joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d727
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 3
jne 0x53d766
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.0053d63d
add esp, 0xc
test ax, ax
jne 0x53d750
mov dword [esi + 0xc], 2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push dword [esi + 0x1c]
call edi
push 2
push dword [esi + 0x20]
call edi
pop edi
pop esi
ret

Function at 0x53d958
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.005843f4
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
and dword [0x6be5b0], 0
pop ebp
mov ebx, str.acroct.ini
mov edi, str.WinFntSvr
push ebx
push ebp
push str.FontResPublic
push edi
mov dword [0x6b9a28], eax
mov dword [0x6be5a8], ebp
mov dword [0x6be5ac], ebp
call esi
push ebx
push 0
push str.T1ToTTDisabled
push edi
mov dword [0x6be5a8], eax
call esi
push ebx
push ebp
push str.TTToSysDisabled
push edi
mov dword [0x6be5b0], eax
call esi
push 0
push 0x568838
push 0
push 0x3b
mov dword [0x6be5ac], eax
call fcn.004e8811
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x55fabc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x624ec2
call fcn.0044c384
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.AcroStdBase.0
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 4]
lea edi, [esi + 4]
push edi
call fcn.004f6f28
mov eax, dword [edi + 4]
mov dword [ebx + 8], eax
lea eax, [esi + 0xc]
lea ecx, [ebx + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.00545b9c
push 6
add esi, 0x14
lea edi, [ebx + 0x14]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x2c]
mov byte [ebp - 4], 2
lea edi, [esi + 0x2c]
push edi
call fcn.004f6f28
mov eax, dword [edi + 4]
add esi, 0x40
mov dword [ebx + 0x30], eax
mov eax, dword [esi - 0xc]
mov dword [ebx + 0x34], eax
mov eax, dword [esi - 8]
mov dword [ebx + 0x38], eax
mov al, byte [esi - 4]
lea edi, [ebx + 0x40]
mov byte [ebx + 0x3c], al
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebx], vtable.CommonShadingInfo.0
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x56751c
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, dword [0x6b9c70]
test eax, eax
je 0x567540
push 0
push 0x5676ba
push eax
call fcn.005aa143
push dword [0x6b9c70]
call fcn.005aa18a
add esp, 0x10
mov eax, dword [0x6b9c74]
and dword [0x6b9c70], 0
test eax, eax
je 0x567557
push eax
call fcn.005aa18a
pop ecx
and dword [0x6b9c74], 0
call fcn.00567801
test ax, ax
je 0x56756d
jmp fcn.0056756e
ret
Function at 0x567af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push esi
lea eax, [ebp - 0x23c]
push edi
push eax
push 0x104
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x567b7c
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x138]
push str._sFOR.
push eax
call fcn.00598752
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0xc
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x138]
push eax
call esi
cmp eax, 0xffffffff
jne 0x567b79
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x138]
push str._sZTR.
