joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503440
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb890
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00502a30
test al, al
jne 0x5034c0
call fcn.00572740
push str.Failed_to_convert_path_to_wide_char
push 0x647e5c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
add esp, 0xc
xor bl, bl
jmp 0x50359d
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00502a30
test al, al
je 0x5034a1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
je 0x503511
mov dl, 1
lea ecx, [ebp - 0x28]
call fcn.00502c80
test al, al
jne 0x503511
push str.Failed_to_remove_remains_of_the_installation
push 0x647e5c
call fcn.00572740
push eax
call fcn.00573570
add esp, 0xc
xor bl, bl
jmp 0x50359d
call fcn.00572740
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov esi, eax
lea ecx, [ebp - 0x40]
cmovae edx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push edx
cmovae ecx, dword [ebp - 0x40]
mov eax, dword [esi]
push ecx
push str.Backup_File__ls_Source_File_:_ls
push 0x647e5c
push esi
call dword [eax + 0x54]
add esp, 0x14
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.005cd994
add esp, 8
test eax, eax
je 0x503583
push str.Failed_to_Restore_the_Backup_File
push 0x647e5c
call fcn.00572740
push eax
call fcn.00573600
add esp, 0xc
xor bl, bl
jmp 0x50359d
call fcn.00572740
push str.Backup_Folder_is_restored_to_original_File
push 0x647e5c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
add esp, 0xc
mov bl, 1
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x5035b2
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407b40
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x5035db
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x50a2c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x50a2ed
nop dword [eax]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x620250]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x50a2d0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x50a370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x50a3a1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6899a8]
test eax, eax
je 0x50a3ac
call eax
lea eax, [esi*8]
push eax
call fcn.00506550
mov ecx, dword [0x6899ac]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x50a3cd
call ecx
test esi, esi
je 0x50a398
push dword [ebx + 0xc]
call fcn.00506850
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x67ead8]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.005b3770
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x50a4b0
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x50a43f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x620250]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x50a422
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x50a48a
mov eax, dword [esi]
test eax, eax
je 0x50a45d
mov edx, dword [esi + 4]
jmp 0x50a45f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x50a48a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x50a47f
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x50a4a6
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x50a4a6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x50a49c
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x50a416
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50a5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x50a624
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x50a614
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x620250]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x50a5f4
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x50a626
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.0050a4c0
add esp, 8
test eax, eax
je 0x50a640
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x50a650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x50a6a5
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x50a695
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x620250]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x50a675
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x50a6aa
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.0050a4c0
add esp, 8
test eax, eax
je 0x50a6f2
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x50a6e2
push ebx
mov edx, eax
mov ecx, esi
call fcn.0050a570
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x50a790
push 0x14
call fcn.00506550
mov edi, eax
add esp, 4
test edi, edi
jne 0x50a716
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x50a756
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x50a756
add edx, edx
mov ecx, esi
call fcn.0050a370
test eax, eax
je 0x50a756
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0050a2c0
xor edx, edx
div dword [esi]
jmp 0x50a759
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x50a777
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.0050a300
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x50a786
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53b1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, eax
test eax, eax
je 0x53b1ff
cmp byte [eax], dl
