joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54dc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [ecx + 4]
push edi
mov edi, dword [ecx + 8]
xor ecx, ecx
test eax, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
jle 0x54dd81
push ebx
push ebp
push esi
lea ebx, [esp + 0x18]
mov ebp, eax
lea esp, [esp]
mov esi, dword [edi]
mov eax, dword [0x6bf458]
mov ecx, dword [eax + 0x18]
lea edx, [esp + 0x9c]
push edx
push esi
push ecx
call fcn.0045b9e0
add esp, 0xc
test eax, eax
je 0x54dd78
mov edx, dword [esp + 0xc4]
test dword [edi + 4], edx
je 0x54dd78
mov eax, dword [0x6bf458]
mov ecx, dword [eax + 0x18]
push esi
push ecx
call fcn.004caec0
add esp, 8
cmp eax, 1
jne 0x54dd78
mov dword [ebx], esi
add ebx, 4
add edi, 0x14
dec ebp
jne 0x54dd30
pop esi
pop ebp
pop ebx
mov edx, dword [esp + 0xbc]
lea eax, [esp + 4]
push eax
push 1
push 0
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], edx
lea edx, [esp + 0xa8]
push 1
push edx
mov dword [esp + 0x20], 0
call fcn.004caf60
mov eax, dword [0x6bf458]
mov ecx, dword [eax + 0x2c]
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.004caf90
add esp, 0x20
pop edi
add esp, 0xb0
ret
Function at 0x5c50b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
jle 0x5c50de
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
shr esi, 0x18
xor esi, edi
mov edi, dword [esi*4 + 0x69d4f0]
shl eax, 8
xor eax, edi
inc ecx
dec edx
jne 0x5c50c2
pop edi
pop esi
ret
Function at 0x5c6a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x6bf1f0]
test eax, eax
push ebx
push esi
push edi
mov edi, dword [0x6bf1f4]
je 0x5c6aa0
call fcn.004b3270
mov eax, dword [edi + 0xa4]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 0xa8]
mov dword [esp + 0x14], ecx
lea ebx, [edi + 4]
mov eax, ebx
mov ecx, dword [eax]
lea edx, [esi + 0x40]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov eax, dword [eax + 0x14]
push ebx
mov dword [edx + 0x14], eax
call fcn.00510890
add esp, 4
cmp eax, 1
jne 0x5c6afc
lea ecx, [esi + 0x58]
push ecx
push ebx
call fcn.00510640
add esp, 8
mov edx, dword [edi + 0x98]
mov ebx, dword [esi + 0x7c]
mov dword [esi], edx
mov eax, dword [edi + 0x9c]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xd4]
movzx edx, byte [ecx + 0x10]
shl edx, 5
xor edx, ebx
and edx, 0x60
mov eax, ebx
xor eax, edx
mov dword [esi + 0x7c], eax
mov ecx, eax
mov eax, dword [edi + 0xd8]
shr eax, 7
xor eax, ecx
and eax, 3
xor eax, ecx
mov dword [esi + 0x7c], eax
mov ecx, dword [edi + 0xd8]
shr ecx, 7
xor ecx, eax
and ecx, 0xc
xor ecx, eax
mov dword [esi + 0x7c], ecx
mov eax, dword [edi + 0xd8]
shl eax, 1
xor eax, ecx
and eax, 0x10
xor eax, ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0xac]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0xd4]
mov ecx, dword [edx + 0x24]
mov edx, dword [esi + 0x7c]
shl ecx, 7
xor ecx, edx
and ecx, 0x80
xor edx, ecx
mov dword [esi + 0x7c], edx
mov edx, dword [edi + 0xd4]
mov ecx, dword [edx + 0x28]
mov dword [esi + 0x70], ecx
mov edx, dword [edi + 0xd4]
mov ecx, dword [edx + 0x2c]
mov dword [esi + 0x74], ecx
mov edx, dword [edi + 0xd4]
mov ecx, dword [edx + 0x30]
mov dword [esi + 0x78], ecx
mov ecx, dword [0x69d92c]
xor ebx, ebx
cmp ecx, ebx
jne 0x5c6bd2
mov dword [0x69d934], ebx
mov dword [0x69d92c], 1
cmp eax, ebx
mov edx, dword [0x69d934]
mov dword [esi + 0x3c], edx
je 0x5c6c1b
lea edi, [esi + 8]
jle 0x5c6c1b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00483810
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push eax
push ecx
call fcn.004d1130
mov edx, dword [esp + 0x20]
mov dword [edi], edx
mov eax, dword [esi + 0x34]
add esp, 0x14
add edi, 4
inc ebx
cmp ebx, eax
jl 0x5c6be4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cfd20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov cl, byte [ebx]
xor eax, eax
test cl, cl
push esi
mov esi, ebx
je 0x5cfd70
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push edi
mov edi, dword [sym.imp.MSVCR71.dll__strnicmp]
mov edi, edi
cmp byte [esi], 0x5c
jne 0x5cfd56
push 7
push str._fonts_
push esi
call edi
add esp, 0xc
test eax, eax
je 0x5cfd73
xor eax, eax
mov al, byte [esi]
push eax
call ebp
test eax, eax
je 0x5cfd66
add esi, 2
jmp 0x5cfd67
inc esi
cmp byte [esi], 0
jne 0x5cfd40
pop edi
xor eax, eax
pop ebp
pop esi
pop ebx
ret
mov ecx, dword [str.atmntrap.]
inc esi
mov dword [esi], ecx
mov edx, dword [0x677140]
mov dword [esi + 4], edx
mov eax, dword [0x677144]
mov dword [esi + 8], eax
mov cl, byte [0x677148]
push ebx
mov byte [esi + 0xc], cl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5cfd6c
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret

Function at 0x5d0120
Capabilities:
Create directory

Disassembly:
push ecx
push esi
lea ecx, [esp + 4]
push ecx
lea esi, [eax + 0x104]
push esi
push eax
push edi
call fcn.005d00b0
add esp, 0x10
cmp ax, 1
jle 0x5d0161
push ebx
dec eax
push ebp
lea ebx, [esi + 1]
movzx ebp, ax
movzx esi, byte [ebx]
push 0
add esi, edi
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc ebx
dec ebp
mov byte [esi], 0x5c
jne 0x5d0147
pop ebp
pop ebx
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop esi
pop ecx
ret
Function at 0x5d0750
Capabilities:
Get disk information

Disassembly:
movzx eax, bl
sub esp, 0xc
add eax, 0x41
push eax
lea ecx, [esp + 4]
push str._c:_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x5d07b1
dec eax
je 0x5d0791
dec eax
je 0x5d0788
xor eax, eax
add esp, 0xc
ret
mov eax, 3
add esp, 0xc
ret
movzx ax, bl
push eax
call fcn.005d0180
add esp, 4
test eax, eax
jne 0x5d07a7
mov eax, 0x1234adbe
shl eax, 2
or eax, 2
add esp, 0xc
ret
mov eax, 1
add esp, 0xc
ret

Function at 0x5d07c0
Capabilities:
Check if file exists
Get file attributes
Read file on windows
Set file attributes

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, eax
xor eax, eax
mov ecx, 0x14
mov edi, esi
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5d07ef
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 8
ret
and eax, 0xfffffff9
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5d080a
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
add esp, 8
ret
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push ebp
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x5d088d
push ebx
lea eax, [esp + 0x18]
push eax
push 0x50
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d0886
cmp dword [esp + 0x14], 0x50
jne 0x5d0886
mov eax, 0x50
mov dword [esp + 0x10], ebx
call fcn.005cfff0
cmp byte [esi + 1], 1
jne 0x5d087e
mov cl, byte [ebp]
and cl, 0x1f
movsx bx, cl
dec ebx
cmp bx, 0x1a
jge 0x5d087e
call fcn.005d0750
mov ecx, dword [esi + 4]
shr eax, 2
cmp ecx, eax
je 0x5d0886
mov dword [esp + 0x10], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop ebx
je 0x5d08a5
or eax, 6
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x5d0a20
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xcc
push ebx
mov ebx, dword [esp + 0xdc]
push ebp
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d0a36
mov edi, dword [sym.imp.MSVCR71.dll_strncpy]
sub eax, edx
push 8
mov esi, eax
lea eax, [esp + 0x74]
push str.startkey
push eax
call edi
movsx ebp, si
push ebp
lea ecx, [esp + 0x88]
push ebx
push ecx
call edi
add esp, 0x18
lea esi, [esp + 0x70]
lea edi, [esp + 0x30]
mov ecx, 0xd7e5
lea ebx, [ebp + 7]
movzx dx, byte [esi]
mov al, ch
xor al, dl
movzx dx, al
inc esi
mov byte [edi], al
inc edi
add edx, ecx
imul edx, edx, 0x522f
mov ecx, 0x4de1
sub ecx, edx
dec ebx
jns 0x5d0a77
lea eax, [esp + ebp + 0x28]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0x2c], edx
push 0x40
mov eax, 4
lea edx, [esp + 0xa0]
call fcn.005d0900
add esp, 4
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x34]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 7
jmp 0x5d0b00
mov ecx, dword [esp + edx + 0x9c]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, 0xc6ef3720
mov esi, 0x20
jmp 0x5d0b20
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, ecx
shr edi, 5
add edi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x20]
