joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1540
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x20], 0
je 0x4d159e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
mov ecx, eax
add ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
adc esi, edx
sub ecx, 1
sbb esi, 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
push edx
push eax
push esi
push ecx
call fcn.0055eb80
mov ecx, eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
push edx
push eax
push esi
push ecx
call fcn.00559510
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004d1330
add esp, 0xc
test eax, eax
je 0x4d15bf
mov dword [ebp - 4], 0x60a
jmp 0x4d15e3
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4d15e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d1630
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4d1676
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d1676
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x10], edx
mov eax, 0x70a
jmp 0x4d1695
mov eax, dword [ebp - 4]
xor edx, edx
mov cl, 0x20
call fcn.005bb4c0
mov ecx, dword [ebp - 0x10]
xor esi, esi
add eax, ecx
adc edx, esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d2640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
cmp dword [0x643820], 0
je 0x4d2681
mov eax, dword [0x643820]
push eax
push 0x606830
lea ecx, [ebp - 0x110]
push ecx
push 0xe6
call fcn.004ce370
add esp, 0x10
jmp 0x4d2762
call fcn.004d1000
test eax, eax
je 0x4d26f7
lea edx, [ebp - 0x320]
push edx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x320]
push eax
call fcn.004d10f0
add esp, 4
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x4d26eb
mov ecx, dword [ebp - 0x324]
push ecx
push 0x606830
lea edx, [ebp - 0x110]
push edx
push 0xe6
call fcn.004ce370
add esp, 0x10
mov eax, dword [ebp - 0x324]
push eax
call fcn.0054eaee
add esp, 4
jmp 0x4d26f5
mov eax, 7
jmp 0x4d2893
jmp 0x4d2762
lea ecx, [ebp - 0x430]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x430]
push edx
call fcn.004d1290
add esp, 4
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4d2758
mov eax, dword [ebp - 0x434]
push eax
push 0x606830
lea ecx, [ebp - 0x110]
push ecx
push 0xe6
call fcn.004ce370
add esp, 0x10
mov edx, dword [ebp - 0x434]
push edx
call fcn.0054eaee
add esp, 4
jmp 0x4d2762
mov eax, 7
jmp 0x4d2893
lea eax, [ebp - 0x110]
push eax
call fcn.004cf400
add esp, 4
mov esi, eax
push str.etilqs_
call fcn.004cf400
add esp, 4
lea ecx, [esi + eax + 0x11]
cmp ecx, dword [ebp + 8]
jl 0x4d2793
mov eax, 1
jmp 0x4d2893
lea edx, [ebp - 0x110]
push edx
call fcn.004cf400
add esp, 4
mov dword [ebp - 0x114], eax
jmp 0x4d27b9
mov eax, dword [ebp - 0x114]
sub eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jbe 0x4d27d7
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ebp + ecx - 0x111]
cmp edx, 0x5c
jne 0x4d27d7
jmp 0x4d27aa
mov eax, dword [ebp - 0x114]
mov byte [ebp + eax - 0x110], 0
lea ecx, [ebp - 0x110]
push ecx
push str._setilqs_
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
sub eax, 0x11
push eax
call fcn.004ce370
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004cf400
add esp, 4
mov dword [ebp - 0x118], eax
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
push edx
push 0xf
call fcn.004ce650
add esp, 8
mov dword [ebp - 0x114], 0
jmp 0x4d2854
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 0x114], 0xf
jae 0x4d2885
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
movzx eax, byte [edx]
xor edx, edx
mov ecx, 0x3e
div ecx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x118]
mov cl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [eax], cl
jmp 0x4d2836
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
mov byte [edx], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret
Function at 0x4d2c80
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d2600
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d2cb3
mov eax, 7
jmp 0x4d2d81
call fcn.004d1000
test eax, eax
je 0x4d2d0a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4d2ce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
jne 0x4d2d08
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 5
jge 0x4d2d08
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x4d2cbc
jmp 0x4d2d56
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4d2d36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
jne 0x4d2d56
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 5
jge 0x4d2d56
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 1
test edx, edx
jne 0x4d2d0a
mov eax, dword [ebp - 8]
push eax
call fcn.0054eaee
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x4d2d77
cmp dword [ebp - 0x10], 2
jne 0x4d2d77
mov dword [ebp - 0x14], 0
jmp 0x4d2d7e
mov dword [ebp - 0x14], 0xa0a
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4d3010