je 0x53b1f7
inc edi
cmp byte [edi], dl
jne 0x53b1f2
sub edi, eax
and edi, 0x3fffffff
xor ebx, ebx
cmp dword [esi + 0x14], edx
jle 0x53b2ab
nop word [eax + eax]
mov eax, ebx
mov ecx, ebx
xor eax, 1
cmp ebx, 2
cmovl ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x53b27b
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x53b25d
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x620250]
cmp cl, byte [edx + 0x620250]
jne 0x53b25d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x53b240
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 8]
movzx ecx, byte [ecx + 0x620250]
movzx eax, byte [eax + 0x620250]
sub eax, ecx
jne 0x53b29e
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 0x10]
add ecx, ecx
mov edx, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0050a5d0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x53b2ab
jmp 0x53b2a1
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x53b210
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53b3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push ebx
push edi
mov edi, eax
test eax, eax
je 0x53b3fd
cmp byte [eax], dl
je 0x53b3f5
nop dword [eax]
inc edi
cmp byte [edi], dl
jne 0x53b3f0
sub edi, eax
and edi, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor ebx, ebx
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x53b4a9
push esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov eax, ebx
xor ecx, 1
cmp ebx, 2
cmovl eax, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x53b47b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x53b460
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x620250]
cmp cl, byte [edx + 0x620250]
jne 0x53b45d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x53b440
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x620250]
movzx ecx, byte [ecx + 0x620250]
sub eax, ecx
jne 0x53b493
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea ecx, [eax + 0x18]
push edi
call fcn.0050a5d0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x53b4a0
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x53b414
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53b7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], ebx
push edi
test esi, esi
je 0x53b962
test ebx, ebx
je 0x53b7d8
cmp dword [ebx + 0x200], 0
jne 0x53b7e7
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x53b962
mov edi, dword [esi + 8]
mov dword [ebp - 0x14], edi
test edi, edi
je 0x53b917
mov esi, dword [edi + 0x14]
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x53b80c
cmp dword [ebx + 0x200], 0
jne 0x53b8b8
mov esi, dword [edi]
mov ecx, esi
mov dword [ebp - 0x24], esi
test esi, esi
je 0x53b82e
cmp byte [esi], 0
je 0x53b826
nop dword [eax]
inc ecx
cmp byte [ecx], 0
jne 0x53b820
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [edi + 0x18]
add eax, 0x18
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
test edx, edx
je 0x53b88e
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
test ecx, ecx
jle 0x53b884
mov edi, ecx
mov ebx, eax
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x620250]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x53b855
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
jmp 0x53b890
xor edx, edx
push edx
mov dword [ebp - 8], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0050a4c0
add esp, 8
test eax, eax
je 0x53b8b5
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, eax
call fcn.0050a570
add esp, 4
mov esi, dword [ebp - 0x10]
test ebx, ebx
je 0x53b8c5
cmp dword [ebx + 0x200], 0
jne 0x53b8da
mov eax, dword [edi + 0x28]
test eax, eax
je 0x53b8da
add dword [eax], 0xffffffff
jne 0x53b8da
push eax
call fcn.00506850
add esp, 4
mov edx, dword [edi + 0x24]
mov ecx, ebx
call fcn.00532fb0
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.005068f0
test byte [edi + 0x38], 0x10
je 0x53b8fe
mov edx, dword [edi + 0x20]
mov ecx, ebx
call fcn.005068f0
mov edx, edi
mov ecx, ebx
call fcn.005068f0
mov dword [ebp - 0x14], esi
mov edi, esi
test esi, esi
jne 0x53b7f5
mov esi, dword [ebp - 0x2c]
mov edx, esi
mov ecx, ebx
call fcn.00547290
mov edx, esi
mov ecx, ebx
call fcn.0053b730
mov edx, dword [esi]
mov ecx, ebx
call fcn.005068f0
mov edx, dword [esi + 0x14]
mov ecx, ebx
call fcn.005068f0
mov edx, dword [esi + 0xc]
mov ecx, ebx
call fcn.0054f980
mov edx, dword [esi + 0x18]
mov ecx, ebx
call fcn.00533c30
mov edx, esi
mov ecx, ebx
call fcn.0055c900
mov edx, esi
mov ecx, ebx
call fcn.005068f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56e1a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0968
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x56e1fa
push str.OPM_db_is_not_initialized_in_opd_getOpdSchemaVersion
push 0x6489b4
call fcn.00572740
push eax
call fcn.005734e0
add esp, 0xc
mov eax, 1
jmp 0x56e27c
push 0x35
push str.SELECT_value_FROM_opm_meta_WHERE_keyschema_version
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00407200
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [esi]
cmovae edx, dword [ebp - 0x28]
push edi
call fcn.0056d900
mov edi, eax
add esp, 4
test edi, edi
jne 0x56e265
push 0x43