xor edi, ebx
lea ebx, [edx + ecx]
xor edi, ebx
mov ebx, dword [esp + 0x24]
sub eax, edi
mov edi, eax
shr edi, 5
add edi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor edi, ebx
lea ebx, [edx + eax]
xor edi, ebx
sub ecx, edi
add edx, 0x61c88647
dec esi
jne 0x5d0b20
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov dword [esp + edx + 0x30], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
add ebx, 8
add edx, 8
add ecx, 8
dec eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jne 0x5d0b00
mov eax, dword [esp + 0xe0]
mov cl, byte [esp + 0x30]
mov dx, word [esp + 0x31]
mov byte [eax], cl
mov cl, byte [esp + 0x33]
mov byte [eax + 4], cl
mov cl, byte [esp + 0x36]
mov byte [eax + 8], cl
movzx ecx, cl
mov word [eax + 2], dx
mov dx, word [esp + 0x34]
mov word [eax + 6], dx
mov dl, byte [esp + 0x37]
mov byte [eax + 9], dl
mov edx, ecx
shr ecx, 2
lea edi, [eax + 0xa]
lea esi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, byte [eax + 9]
movzx esi, byte [eax + 8]
lea edi, [eax + 0x1a]
mov eax, ecx
shr ecx, 2
lea esi, [esp + esi + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xcc
ret
Function at 0x5d0fc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x69e1e8]
sub esp, 0xc
test eax, eax
push ebx
mov ebx, dword [esp + 0x14]
jne 0x5d10b3
push ebp
push esi
lea eax, [ebx + 0x10]
push edi
mov esi, 1
xor edx, edx
mov edi, eax
mov ecx, edx
shl ecx, 8
or ecx, edx
shl ecx, 2
mov ebp, ecx
shl ebp, 0x10
or ebp, ecx
add ebp, 0x3020100
mov dword [edi], ebp
inc edx
add edi, 4
cmp edx, 0x10
jl 0x5d0fe4
mov edx, 0xfffffff1
sub edx, ebx
mov dword [esp + 0x10], edx
mov edx, 0xfffffff2
sub edx, ebx
mov dword [esp + 0x14], edx
mov edx, 0xfffffff3
sub edx, ebx
mov edi, 0xfffffff0
mov ecx, 0x69e1a9
mov dword [esp + 0x18], edx
sub edi, ebx
mov dl, byte [eax]
movzx ebp, dl
lea ebx, [edi + eax]
sub ebp, ebx
mov ebx, dword [esp + 0x10]
neg ebp
sbb ebp, ebp
inc ebp
and esi, ebp
add ebx, eax
mov byte [ecx - 1], dl
mov dl, byte [eax + 1]
movzx ebp, dl
sub ebp, ebx
mov ebx, dword [esp + 0x14]
neg ebp
sbb ebp, ebp
inc ebp
and esi, ebp
mov byte [ecx], dl
mov dl, byte [eax + 2]
add ebx, eax
movzx ebp, dl
sub ebp, ebx
mov ebx, dword [esp + 0x18]
neg ebp
sbb ebp, ebp
inc ebp
and esi, ebp
mov byte [ecx + 1], dl
mov dl, byte [eax + 3]
add ebx, eax
movzx ebp, dl
sub ebp, ebx
neg ebp
sbb ebp, ebp
add eax, 4
inc ebp
mov byte [ecx + 2], dl
lea edx, [edi + eax]
and esi, ebp
add ecx, 4
cmp edx, 0x40
jl 0x5d1033
mov ebx, dword [esp + 0x20]
pop edi
mov dword [0x69e1ec], esi
pop esi
mov dword [0x69e1e8], 1
pop ebp
mov al, byte [esp + 0x18]
xor ecx, ecx
cmp al, cl
je 0x5d10cc
cmp dword [0x69e1ec], ecx
je 0x5d10cc
mov eax, 1
jmp 0x5d10ce
xor eax, eax
mov byte [ebx + 0x58], al
mov dword [ebx + 0x54], ecx
mov dword [ebx + 0x50], ecx
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
add esp, 0xc
ret
Function at 0x5d3870
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
test al, 4
je 0x5d3882
or eax, 1
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test al, 8
jne 0x5d38c4
test al, 1
je 0x5d38c4
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x5d38c4
mov eax, dword [esi + 8]
test eax, eax
jne 0x5d38a0
call fcn.005d3830
movzx eax, word [esi + 0x30]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x1c]
push 0
push esi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5d38c9
or dword [esi + 0xc], 0x10
mov dword [esi], 0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
test ecx, ecx
jne 0x5d38e9
mov edx, dword [esi + 0xc]
or edx, 8
mov eax, edx
test al, 4
mov dword [esi + 0xc], edx
je 0x5d38c4
and eax, 0xfffffffe
mov dword [esi + 0xc], eax
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
dec ecx
mov dword [esi], ecx
mov cl, byte [eax]
inc eax
mov dword [esi + 4], eax
movzx eax, cl
pop esi
ret

Function at 0x5d39a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x5d39b0
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0xc]
test dl, 2
push edi
je 0x5d3a01
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5d3a01
mov eax, dword [esi + 4]
sub eax, ecx
test eax, eax
mov dword [esp + 0xc], eax
mov edi, eax
jle 0x5d3a01
push 0
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5d39f7
cmp edi, dword [esp + 0xc]
jne 0x5d39f7
movzx ecx, word [esi + 0x30]
pop edi
mov dword [esi], ecx
xor eax, eax
pop esi
ret
or dword [esi + 0xc], 0x10
pop edi
or eax, 0xffffffff
pop esi
ret
test dl, 1
je 0x5d3a4c
test dl, 4
jne 0x5d3a4c
mov edx, dword [esi + 0x1c]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.005d3870
add esp, 4
cmp eax, 0xffffffff
je 0x5d3a46
mov edi, 0xffffffef
mov edi, edi
mov ecx, dword [esi + 0xc]
and ecx, edi
push esi
mov dword [esi + 0xc], ecx
call fcn.005d3870
add esp, 4
cmp eax, 0xffffffff
jne 0x5d3a30
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
ret
Function at 0x5d3d10
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
xor ebx, ebx
test al, 6
push edi
mov dword [esp + 0x10], ebx
je 0x5d3d2c
mov dword [esp + 0x10], 1
mov edi, dword [esp + 0x14]
cmp edi, ebx
jge 0x5d3d3a
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dword [esp + 0x10], ebx
push ebp
mov ebp, dword [esp + 0x1c]
je 0x5d3d6d
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x5d3d6d
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 0x2c]
lea eax, [edi + ebp]
cmp eax, ecx
jle 0x5d3d6a
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x5d3de9
cmp dword [esp + 0x14], ebx
jne 0x5d3d94
mov edx, dword [esi + 0x1c]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x2c], eax
jne 0x5d3dd2
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dword [esi + 8], ebx
je 0x5d3dc0
push esi
call fcn.005d39a0
add esp, 4
cmp word [esi + 0x30], 0x1000
jne 0x5d3dbc
mov edx, dword [esi + 8]
mov eax, dword [0x6bf498]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 8]
add esp, 8
mov word [esi + 0x30], bx
push ebx
lea eax, [edi + ebp]
push eax
push ebx
push 4
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x1c]
push ebx
push eax
jmp 0x5d3ddc
mov ecx, dword [esi + 0x1c]
push ebx
push ebx
push ebx
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x5d3d8d
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
jne 0x5d3e3c
cmp dword [esp + 0x14], ebx
je 0x5d3e02
push ebp
push edi
push ebx
mov dword [esi], ebx
mov dword [esi + 0x28], edi
push 2
jmp 0x5d3e0f
mov edx, dword [esi + 0x2c]
push ebx
push ebx
push ebx
mov dword [esi], edx
mov dword [esi + 0x28], ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 0x24], eax
jne 0x5d3e31
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov dword [esi + 0x20], ebx
pop esi
xor eax, eax
pop ebx
ret
pop ebp
pop edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
pop esi
pop ebx
ret
mov eax, dword [esi + 0x2c]
lea edx, [edi + ebp]
cmp edx, eax
jg 0x5d3d8d
pop ebp
add ecx, edi
sub eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x5e3800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [ecx]
mov ecx, dword [0x6bf440]
mov ecx, dword [ecx]
lea ebx, [ecx + 0x80]
xor eax, eax
movzx ebp, byte [edx]
cmp ebp, esi
jle 0x5e382d
or eax, dword [ecx]
movzx ebp, byte [edx + 1]
cmp ebp, esi
jle 0x5e3838
or eax, dword [ecx + 4]
movzx ebp, byte [edx + 2]
cmp ebp, esi
jle 0x5e3843
or eax, dword [ecx + 8]
movzx ebp, byte [edx + 3]
cmp ebp, esi
jle 0x5e384e
or eax, dword [ecx + 0xc]
movzx ebp, byte [edx + 4]
cmp ebp, esi
jle 0x5e3859
or eax, dword [ecx + 0x10]
movzx ebp, byte [edx + 5]
cmp ebp, esi
jle 0x5e3864
or eax, dword [ecx + 0x14]
movzx ebp, byte [edx + 6]
cmp ebp, esi
jle 0x5e386f
or eax, dword [ecx + 0x18]
movzx ebp, byte [edx + 7]
cmp ebp, esi
jle 0x5e387a
or eax, dword [ecx + 0x1c]
add ecx, 0x20
add edx, 8
cmp ecx, ebx
jb 0x5e3824
xor eax, dword [esp + 0x24]
mov dword [edi], eax
mov eax, dword [esp + 0x20]
add edi, 4
dec eax
mov dword [esp + 0x20], eax
je 0x5e38a1
mov eax, dword [0x6bf440]
mov ecx, dword [eax]
jmp 0x5e3822
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ecx], edi
pop edi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
ret
Function at 0x5e7d30
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
mov esi, eax
xor esi, ecx
sar esi, 0x1f
and esi, 1
test eax, eax
je 0x5e7f29
test ecx, ecx
je 0x5e7f21
test eax, eax
jge 0x5e7d59
neg eax
test ecx, ecx
jge 0x5e7d5f
neg ecx
xor edx, edx
cmp eax, ecx
jbe 0x5e7d83
sub eax, ecx
test esi, esi
mov edx, 0x40000000
jne 0x5e7d7b
cmp eax, ecx
jne 0x5e7d7d
mov eax, 0x7fffffff
pop esi
ret
cmp eax, ecx
ja 0x5e7f21
shl eax, 1
cmp eax, ecx
jbe 0x5e7d91
add edx, 0x20000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7d9f
add edx, 0x10000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7dad
add edx, 0x8000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7dbb
add edx, 0x4000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7dc9
add edx, 0x2000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7dd7
add edx, 0x1000000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7de5
add edx, 0x800000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7df3
add edx, 0x400000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e01
add edx, 0x200000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e0f
add edx, 0x100000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e1d
add edx, 0x80000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e2b
add edx, 0x40000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e39
add edx, 0x20000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e47
add edx, 0x10000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e55
add edx, 0x8000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e63
add edx, 0x4000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e71
add edx, 0x2000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e7f
add edx, 0x1000
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e8d
add edx, 0x800
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7e9b
add edx, 0x400
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7ea9
add edx, 0x200
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7eb7
add edx, 0x100
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7ec5
add edx, 0x80
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7ed0
add edx, 0x40
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7edb
add edx, 0x20
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7ee6
add edx, 0x10
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7ef1
add edx, 8
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7efc
add edx, 4
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7f07
add edx, 2
sub eax, ecx
shl eax, 1
cmp eax, ecx
jbe 0x5e7f10
inc edx
sub eax, ecx
add eax, eax
cmp eax, ecx
jbe 0x5e7f17
inc edx
test esi, esi
je 0x5e7f1d
neg edx
mov eax, edx
pop esi
ret
lea eax, [esi + 0x7fffffff]
pop esi
ret
xor eax, eax
test ecx, ecx
setne al
pop esi
dec eax
and eax, 0x7fffffff
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x59a00756
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x29684055
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219