push eax
call fcn.00598752
add esp, 0xc
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x138]
push eax
call esi
cmp eax, 0xffffffff
je 0x567b7c
push 1
pop edi
mov ax, di
pop edi
pop esi
leave
ret
Function at 0x59e310
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
push edi
mov esi, 0x69a2e0
lea edi, [ebp - 0x58]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x54], 0x43
movsx eax, byte [ebp - 0x54]
test eax, eax
je 0x59e461
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x59e447
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
mov dword [ebp - 0x5c], 0x50
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x59e447
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x59e391
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
jmp 0x59e37d
push 0x69a2dc
push dword [ebp - 0x70]
call fcn.005986b2
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
push 0x3a
push dword [ebp - 0x70]
call fcn.0059867a
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x6c], 0
je 0x59e3c0
mov eax, dword [ebp - 0x6c]
and byte [eax], 0
jmp 0x59e3cc
cmp dword [ebp - 0x64], 0
je 0x59e3cc
mov eax, dword [ebp - 0x64]
and byte [eax], 0
push dword [ebp - 0x70]
call fcn.0059e467
pop ecx
push dword [ebp - 0x70]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.005986b2
pop ecx
pop ecx
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x59e447
mov eax, dword [ebp + 8]
inc eax
cmp dword [ebp - 0x68], eax
jne 0x59e447
push dword [ebp + 8]
call fcn.00598610
pop ecx
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x59e447
mov eax, dword [ebp + 8]
mov byte [eax], 0x2f
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x54]
mov byte [eax + 1], cl
mov eax, dword [ebp + 8]
and byte [eax + 2], 0
push dword [ebp - 0x70]
call fcn.00598476
pop ecx
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + eax + 1]
push eax
push dword [ebp + 8]
call fcn.005986d3
pop ecx
pop ecx
push dword [ebp - 0x74]
call fcn.005989b0
pop ecx
push 1
pop eax
jmp 0x59e463
mov al, byte [ebp - 0x54]
add al, 1
mov byte [ebp - 0x54], al
movsx eax, byte [ebp - 0x54]
cmp eax, 0x5a
jle 0x59e45c
and byte [ebp - 0x54], 0
jmp 0x59e327
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x59e52c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 8], 0
je 0x59e604
and dword [ebp - 0x28], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.005a0047
pop ecx
pop ecx
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x12c]
mov dword [ebp - 0xc], eax
push 0x69a2d8
lea eax, [ebp - 0x12c]
push eax
call fcn.0059848b
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call fcn.00598476
pop ecx
lea eax, [ebp + eax - 0x12c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x59e5d9
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x2f
jne 0x59e5b5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jne 0x59e5b5
jmp 0x59e5d9
lea eax, [ebp - 0x29]
cmp dword [ebp - 0x24], eax
jne 0x59e5bf
jmp 0x59e5d9
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
mov byte [eax], cl
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
jmp 0x59e591
mov eax, dword [ebp - 0x24]
and byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.0059e608
pop ecx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x59e604
push 1
pop eax
jmp 0x59e606
xor eax, eax
leave
ret
Function at 0x59e64f
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], 0x640
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.0044d830
pop ecx
mov byte [ebp - 0x14], al
movsx eax, byte [ebp - 0x14]
cmp eax, 0x41
jl 0x59e687
movsx eax, byte [ebp - 0x14]
cmp eax, 0x5a
jle 0x59e68e
xor eax, eax
jmp 0x59e7e1
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x59e6a6
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 2]
cmp eax, 0x5c
je 0x59e6ad
xor eax, eax
jmp 0x59e7e1
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x59e6ce
xor eax, eax
jmp 0x59e7e1
push dword [ebp - 0x1c]
call fcn.0044e905
