi + 0x26]
lea edx, [esp + 0x24]
mov dword [esp + 0x10], edx
mov dx, word [eax + 2]
mov word [esi + 0x24], dx
mov ax, word [eax]
and cl, 8
mov word [esi + 0x1c], ax
xor eax, eax
mov ax, word [esi + 0x20]
neg cl
mov edi, 1
push edi
push 8
mov edx, eax
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 8
imul cx, word [esi + 0x22]
movzx eax, ax
push eax
lea eax, [esp + 0x3c]
sub edx, ecx
lea ecx, [esp + 0x1c]
push ecx
mov word [esi + 0x1e], dx
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, esi
call fcn.652766f0
test eax, eax
je 0x65276f76
mov ecx, dword [esp + 0x20]
xor edx, edx
mov dl, byte [esi + 0x26]
mov dword [esp + 0x48], ecx
mov cx, word [esp + 0x1e]
movzx eax, cx
mov byte [esp + 0x44], cl
shr edx, 1
and edx, 1
mov dword [esp + 0x60], edx
mov edx, eax
shr edx, 0xd
and edx, 1
mov dword [esp + 0x54], edx
mov edx, eax
shr edx, 0xc
and edx, 1
mov dword [esp + 0x58], edx
mov edx, eax
shr edx, 0xb
and edx, 1
mov dword [esp + 0x4c], edx
mov edx, eax
shr edx, 0xa
and edx, 1
mov dword [esp + 0x50], edx
mov edx, eax
shr eax, 9
and eax, 1
shr edx, 8
and edx, 1
mov dword [esp + 0x64], eax
movzx eax, word [esp + 0x1c]
mov dword [esp + 0x5c], edx
add eax, dword [esi + 0x18]
cmp ebx, 1
mov dword [esp + 0x2c], eax
jne 0x65276f2e
cmp edi, ebx
jne 0x65276f2e
mov ecx, dword [eax]
mov dword [esp + 0x68], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x70], edx
jmp 0x65276f4f
mov ecx, dword [esp + 0x8c]
lea eax, [esp + 0x2c]
push eax
push ebp
push ecx
call dword [esp + 0x94]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jne 0x65276f76
add dword [esp + 0x6c], ecx
movzx edx, word [esi + 0x20]
inc edi
push edi
push 8
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
call fcn.652766f0
test eax, eax
jne 0x65276ea2
cmp ebx, dword [esp + 0x18]
je 0x65276f8f
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x1c]
inc eax
push eax
call fcn.65279370
inc ebx
jmp 0x65276e33
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 0xc
Function at 0x65279c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
cmp esi, edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 0x100]
movzx edx, byte [eax + 0x101]
mov dword [esp + 0x10], edi
je 0x65279ceb
push ebx
push ebp
jmp 0x65279ca0
mov ecx, dword [esp + 0x14]
nop
lea edi, [ecx + 1]
and edi, 0xff
mov bl, byte [edi + eax]
movzx ebp, bl
xor ecx, ecx
add edx, ebp
and edx, 0xff
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
mov byte [edx + eax], bl
mov bl, byte [esi]
mov dword [esp + 0x14], edi
add ecx, ebp
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, bl
mov byte [esi], cl
movzx ecx, bl
add edx, ecx
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, ecx
jne 0x65279c9b
mov cl, byte [esp + 0x14]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
ret

Function at 0x6527b030
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov al, byte [ebp]
push esi
mov esi, dword [esp + 0x1c]
cmp ebp, esi
push edi
mov byte [esp + 0x13], 0xad
mov byte [esp + 0x1c], al
jb 0x6527b060
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x20]
jmp 0x6527b060
mov eax, dword [esp + 0x18]
inc ebp
cmp eax, ebp
jbe 0x6527b071
cmp eax, esi
jb 0x6527b199
cmp ebp, esi
mov bl, byte [esp + 0x1c]
jae 0x6527b080
mov cl, byte [ebp]
mov byte [esp + 0x1c], cl
test bl, bl
jns 0x6527b0f6
movzx cx, byte [esp + 0x1c]
movzx dx, bl
shl edx, 8
add edx, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jae 0x6527b0a3
mov cl, byte [ebp]
mov byte [esp + 0x1c], cl
test bl, 0x40
je 0x6527b0ba
mov ecx, edx
shr edx, 9
and ecx, 0x1ff
and edx, 0x1f
mov edi, edx
jmp 0x6527b0ca
mov edi, edx
shr edx, 9
and edi, 0x1ff
and edx, 0x1f
mov ecx, edx
movzx edi, di
add ecx, 3
mov edx, eax
mov esi, ecx
sub edx, edi
jmp 0x6527b0e0
mov bl, byte [edx]
mov byte [edi + edx], bl
add esi, 0xffff
inc edx
test si, si
jne 0x6527b0e0
jmp 0x6527b180
test bl, 0x40
je 0x6527b135
mov dl, bl
shr dl, 3
and dl, 7
movzx cx, dl
and bl, 7
movzx di, bl
add ecx, 3
mov esi, ecx
lea edx, [edi + ecx]
movzx ebx, dx
mov edx, eax
sub edx, ebx
add edi, ecx
movzx edi, di
mov bl, byte [edx]
mov byte [edi + edx], bl
add esi, 0xffff
inc edx
test si, si
jne 0x6527b122
jmp 0x6527b180
test bl, bl
jne 0x6527b13f
mov ecx, esi
sub ecx, ebp
jmp 0x6527b150
and bl, 0x3f
movzx cx, bl
movzx eax, cx
mov dl, byte [eax + ebp]
mov byte [esp + 0x1c], dl
mov esi, dword [esp + 0x18]
mov bl, byte [esp + 0x13]
mov edi, ebp
movzx eax, cx
sub edi, esi
nop
mov dl, byte [edi + esi]
xor dl, bl
add bl, dl
mov byte [esi], dl
inc esi
dec eax
jne 0x6527b160
mov bl, byte [esp + 0x13]