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x120], 0x200
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004d2eb0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d318d
lea eax, [ebp - 0x118]
push eax
call fcn.004d2600
add esp, 4
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x4d317d
call fcn.004d1000
test eax, eax
je 0x4d30fd
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
jmp 0x4d30a5
mov edx, dword [ebp - 0x128]
add edx, 2
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
movzx ecx, word [eax]
test ecx, ecx
je 0x4d30cf
mov edx, dword [ebp - 0x128]
movzx eax, word [edx]
cmp eax, 0x5c
jne 0x4d30cd
xor ecx, ecx
mov edx, dword [ebp - 0x128]
mov word [edx], cx
jmp 0x4d30cf
jmp 0x4d3096
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], eax
jmp 0x4d316e
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], edx
jmp 0x4d311a
mov eax, dword [ebp - 0x12c]
add eax, 1
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
movsx edx, byte [ecx]
test edx, edx
je 0x4d3142
mov eax, dword [ebp - 0x12c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4d3140
mov edx, dword [ebp - 0x12c]
mov byte [edx], 0
jmp 0x4d3142
jmp 0x4d310b
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x124]
push edx
call fcn.0054eaee
add esp, 4
cmp dword [ebp - 4], 0
jne 0x4d318d
mov dword [ebp - 0x120], 0x200
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret
Function at 0x4d8860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
cmp dword [ecx], 0
jne 0x4d8896
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004d8160
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d88ec
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
cmp eax, dword [edx + 0x24]
jbe 0x4d88ec
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x80]
cdq
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x18]
xor esi, esi
push esi
push ecx
push edx
push eax
call fcn.00559510
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.004cafa0
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x24], ecx
cmp dword [ebp - 4], 0
jne 0x4d89dc
cmp dword [ebp + 0xc], 0
je 0x4d89dc
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ecx + 0x18]
ja 0x4d89ce
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
and ecx, 0x20
jne 0x4d89ce
mov ecx, dword [ebp - 0x14]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
cdq
push edx
push eax
push esi
push ecx
call fcn.00559510
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x80]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
push edx
call fcn.004caeb0
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 1
jne 0x4d89a1
mov eax, dword [ebp - 0x18]
add eax, 0x18
mov ecx, dword [ebp + 8]
add ecx, 0x64
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ecx + 0x20]
jbe 0x4d89b5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x58]
push eax
call fcn.004e9250
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
jmp 0x4d88ec
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fc6b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
jne 0x4fc6c1
xor eax, eax
jmp 0x4fc83e
push 0x44
mov eax, dword [ebp + 8]
push eax
call fcn.004cc630
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4fc6df
xor eax, eax
jmp 0x4fc83e
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fc260
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004fc3c0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc240
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc260
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc240
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc260
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 4]
mov byte [edx + 4], cl
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc6b0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc240
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004fc240
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
and edx, 0xfffffff7
mov eax, dword [ebp - 4]
mov word [eax + 6], dx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5315b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0xffffffff
jne 0x5315c9
or eax, 0xffffffff
jmp 0x5315ed
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5315ea
or eax, 0xffffffff
jmp 0x5315ed
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x531660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0xffffffff
jne 0x531679
or eax, 0xffffffff
jmp 0x5316ce
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
call eax
movzx ecx, al
test ecx, ecx
jne 0x531694
or eax, 0xffffffff
jmp 0x5316ce
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5316bf
or eax, 0xffffffff
jmp 0x5316ce
cmp dword [ebp - 4], 0
jne 0x5316cb
xor eax, eax
jmp 0x5316ce
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x5316e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0xffffffff