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x59e6e5
jmp 0x59e7c7
push 1
pop eax
test eax, eax
je 0x59e7c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call sub.MPR.dll_WNetEnumResourceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x59e744
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.0044e665
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x59e73c
jmp 0x59e7c7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
jmp 0x59e6e5
cmp dword [ebp - 0xc], 0
je 0x59e74c
jmp 0x59e7c7
and dword [ebp - 0x24], 0
jmp 0x59e759
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jge 0x59e7c2
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + eax + 0x10], 0
je 0x59e7c0
movsx esi, byte [ebp - 0x14]
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax + 0x10]
movsx eax, byte [eax]
push eax
call fcn.0044d830
pop ecx
cmp esi, eax
jne 0x59e7c0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
push dword [ecx + eax + 0x14]
push dword [ebp + 8]
call fcn.0044bec0
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
inc eax
push eax
push dword [ebp + 8]
call fcn.0044bed0
pop ecx
pop ecx
jmp 0x59e7c7
jmp 0x59e752
jmp 0x59e6e5
push dword [ebp - 0x18]
call sub.MPR.dll_WNetCloseEnum
cmp dword [ebp - 0x10], 0
je 0x59e7de
push dword [ebp - 0x10]
call fcn.0044ddce
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x59f282
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x59f314
test byte [ebp + 0xc], 4
je 0x59f2a0
mov eax, 0xc0000000
xor ecx, ecx
push 2
jmp 0x59f2d3
test byte [ebp + 0xc], 2
je 0x59f2c3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x59f2ba
mov eax, 0x400a0010
pop ebp
ret
mov eax, 0xc0000000
xor ecx, ecx
jmp 0x59f2d1
push 1
pop ecx
cmp word [ebp + 0xc], cx
jne 0x59f2d6
mov eax, Ordinal_3
push 3
pop edx
jmp 0x59f2df
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
push 0
push 0x10000080
push edx
push 0
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x59f30b
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x400d0000
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov eax, 0x400a0001
pop ebp
ret
Function at 0x59f561
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push esi
lea eax, [ebp - 0x140]
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x59f6c7
lea eax, [ebp - 0x340]
and byte [ebp + 8], 0
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0044d668
add esp, 0x14
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
lea eax, [ebp + 8]
push 1
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044bec0
lea eax, [ebp - 8]
push 0x67434c
push eax
call fcn.0044bed0
add esp, 0x10
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x59f6c7
cmp dword [ebp - 0xa8], 1
jne 0x59f669
mov eax, dword [ebp - 0xac]
and eax, 0xffff
cmp eax, 0x3e8
ja 0x59f669
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x59f6c7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x59f6ba
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x59f6c7
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x59f6c0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
call eax
test eax, eax
je 0x59f6c0
cmp dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
jbe 0x59f6ae
or dword [eax], 0xffffffff
jmp 0x59f6b3
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, 1
jmp 0x59f6ca
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ax, ax
pop esi
leave
ret
Function at 0x5a08b9
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
cmp word [0x6bb224], dx
push 1
pop ecx
jne 0x5a0932
push ebx
push esi
lea esi, [eax + 0x10]
push edi
mov dword [ebp + 8], ecx
mov edi, esi
mov ecx, edx
shl ecx, 8
or ecx, edx
shl ecx, 2
mov ebx, ecx
shl ebx, 0x10
or ebx, ecx
add ebx, 0x3020100
inc edx
mov dword [edi], ebx
add edi, 4
cmp edx, 0x10
jl 0x5a08d8
xor ecx, ecx
mov dl, byte [esi + ecx]
movzx edi, dl
sub edi, ecx
mov byte [ecx + 0x6bb228], dl
neg edi
sbb edi, edi
inc edi
and dword [ebp + 8], edi
inc ecx
cmp ecx, 0x40
jl 0x5a08fc
mov cx, word [ebp + 8]