movzx eax, cx
inc bl
add ebp, eax
mov eax, dword [esp + 0x18]
mov byte [esp + 0x13], bl
movzx ecx, cx
add eax, ecx
cmp ebp, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jb 0x6527b057
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x6527dc2d
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x6527dd1a
mov eax, 0x94
call fcn.6527c5f0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x6527dd8f
mov ecx, dword [esi + 0x10]
mov dword [0x652fb3e8], ecx
mov eax, dword [esi + 4]
mov dword [0x652fb3f4], eax
mov edx, dword [esi + 8]
mov dword [0x652fb3f8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x652fb3ec], esi
je 0x6527dc98
or esi, 0x8000
mov dword [0x652fb3ec], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x652fb3f0], eax
call fcn.65282cc8
test eax, eax
pop ecx
je 0x6527dd8f
call fcn.65280cc7
test eax, eax
jne 0x6527dcc5
call fcn.65282d19
jmp 0x6527dd8f
call fcn.65284a4b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x652fcc10], eax
call fcn.65284929
mov dword [0x652fb3b4], eax
call fcn.6528440a
test eax, eax
jl 0x6527dd13
call fcn.65284887
test eax, eax
jl 0x6527dd0e
call fcn.65284654
test eax, eax
jl 0x6527dd0e
call fcn.65280070
test eax, eax
jne 0x6527dd0e
inc dword [0x652fb3b0]
jmp 0x6527dda0
call fcn.65284608
call fcn.65280aba
jmp 0x6527dcbb
test eax, eax
jne 0x6527dd4a
cmp dword [0x652fb3b0], eax
jle 0x6527dd8f
dec dword [0x652fb3b0]
cmp dword [0x652fb424], eax
jne 0x6527dd39
call fcn.652801ca
call fcn.65284608
call fcn.65280aba
call fcn.65282d19
jmp 0x6527dda0
cmp eax, 2
jne 0x6527dd93
push 0x88
push 1
call fcn.6527d096
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x6527dd8f
push esi
push dword [0x652ed234]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x6527dd89
call fcn.65280ad8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x6527dda0
call fcn.6527ce78
pop ecx
xor eax, eax
jmp 0x6527dda3
cmp eax, 3
jne 0x6527dda0
push 0
call fcn.65280b5c
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x6527e075
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x6527e095
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.6527ba98
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x6527e0b8
test byte [esp + 8], 2
je 0x6527e0b8
call fcn.6527ba86
mov dword [eax], 0xd
call fcn.6527ba8f
mov dword [eax], 5
jmp 0x6527e091
xor eax, eax
ret

Function at 0x6527e0bb
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6527e0e8
test byte [esp + 8], 0x80
je 0x6527e0d6
and eax, 0xfffffffe
jmp 0x6527e0d9
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x6527e0f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.6527ba98
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x6527e35b
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x6527e37c
lea eax, [ebp - 4]
push eax
call fcn.65284e03
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call fcn.65284c83
test eax, eax
pop ecx
jne 0x6527e39d
call fcn.6527ba86
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x6527e49e
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x6527e48f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x6527e48f
push edi
call fcn.65284c83
test eax, eax
pop ecx
je 0x6527e48f
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x6527e48f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x6527e48f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call fcn.6527e964
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x6527e48f
xor eax, eax
jmp 0x6527e49d
call fcn.6527ba86
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x6527eb87
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x6527ed4d
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x652fb880]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x6527ed4d
test cl, 0x48
je 0x6527ebed
mov al, byte [eax + 5]
cmp al, 0xa
je 0x6527ebed
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6527ec3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x6527ec27
call fcn.6527ba86
mov dword [eax], 9
call fcn.6527ba8f
mov dword [eax], esi
jmp 0x6527ec37
cmp eax, 0x6d
je 0x6527ed4d
push eax
call fcn.6527ba98
pop ecx
or eax, 0xffffffff
jmp 0x6527ed4f
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x6527ed48
test edx, edx
je 0x6527ec62
cmp byte [ebx], 0xa
jne 0x6527ec62
or al, 4
jmp 0x6527ec64
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x6527ed42
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x6527ed32
cmp al, 0xd
je 0x6527ec98
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x6527ed24
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x6527ecb2
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x6527ecad
add dword [ebp + 0x10], 2
jmp 0x6527ed06
mov dword [ebp + 0x10], eax
jmp 0x6527ed20
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6527ecda
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6527ed20
cmp dword [ebp - 0xc], 0
je 0x6527ed20
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x6527ecfb
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x6527ed06
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x6527ed23
cmp ebx, dword [ebp + 0xc]
jne 0x6527ed0b
cmp byte [ebp - 1], 0xa
jne 0x6527ed0b
mov byte [ebx], 0xa
jmp 0x6527ed23
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.65283d98
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x6527ed24
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x6527ec7c
jmp 0x6527ed42
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x6527ed42
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x6527ed4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6527ee12
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x652ed7b0]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x6527ee3b
xor eax, eax
jmp 0x6527efa9
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x652fb880]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x6527ee6e
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.6527e21a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x6527ef40
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x6527ef7b
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x6527eec9
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x6527eeba
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x6527ee9d
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6527ef09
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x6527ef12
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x6527ee8e
jmp 0x6527ef14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x6527efa4
cmp dword [ebp - 8], edi
je 0x6527ef7b
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x6527ef6d
call fcn.6527ba86
mov dword [eax], 9
call fcn.6527ba8f
mov dword [eax], esi
jmp 0x6527ef76
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6527ef62
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x6527ef14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x6527ef14
push dword [ebp - 8]
call fcn.6527ba98
pop ecx
or eax, 0xffffffff
jmp 0x6527efa7
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x6527ef90
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x6527ef90
xor eax, eax
jmp 0x6527efa7
call fcn.6527ba86
mov dword [eax], 0x1c
call fcn.6527ba8f
mov dword [eax], edi
jmp 0x6527ef76
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.65285043
leave
ret
Function at 0x6527ff9d
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x6527ffb9
call fcn.6527ba86
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x6528002b
push esi
push 0x88
push 1
call fcn.6527d096
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x65280011
push esi
call fcn.65280ad8
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x6527fefd
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x65280009
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x65280028
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.6527ce78
test ebx, ebx
pop ecx
je 0x65280023
push ebx
call fcn.6527ba98
pop ecx
or eax, 0xffffffff
jmp 0x6528002a
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x652800d5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.65282c7d
xor esi, esi
inc esi
cmp dword [0x652fb428], esi
pop ecx
jne 0x652800fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x652fb424], esi
mov byte [0x652fb420], al
jne 0x65280163
mov ecx, dword [0x652fcc08]
test ecx, ecx
je 0x65280144
mov eax, dword [0x652fcc04]
sub eax, 4
cmp eax, ecx
jmp 0x6528013d
mov eax, dword [eax]
test eax, eax
je 0x6528012f
call eax
mov eax, dword [0x652fcc04]
sub eax, 4
cmp eax, dword [0x652fcc08]
mov dword [0x652fcc04], eax
jae 0x65280127
mov eax, 0x652a1034
mov esi, 0x652a1040
cmp eax, esi
mov edi, eax
jae 0x65280163
mov eax, dword [edi]
test eax, eax
je 0x6528015c
call eax
add edi, 4
cmp edi, esi
jb 0x65280154
mov eax, 0x652a1044
mov esi, 0x652a1048
cmp eax, esi
mov edi, eax
jae 0x65280182
mov eax, dword [edi]
test eax, eax
je 0x6528017b
call eax
add edi, 4
cmp edi, esi
jb 0x65280173
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x65280193
push 8
call fcn.65282be9
jmp 0x652801a5
push dword [ebp + 8]
mov dword [0x652fb428], 1
call fcn.6528002e
pop ecx
pop ebp
ret