jne 0x5316f8
xor al, al
jmp 0x531742
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
call eax
movzx ecx, al
test ecx, ecx
jne 0x531712
xor al, al
jmp 0x531742
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x531740
cmp dword [ebp - 4], 0
jne 0x531740
xor al, al
jmp 0x531742
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x531830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0xffffffff
jne 0x531849
or eax, 0xffffffff
jmp 0x53189d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
call eax
movzx ecx, al
test ecx, ecx
jne 0x531863
xor eax, eax
jmp 0x53189d
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x531895
or eax, 0xffffffff
jmp 0x53189d
mov eax, dword [ebp - 4]
jmp 0x53189d
mov esp, ebp
pop ebp
ret 8
Function at 0x535bc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov bl, byte [edx + 8]
push esi
mov esi, eax
mov eax, dword [ebp + 8]
cmp bl, 3
je 0x535d59
mov ecx, dword [edx]
push edi
mov dword [ebp - 4], 0
test bl, 2
je 0x535c14
movzx eax, byte [edx + 9]
movzx edi, byte [esi]
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 1]
mov dword [ebp - 0x14], ebx
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 2]
sub eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov edi, 3
jmp 0x535c26
movzx edi, byte [esi + 3]
movzx ebx, byte [edx + 9]
sub ebx, edi
mov dword [ebp - 0x14], ebx
mov edi, 1
test byte [edx + 8], 4
je 0x535c3b
movzx esi, byte [esi + 4]
movzx ebx, byte [edx + 9]
sub ebx, esi
mov dword [ebp + edi*4 - 0x14], ebx
inc edi
xor esi, esi
test edi, edi
jle case.0x535c84.3
cmp dword [ebp + esi*4 - 0x14], 0
jg 0x535c56
mov dword [ebp + esi*4 - 0x14], 0
jmp 0x535c5d
mov dword [ebp - 4], 1
inc esi
cmp esi, edi
jl 0x535c45
cmp word [ebp - 4], 0
je case.0x535c84.3
movzx esi, byte [edx + 9]
add esi, 0xfffffffe
cmp esi, 0xe
ja case.0x535c84.3
movzx esi, byte [esi + 0x535d74]
jmp dword [esi*4 + 0x535d60]
mov edx, dword [edx + 4]
test edx, edx
jbe case.0x535c84.3
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x535c96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [edx + 4]
mov edx, dword [ebp - 0x14]
mov esi, eax
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x535c84.3
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x535cd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
imul ecx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jbe case.0x535c84.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
cmp ebx, dword [ebp - 4]
jb 0x535cf6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
imul ecx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jbe case.0x535c84.3
nop
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [ebp + edx*4 - 0x14]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, dword [ebp - 4]
jb 0x535d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53e3c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x53e3d0
pop edi
pop ebx
ret
Function at 0x53e400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x53e411
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x53e570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x53e5b4
push ebx
push edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + edx*2]
mov ecx, esi
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add edx, edx
shr esi, 1
or edx, ecx
sub dword [ebp - 4], 1
jne 0x53e585
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53e710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0x14], ecx
xor edx, edx
jmp 0x53e760
cmp edx, dword [ebp + 0x10]
jae 0x53e891
mov eax, edx
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x53e7a9
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 4]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x53e778
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
add edi, eax
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x53e760
cmp edx, 0x10
jae 0x53e82c
lea eax, [edx - 8]
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jae 0x53e891
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x53e814
jmp 0x53e7e0
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 0x104]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x53e7e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
add edi, eax
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, 0x10
jb 0x53e7c5
cmp edx, dword [ebp + 0x10]
jae 0x53e891
lea eax, [edx - 0x10]
mov dword [ebp - 8], eax
jmp 0x53e840
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x53e879
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp + 8]
mov eax, ecx
cmp eax, 1
jne 0x53e850
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
add edi, eax
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jb 0x53e840
pop edi
pop ebx
mov esp, ebp
pop ebp
ret