push 1
mov word [0x6bb268], cx
pop ecx
pop edi
pop esi
mov word [0x6bb224], cx
xor edx, edx
pop ebx
cmp byte [ebp + 0xc], dl
je 0x5a0940
cmp word [0x6bb268], dx
jne 0x5a0942
xor ecx, ecx
mov byte [eax + 0x58], cl
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x5a55a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
lea eax, [eax + eax*2]
push str.RCDATA
shl eax, 2
mov esi, dword [eax + 0x6a4e9c]
mov edi, dword [eax + 0x6a4ea0]
push esi
call fcn.005984f9
pop ecx
test eax, eax
pop ecx
jne 0x5a55d2
push 0xa
jmp 0x5a55d3
push esi
push edi
push dword [0x6b504c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5a564e
push esi
push dword [0x6b504c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5a564e
push esi
push dword [0x6b504c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x5a560f
push ebx
jmp 0x5a5620
lea eax, [esi + 1]
push eax
call fcn.005988ea
mov edi, eax
pop ecx
test edi, edi
push ebx
jne 0x5a5628
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x5a5659
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
push edi
call fcn.005a00cb
and byte [edi + esi], 0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov eax, edi
jmp 0x5a565b
push 0x40000007
call fcn.00598a7e
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x5aa461
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x10
pop eax
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp + 0x10], eax
jle 0x5aa475
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jle 0x5aa4f0
mov eax, dword [ebp + 8]
push 0x108
push eax
mov ecx, dword [eax]
call dword [ecx]
pop ecx
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x5aa4f0
push esi
xor esi, esi
push edi
xor eax, eax
mov byte [eax + ecx + 4], al
inc eax
cmp eax, 0x100
jl 0x5aa495
xor edi, edi
mov edx, dword [ebp + 0xc]
mov al, byte [edi + ecx + 4]
add ebx, eax
mov dl, byte [esi + edx]
add edx, ebx
and edx, 0xff
mov dword [ebp - 4], edx
mov dl, byte [ecx + edx + 4]
mov ebx, dword [ebp - 4]
mov byte [edi + ecx + 4], dl
mov byte [ecx + ebx + 4], al
lea eax, [esi + 1]
cdq
idiv dword [ebp + 0x10]
inc edi
cmp edi, 0x100
mov esi, edx
jl 0x5aa4a3
mov eax, dword [ebp + 8]
and byte [ecx + 0x104], 0
and byte [ecx + 0x105], 0
pop edi
mov dword [ecx], eax
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x5aa4f5
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5aa57a
mov al, byte [ecx + 0x104]
mov edx, dword [ebp + 0x14]
mov byte [ebp + 0xb], al
mov al, byte [ecx + 0x105]
test edx, edx
mov byte [ebp - 1], al
jle 0x5aa568
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
sub eax, ebx
push edi
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
inc byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
mov dl, byte [eax + ecx + 4]
add byte [ebp - 1], dl
lea esi, [eax + ecx + 4]
movzx eax, byte [ebp - 1]
lea edi, [eax + ecx + 4]
mov al, byte [eax + ecx + 4]
mov byte [esi], al
add eax, edx
and eax, 0xff
mov byte [edi], dl
mov edx, dword [ebp + 0x10]
mov al, byte [eax + ecx + 4]
xor al, byte [edx + ebx]
mov byte [ebx], al
inc ebx
dec dword [ebp + 0x14]
jne 0x5aa52a
pop edi
pop esi
pop ebx
mov al, byte [ebp + 0xb]
mov byte [ecx + 0x104], al
mov al, byte [ebp - 1]
mov byte [ecx + 0x105], al
leave
ret
Function at 0x5ac791
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp word [ebp + 0x18], 0
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
sete al
push esi
mov esi, dword [ecx]
mov ecx, dword [ebp + 0xc]
dec eax
and al, 1
push edi
mov dl, byte [ecx]
add eax, 0xff
mov byte [ebp + 0x1b], al
mov byte [ebp - 1], dl
mov byte [ecx], 0xaa
movzx ecx, byte [ebx]
movzx edx, al
xor ecx, edx
inc ebx
test ecx, ecx
mov dword [ebp - 8], ecx
jne 0x5ac839
cmp byte [ebx], al
jne 0x5ac833
cmp byte [ebx + 1], al
lea ecx, [ebx + 1]
jne 0x5ac82d
cmp byte [ebx + 2], al
lea ecx, [ebx + 2]
jne 0x5ac825
cmp byte [ebx + 3], al
lea ecx, [ebx + 3]
jne 0x5ac81f
mov cl, al
push 4
neg cl
sbb ecx, ecx
pop edx