push str.SELECT_value_FROM_opm_meta_WHERE_keyschema_compatibility_version
lea ecx, [ebp - 0x28]
call fcn.00407200
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov ecx, dword [esi]
cmovae edx, dword [ebp - 0x28]
push ebx
call fcn.0056d900
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x56e27a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407440
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 8
Function at 0x5724b0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb0e6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x653534
mov ecx, 0x68cf88
mov dword [ebp - 0x430], 0x68cf88
call fcn.004b2f40
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push eax
push 0x200
mov dword [0x68cf88], 0x6534b0
mov dword [0x68d014], 0
mov word [0x68d018], 0
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x57254a
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 8
call fcn.00599c81
mov esi, eax
add esp, 4
mov dword [ebp - 0x42c], esi
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [0x68d010], esi
cmp dword [esi], 0
jne 0x572584
push str.Local5071F542_DF26_4e46_810E_74570ED35255
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov dword [esi], eax
push 0x110
call fcn.00599c81
add esp, 4
mov dword [ebp - 0x42c], eax
push 0x6255fc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004ae640
mov byte [ebp - 4], 0
mov ecx, eax
push 0x1e
mov dword [0x68d00c], eax
call fcn.004b2310
mov ecx, dword [0x68d00c]
push 0x622628
push 0x653520
call fcn.004b2550
push dword [0x68d00c]
call fcn.004ad620
mov ecx, eax
call fcn.004ad6d0
call fcn.004ad620
lea ecx, [ebp - 0x428]
call fcn.004ad9c0
mov esi, eax
cmp esi, 0x68cf90
je 0x57263d
mov eax, dword [0x68cfa4]
cmp eax, 8
jb 0x572616
inc eax
mov ecx, 0x68cf90
push eax
push dword [0x68cf90]
call fcn.00407b40
xor eax, eax
mov dword [0x68cfa4], 7
push esi
mov ecx, 0x68cf90
mov dword [0x68cfa0], 0
mov word [0x68cf90], ax
call fcn.004098a0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x414]
cmp eax, 8
jb 0x57265f
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00407b40
push 3
push 0x6255fc
mov ecx, 0x68cfa8
call fcn.00407060
mov eax, 0x68cf88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x5767e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb879
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [0x689970], 0
jne 0x57682d
call fcn.004f53a0
mov dword [0x689970], 0x4eaaf0
mov esi, dword [ebp + 8]
mov ecx, 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.004fa250
mov ecx, 8
call fcn.005007b0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0xc]
mov edx, dword [edi]
push esi
mov dword [ebp - 0x10], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57a920
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx esi, byte [eax + str.cw]
mov edx, esi
mov ecx, esi
shr edx, 7
imul edi, edx, 0x1b000000
shl ecx, 0x19
imul edx, edx, 0x11b
xor edi, ecx
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or edi, ecx
lea ecx, [esi + esi]
xor edx, ecx
xor ecx, ecx
xor edx, esi
or ecx, edi
or edx, edi
mov dword [eax*8 + 0x689ad0], ecx
mov dword [eax*8 + 0x689ad4], edx
inc eax
cmp eax, 0x100
jl 0x57a924
xorps xmm0, xmm0
pop edi
movlpd qword [0x68a2d8], xmm0
movlpd qword [0x68a2d0], xmm0
mov byte [0x689ac6], 1
pop esi
ret
Function at 0x57db40
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x100
push eax
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x57dbac
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str._Failed_in_getting_user_name_error:_d
push 0x6489b4
push ecx
call fcn.00572740
add esp, 4
push eax
call fcn.005734e0
add esp, 0x10
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x210], 0
jne 0x57dbba
xor ecx, ecx
jmp 0x57dbd2
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57dbc3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00407060
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x581310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 0
push esi
push 0x57f4d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x581368
call fcn.0057e620
push str.FileDownloadManager::runThisThread:_failed_to_create_a_new_thread._Fatal_Error
push 0x622628
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret

Function at 0x581eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 9], 1
cmp dword [edi + 0x14], 8
jb 0x581ed7
mov eax, dword [edi]
jmp 0x581ed9
mov eax, edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x581f36
call fcn.0057e620
cmp dword [edi + 0x14], 8
mov ebx, eax
jb 0x581f08
mov edi, dword [edi]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push edi
push str.Failed_to_create_file_at_path_:_s_Error:_d
push 0x622628
push ebx
call dword [esi + 0x24]
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], 0
jb 0x581f48
mov esi, dword [esi]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x581f80
call fcn.0057e620
mov esi, eax
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Failed_to_write_in_file_ERROR_VAL:_d_n
push 0x622628
push esi
call dword [edi + 0x24]
add esp, 0x10
mov byte [ebp - 9], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret