joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51602a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x64c]
test al, al
jne 0x516043
mov eax, str.ostatus
jmp 0x516087
cmp al, 1
jne 0x51604c
lea eax, [ebx + 4]
jmp 0x516087
cmp al, 2
jne 0x516083
mov al, byte [ebx + 0x64d]
cmp al, 1
jne 0x51605f
lea eax, [ebx + 4]
jmp 0x516087
cmp al, 2
jne 0x51606a
mov eax, str.omessage
jmp 0x516087
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.00539518
add esp, 8
test eax, eax
jne 0x516080
mov eax, esi
jmp 0x516087
inc eax
jmp 0x516087
xor eax, eax
jmp 0x5160e2
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b8ec
push eax
push str.timestamp
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x55b8f0
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x5160c0
xor eax, eax
jmp 0x5160e2
push 0x55b8f5
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x5160dd
mov eax, 1
jmp 0x5160e2
mov eax, 2
pop esi
pop ebx
pop ebp
ret 4
Function at 0x51a802
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
mov ax, 0x101
push esp
push eax
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x51a841
push 0x10
push str.mIRC32
push ebx
call fcn.0051a7ac
push eax
push dword [0x55b3c8]
call sub.USER32.dll_MessageBoxA
mov dword [0x55bb68], 1
xor eax, eax
jmp 0x51a850
mov dword [0x55bb68], 1
mov eax, 1
add esp, 0x190
pop ebx
ret

Function at 0x51b0c9
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
push edi
mov dword [0x55bb64], 1
mov esi, 0x57a469
mov edi, 0x5577b8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x557884], 0
jne 0x51b12d
cmp byte [0x5577b8], 0
je 0x51b12d
push 0
push 0x1774
call fcn.0041c35b
push eax
push 0x5577b8
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x51b16d
push 0x64
push 0x5577b8
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x51b16d
push 0
push 0x1774
call fcn.0041c35b
mov edi, eax
mov esi, 0x5577b8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x55bb64], 0
jne 0x51b17d
xor eax, eax
jmp 0x51b30d
cmp dword [0x557888], 0
jne 0x51b1bf
cmp dword [0x557880], 0
je 0x51b1bf
mov eax, 0x5577b8
mov edx, 0x57a469
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x51b1b9
test cl, cl
je 0x51b30b
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x51b1b9
add eax, 2
add edx, 2
test cl, cl
jne 0x51b199
je 0x51b30b
push 0
push 0x1774
call fcn.0041c35b
push eax
push 0x5577b8
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x51b261
push 0
push 0x1774
call fcn.0041c35b
mov edi, eax
mov esi, 0x55781c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [0x557880], eax
cmp dword [0x54e370], 0
je 0x51b25a
mov dword [0x558960], 1
push dword [0x54d2a0]
push 0
push 0x1779
call fcn.0041c35b
push eax
push dword [0x55b3d8]
call fcn.004e0c3e
mov dword [0x55bb6c], 1
push 1
call fcn.0051ac4a
xor eax, eax
jmp 0x51b30d
cmp dword [0x55bb64], 0
jne 0x51b271
xor eax, eax
jmp 0x51b30d
push 0x400
push 0
push 0x58d13c
call fcn.00539438
add esp, 0xc
push 0x400
push 0x58d13c
push 0x5577b8
push 0x40a
push dword [0x55b3c8]
call sub.WSOCK32.dll_WSAAsyncGetHostByName
mov ebx, eax
mov dword [0x55bb60], ebx
test ebx, ebx
jne 0x51b30b
cmp dword [0x54e374], 0
je 0x51b2bd
xor eax, eax
jmp 0x51b30d
xor edx, edx
mov dword [0x557880], edx
cmp dword [0x54e370], 0
je 0x51b307
mov dword [0x558960], 1
push dword [0x54d2a0]
push 0
push 0x177a
call fcn.0041c35b
push eax
push dword [0x55b3d8]
call fcn.004e0c3e
mov dword [0x55bb6c], 2
push 1
call fcn.0051ac4a
xor eax, eax
jmp 0x51b30d
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x51b8a5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp dword [0x55bb40], 0xffffffff
jne 0x51b8d0
push 0
push 0x1776
call fcn.0041c35b
push eax
call fcn.0051a858
xor eax, eax
jmp 0x51bb19
cmp dword [0x54affc], 0
je 0x51b8df
push esi
call fcn.0040c5d0
mov ebx, dword [0x55bb5c]
test ebx, ebx
je 0x51b90e
cmp dword [ebx + 0x1c], 0xffffffff
jne 0x51b907
mov edi, dword [ebx + 0x34]
push ebx
push dword [0x55bb5c]
call fcn.004b103a
mov dword [0x55bb5c], eax
mov ebx, edi
jmp 0x51b8e5
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x51b8e9
cmp dword [0x55bb5c], 0
je 0x51b951
test esi, esi
je 0x51b93d
cmp byte [esi], 0
je 0x51b93d
push dword [ebp + 0xc]
push 0
push esi
push dword [0x55bb5c]
call fcn.004b0c4c
mov edi, eax
test edi, edi
je 0x51b93d
mov dword [0x55bb5c], edi
mov eax, dword [0x55bb5c]
mov edx, dword [eax + 0x1c]
mov dword [ebp + 0xc], edx
mov dword [eax + 0x1c], 0xffffffff
mov esi, dword [eax]
test esi, esi
je 0x51b95a
cmp byte [esi], 0
jne 0x51b964
mov eax, 1
jmp 0x51bb19
cmp dword [0x55183c], 0
je 0x51b984
push dword [ebp + 0xc]
push esi
call fcn.00476ea4
test eax, eax
je 0x51b984
mov eax, 1
jmp 0x51bb19
push 1
call fcn.0050d0f7
push esi
call fcn.005395b8
pop ecx
mov edi, eax
push 0
push edi
push esi
push dword [0x55bb40]
call sub.WSOCK32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x51ba66
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
cmp ebx, 0x2733
jne 0x51b9f9
mov eax, dword [0x55bb5c]
test eax, eax
je 0x51b9d2
cmp esi, dword [eax]
jne 0x51b9d2
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edx
xor esi, esi
test esi, esi
je 0x51b9f2
push 0
push 0
push esi
push dword [0x55bb5c]
call fcn.004b0c4c
mov edi, eax
test edi, edi
je 0x51b9f2
mov dword [0x55bb5c], edi
xor eax, eax
jmp 0x51bb19
test ebx, ebx
je 0x51ba46
push ebx
call fcn.0051a7ac
push eax
push 0
push 0x1777
call fcn.0041c35b
push eax
push 0x57a469
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor edx, edx
mov dword [0x558950], edx
mov dword [0x558960], 1
push dword [0x54d2a0]
push 0x57a469
push dword [0x55b3d8]
call fcn.004e0c3e
push 0
call fcn.0051ac4a
push 0
push 0x5e3
call fcn.0041c35b
push eax
call fcn.0051a858
xor eax, eax
jmp 0x51bb19
test ebx, ebx
jg 0x51ba6c
xor ebx, ebx
cmp edi, ebx
jle 0x51ba95
push 0
push 0
lea eax, [ebx + esi]
push eax
push dword [0x55bb5c]
call fcn.004b0e61
mov edi, eax
test edi, edi
je 0x51ba8f
mov dword [0x55bb5c], edi
mov byte [esi + ebx], 0
mov edi, ebx
mov eax, dword [0x551858]
test eax, eax
jle 0x51baae
add eax, edi
sar eax, 1
jns 0x51baa7
adc eax, 0
mov dword [0x551858], eax
jmp 0x51bab4
mov dword [0x551858], edi
add dword [0x551854], edi
mov eax, dword [0x551840]
cmp eax, dword [0x551854]
jge 0x51bacc
mov dword [0x551854], eax
cmp dword [0x54bdc0], 0
je 0x51baf7
push 0x553318
push str._sdebug.log
push 0x57a469
call sub.USER32.dll_wsprintfA
add esp, 0xc
push esi
push 0x57a469
call fcn.0041c228
cmp dword [0x55bb5c], 0
je 0x51bb14
push 0
push 0
push 0x44d
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x51c06a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, 0x58cc1c
cmp dword [0x55bb40], 0xffffffff
jne 0x51c088
xor eax, eax
jmp 0x51c31c
push 2
call fcn.0050d0f7
cmp dword [0x54e370], 0
je 0x51c09d
call fcn.0051be92
mov eax, esi
shr eax, 0x10
and ax, 0xffff
test ax, ax
je 0x51c0b3
movzx ebx, ax
jmp 0x51c17c
cmp dword [0x55bb50], 0
jne 0x51c0c5
cmp dword [0x55bb54], 0
je 0x51c0d6
mov dword [0x55bb58], 1
xor eax, eax
jmp 0x51c31c
cmp dword [0x55bb4c], 0x14
jl 0x51c140
mov dword [0x55bb4c], 0xa
push 2
push 0
push 0
push 0
push ebx
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x51c130
mov eax, dword [ebx + 4]
cmp eax, 0x40e
je 0x51c130
cmp eax, 0x12
je 0x51c130
push 3
push 0
push 0
push 0
push ebx
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x51c130
mov ecx, ebx
mov edx, 6
push dword [ecx + edx*4]
dec edx
jns 0x51c123
call fcn.004bd172
jmp 0x51c0e9
cmp dword [0x55bb40], 0xffffffff
jne 0x51c140
xor eax, eax
jmp 0x51c31c
xor edx, edx
mov dword [0x55bb58], edx
push 0
push 0x3b5
push 0x58da2b
push dword [0x55bb40]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x51c1d7
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
cmp ebx, 0x2733
jne 0x51c17c
xor eax, eax
jmp 0x51c31c
test ebx, ebx
je 0x51c2bc
cmp dword [0x54e374], 0
je 0x51c2bc
push ebx
call fcn.0051a7ac
push eax
push str.__s
push 0x57f8f2
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor edx, edx
mov dword [0x558950], edx
mov dword [0x558960], 1
push dword [0x54d2a0]
push 0x57f8f2
push dword [0x55b3d8]
call fcn.004e0c3e
jmp 0x51c2bc
test esi, esi
jle 0x51c2bc
mov byte [esi + 0x58da2b], 0
mov dword [0x55bb50], 1
xor edi, edi
mov ebx, 0x58da2b
cmp esi, edi
jle 0x51c2af
mov al, byte [ebx]
cmp al, 0xd
je 0x51c2a5
cmp al, 0xa
jne 0x51c24b
mov edx, dword [0x55bb7c]
mov byte [edx + 0x58d644], 0
xor ecx, ecx
mov dword [0x55bb7c], ecx
cmp byte [0x58d644], 0
je 0x51c235
push 0x58d644
call fcn.004a7965
push 0x3e7
push 0
push 0x58d644
call fcn.00539438
add esp, 0xc
jmp 0x51c2a5
mov eax, dword [0x55bb7c]
mov dl, byte [ebx]
mov byte [eax + 0x58d644], dl
inc dword [0x55bb7c]
cmp dword [0x55bb7c], 0x383
jl 0x51c2a5
mov ecx, dword [0x55bb7c]
mov byte [ecx + 0x58d644], 0
xor eax, eax
mov dword [0x55bb7c], eax
cmp byte [0x58d644], 0
je 0x51c291
push 0x58d644
call fcn.004a7965
push 0x3e7
push 0
push 0x58d644
call fcn.00539438
add esp, 0xc
inc edi
inc ebx
cmp esi, edi
jg 0x51c1ff
xor edx, edx
mov dword [0x55bb50], edx
jmp 0x51c148
cmp dword [0x54e374], 0
je 0x51c2fe
push dword [0x54d29c]
push dword [0x55b3d8]
call fcn.004dfc12
mov dword [0x558960], 1
push dword [0x54d29c]
push 0
push 0x5e3
call fcn.0041c35b
push eax
push dword [0x55b3d8]
call fcn.004dfd6c
push 0
call fcn.0051ac4a
push 0x55bc15
call fcn.0051a858
xor ecx, ecx
mov dword [0x55bb78], ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x51c32a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x51c350
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str._at_end_of_pattern
jmp 0x51c4b4
cmp eax, 0x30
jl 0x51c4b4
cmp eax, 0x7a
jg 0x51c4b4
movsx ebx, word [eax*2 + 0x55bbc8]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x51c379
mov eax, dword [ebp - 4]
jmp 0x51c4b4
mov ebx, eax
sub ebx, 0x30
je 0x51c3ee
dec ebx
sub ebx, 9
jb 0x51c39d
sub ebx, 0x29
je 0x51c477
sub ebx, 0x15
je 0x51c42f
jmp 0x51c4a3
cmp dword [ebp + 0x18], 0
jne 0x51c3dd
mov esi, edx
sub eax, 0x30
jmp 0x51c3b9
inc edx
add eax, eax
lea eax, [eax + eax*4]
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
xor ebx, ebx
mov bl, byte [edx + 1]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x51c3aa
cmp eax, 0xa
jl 0x51c3d1
cmp eax, dword [ebp + 0x10]
jg 0x51c3db
add eax, 0xc
neg eax
jmp 0x51c4b4
mov edx, esi
xor eax, eax
mov al, byte [edx]
cmp eax, 0x38
jl 0x51c3ee
dec edx
xor eax, eax
jmp 0x51c4b4
sub eax, 0x30
jmp 0x51c400
inc edx
shl eax, 3
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x51c425
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 4
je 0x51c425
cmp byte [edx + 1], 0x38
je 0x51c425
cmp byte [edx + 1], 0x39
jne 0x51c3f3
and eax, 0xff
jmp 0x51c4b4
xor eax, eax
jmp 0x51c45c
inc edx