mov dword [ebp + 8], ecx
mov ecx, ebx
and ecx, 3
lea edi, [ebx - 1]
sub edx, ecx
mov ecx, dword [ebp + 8]
add ebx, edx
cmp dword [ebx], ecx
jne 0x5ac80f
add ebx, 4
jmp 0x5ac806
imul edi, edi, 0x1fff
add edi, ebx
shl edi, 3
add word [esi], di
jmp 0x5ac7bf
add word [esi], 0x20
jmp 0x5ac829
add word [esi], 0x18
mov ebx, ecx
jmp 0x5ac7bf
add word [esi], 0x10
jmp 0x5ac829
add word [esi], 8
jmp 0x5ac7bf
mov dx, word [ecx*2 + 0x63b2a4]
lea ecx, [ecx*2 + 0x63b2a4]
movzx edi, dx
mov cl, byte [ecx + 2]
add edi, 0x63b4a8
sub cl, dl
mov dword [ebp + 8], edx
mov byte [ebp + 0xb], cl
jne 0x5ac866
call fcn.005a54b7
mov al, byte [ebp + 0x1b]
cmp byte [ebp + 0xb], 8
jbe 0x5ac874
call fcn.005a54b7
mov al, byte [ebp + 0x1b]
cmp esi, dword [ebp + 0x14]
jb 0x5ac881
call fcn.005a54b7
mov al, byte [ebp + 0x1b]
movzx edx, byte [ebp + 0xb]
lea ecx, [edx - 1]
cmp ecx, 7
ja case.default.0x5ac891
jmp dword [ecx*4 + 0x5ac957]
cmp dword [ebp + 0xc], ebx
jb 0x5ac945
movzx cx, byte [edi + 6]
mov word [esi + 0xe], cx
movzx cx, byte [edi + 5]
mov word [esi + 0xc], cx
movzx cx, byte [edi + 4]
mov word [esi + 0xa], cx
movzx cx, byte [edi + 3]
mov word [esi + 8], cx
movzx cx, byte [edi + 2]
mov word [esi + 6], cx
movzx cx, byte [edi + 1]
mov word [esi + 4], cx
not al
mov byte [ebp + 0x1b], al
jmp case.default.0x5ac891
cmp dword [ebp + 0xc], ebx
jb 0x5ac945
movzx cx, byte [edi + 7]
mov word [esi + 0x10], cx
movzx cx, byte [edi + 6]
mov word [esi + 0xe], cx
movzx cx, byte [edi + 5]
mov word [esi + 0xc], cx
movzx cx, byte [edi + 4]
mov word [esi + 0xa], cx
movzx cx, byte [edi + 3]
mov word [esi + 8], cx
movzx cx, byte [edi + 2]
mov word [esi + 6], cx
movzx cx, byte [edi + 1]
mov word [esi + 4], cx
movzx cx, byte [edi]
mov word [esi + 2], cx
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + 0x63b8a8]
and cl, 0xf
movzx cx, cl
add word [esi], cx
lea esi, [esi + edx*2]
jmp 0x5ac7bf
mov ecx, dword [ebp + 0xc]
mov al, byte [ebp - 1]
pop edi
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop ebx
leave
ret
Function at 0x5b0606
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
cmp dword [0x6bb3c4], 0
jne 0x5b0746
push ebx
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
push dword [0x6b504c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044d668
lea eax, [ebp - 0x208]
push str...ResourceCMap
push eax
call fcn.005986d3
push 0x679458
lea eax, [ebp - 0x208]
push 0x684d30
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044de37
mov esi, dword [sym.imp.USER32.dll_OemToCharA]
add esp, 0x30
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5b073d
push edi
test byte [ebp - 0x44c], 0x10
jne 0x5b072a
lea eax, [ebp - 0x420]
push 0x6b4f90
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044de37
add esp, 0x14
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x30c]
push eax
call fcn.0059e157
mov edi, eax
push edi
call fcn.005b0748
pop ecx
test ax, ax
pop ecx
jne 0x5b072a
push edi
call fcn.0059e268
push eax
call fcn.0059d6f7
pop ecx
pop ecx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x5b06c2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
leave
ret
Function at 0x5c09a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x5c09d0
test ecx, ecx
jne 0x5c09da
test edx, edx
jne 0x5c09da
mov eax, edi
jmp 0x5c0a46
cmp eax, 0xffffffff
jne 0x5c09da
push 0xfffffffffffffffe
pop eax
jmp 0x5c0a46
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x5c0a46
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.005be702
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x5c0a0b
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x5c0a2a
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x5c0aa1
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.005c0aa6
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x5c0a8d
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x5c0aa1
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x5c09b2
pop edi
pop esi
pop ebx
pop ebp
ret