mov esi, 0x30
xor ebx, ebx
mov bl, byte [edx]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x51c449
add esi, 0x27
xor ebx, ebx
mov bl, byte [edx]
mov edi, dword [ecx]
movzx ebx, byte [edi + ebx]
shl eax, 4
add ebx, eax
sub ebx, esi
mov eax, ebx
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x51c4b4
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 8
jne 0x51c433
jmp 0x51c4b4
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x51c48d
mov edx, dword [ebp + 0xc]
mov dword [edx], str.c_at_end_of_pattern
xor eax, eax
jmp 0x51c4b9
cmp eax, 0x61
jl 0x51c49e
cmp eax, 0x7a
jg 0x51c49e
mov ecx, dword [ecx + 4]
movzx eax, byte [ecx + eax]
xor eax, 0x40
jmp 0x51c4b4
test byte [ebp + 0x14], 0x40
je 0x51c4b4
mov ecx, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str.unrecognized_character_follows__
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x5206ca
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x55c6a0
test edx, edx
jne 0x5206e8
xor eax, eax
jmp 0x5207d0
xor eax, 0xffffffff
cmp ebx, 8
jb 0x5207b0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ebx, 8
cmp ebx, 8
jae 0x5206f4
test ebx, ebx
je 0x5207cd
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ebx
jne 0x5207b4
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x526dfa
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0x526f90
xor ebx, ebx
xor esi, esi
mov ecx, dword [edx]
mov dword [ebp - 4], ecx
test byte [edx + 8], 2
je 0x526e53
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 1]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 2]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x526e63
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x526e79
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x526e99
cmp dword [eax], 0
jg 0x526e8d
xor edi, edi
mov dword [eax], edi
jmp 0x526e91
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x526e82
test si, si
je 0x526f90
mov al, byte [edx + 9]
sub al, 2
je 0x526ebe
sub al, 2
je 0x526ede
sub al, 4
je 0x526f19
sub al, 8
je 0x526f40
jmp 0x526f90
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x526f90
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x526ece
jmp 0x526f90
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x20]
mov ecx, esi
mov ebx, 0xf0
sar ebx, cl
and bl, 0xf0
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
or bl, cl
xor esi, esi
cmp edx, esi
jbe 0x526f90
mov ecx, dword [ebp - 0x20]
shr byte [eax], cl
and byte [eax], bl
inc eax
inc esi
cmp edx, esi
ja 0x526f0a
jmp 0x526f90
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0x526f90
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x526f2b
jmp 0x526f90
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x526f90
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
add si, ax
mov eax, dword [ebp - 0xc]
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov byte [edi], al
inc edi
mov edx, esi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0x526f58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52e0bc
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x52e0ed
push ebx
call fcn.00533751
cmp byte [ebx + 0x40], 0
je 0x52e0e6
mov dword [ebx + 0x14], 0xcf
mov al, 1
jmp 0x52e17c
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x52e159
mov edx, dword [ebx + 0x190]
cmp byte [edx + 0x10], 0
je 0x52e14e
cmp dword [ebx + 8], 0
je 0x52e10e
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
push ebx
mov eax, dword [ebx + 0x190]
call dword [eax]
test eax, eax
jne 0x52e11f
xor eax, eax
jmp 0x52e17c
cmp eax, 2
je 0x52e14e
cmp dword [ebx + 8], 0
je 0x52e102
cmp eax, 3
je 0x52e132
dec eax
jne 0x52e102
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x52e102
mov edx, dword [ebx + 0x11c]
add dword [eax + 8], edx
jmp 0x52e102
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x84], ecx
jmp 0x52e176
cmp dword [ebx + 0x14], 0xcc
je 0x52e176
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
push ebx
call fcn.0052e181
pop ebx
pop ebp
ret 4

Function at 0x53cd68
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x58dfd8
call fcn.0053fdc0
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x58dfd8
call fcn.0053cfbc
add esp, 0x14
push 0x5634f8
lea ecx, [ebp - 8]
push ecx
call fcn.005394dc
add esp, 8
mov byte [0x58dfd8], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x58dfd8
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x53cddb
mov eax, 0x58dfd8
jmp 0x53cddd
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x53cde4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x53ce09
cmp dword [ebx + 4], 0xfffffffe
jne 0x53ce09
or eax, 0xffffffff
jmp 0x53cf41
test byte [ebx + 8], 8
je 0x53ce76
cmp dword [ebx + 4], 0xffffffff
jne 0x53ce76
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.0053cd68
pop ecx
mov edi, eax
test edi, edi
je 0x53ce5e
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x53cf41
call fcn.00540478
test eax, eax
jne 0x53ce6e
xor eax, eax
jmp 0x53cf41
or eax, 0xffffffff
jmp 0x53cf41
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x53ce83
cmp eax, 0xfffffffe
jne 0x53ceaa
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x53ceba
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x53ced0
call fcn.00540478
test eax, eax
jne 0x53cecb
xor eax, eax
jmp 0x53cf41
or eax, 0xffffffff
jmp 0x53cf41
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x53cee4
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x53ce76
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53fb44
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x53fb60
call fcn.00540498
jmp 0x53fbcf
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x53fb7c
call fcn.00540498
jmp 0x53fbcf
cmp dword [0x58e320], 1
je 0x53fbcd
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00545144
pop ecx
cmp al, 0x41
jl 0x53fbcd
cmp al, 0x5a
jg 0x53fbcd
cmp byte [ebp - 0x107], 0x3a
jne 0x53fbcd
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x53fbcd
call fcn.00540498
jmp 0x53fbcf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x53fbd4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x53fbf0
call fcn.00540498
jmp 0x53fc11
test byte [ebp + 0xc], 0x80
jne 0x53fbfb
or ebx, 1
jmp 0x53fbfe
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.dll_SetFileAttributesA
dec eax
je 0x53fc0f
call fcn.00540498
jmp 0x53fc11
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x53fc18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x53fc47
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x53fc51
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x53fc5c
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x53fcc2
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x53fcc2
call fcn.00540498
jmp 0x53fcfd
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x53fcd2
call fcn.00540498
jmp 0x53fcfd
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x53fcf8
push edi
call sub.KERNEL32.dll_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x53fcf6
cmp ebx, 1
je 0x53fcf6
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x53fce3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret