joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5527b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x71fc90], 0
jne 0x5527d9
mov dword [0x71fc90], 1
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.0062939d
add esp, 4
call fcn.00552660
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x552873
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0061c880
add eax, esi
push eax
mov ecx, edi
call fcn.00542050
xor ebx, ebx
call fcn.00552620
test esi, esi
jle 0x55285c
dec esi
shr esi, 2
inc esi
lea ebx, [esi*4]
mov eax, dword [0x71f8a0]
movzx ecx, byte [eax + 0x7058f8]
mov dword [0x71f8a0], ecx
mov ecx, dword [0x7058f0]
movzx edx, byte [ecx + 0x7058f8]
mov ecx, dword [ecx*4 + 0x71f8a8]
xor dword [eax*4 + 0x71f8a8], ecx
lea eax, [eax*4 + 0x71f8a8]
push 4
push eax
mov ecx, edi
mov dword [0x7058f0], edx
call fcn.00540eb0
dec esi
jne 0x552812
mov esi, dword [ebp + 8]
mov byte [0x71f8a4], 0
cmp ebx, esi
jle 0x552871
sub ebx, esi
push ebx
mov ecx, edi
call fcn.00540080
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x552f40
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a8bc
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
call fcn.0053e160
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.0053fa80
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0053f190
lea ecx, [ebp - 0xa8]
call fcn.0056ca70
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.0056caa0
lea ecx, [ebp - 0x134]
test al, al
je 0x552fd8
call fcn.0053e9e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x5530f0
call fcn.0053f480
cmp eax, 0x104
jle 0x553090
lea ecx, [ebp - 0x244]
call fcn.0053e160
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x134]
push ecx
mov byte [ebp - 4], 2
call fcn.00552b80
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.0053e160
push 0x6ae05c
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.0053f930
lea ecx, [ebp - 0x244]
call fcn.0053ed40
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0053f930
lea ecx, [ebp - 0x1bc]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x55306d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x55306b
mov esi, 1
test esi, esi
lea ecx, [ebp - 0x1bc]
setne bl
mov byte [ebp - 4], 2
call fcn.0053e210
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.0053e210
jmp 0x5530f3
lea ecx, [ebp - 0x134]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xac], eax
test eax, eax
jne 0x5530e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x5530da
push edi
mov ecx, esi
call fcn.00561f10
mov ebx, dword [esi]
lea ecx, [ebp - 0x134]
call fcn.0053ed40
mov edx, dword [ebx + 0x28]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x5530e9
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
setne bl
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.0056ca90
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.0053e210
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0x553530
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a9d7
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xac], eax
call fcn.0053e160
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 0
call fcn.0053e160
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0053fa80
push edi
lea ecx, [ebp - 0x1bc]
call fcn.0053fa80
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0053f190
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0053f190
lea ecx, [ebp - 0xa8]
call fcn.0056ca70
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.0056caa0
test al, al
je 0x55360a
lea ecx, [ebp - 0x1bc]
call fcn.0053e9e0
push eax
lea ecx, [ebp - 0x134]
call fcn.0053e9e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne bl
jmp 0x5536d8
lea ecx, [ebp - 0x134]
call fcn.0053f480
test eax, eax
jg 0x553650
lea ecx, [ebp - 0x1bc]
call fcn.0053f480
test eax, eax
jg 0x553650
lea ecx, [ebp - 0x1bc]
call fcn.0053f670
push eax
lea ecx, [ebp - 0x134]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x5536d8
lea ecx, [ebp - 0x244]
call fcn.0053e160
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 3
call fcn.0053e160
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x134]
push edx
mov byte [ebp - 4], 4
call fcn.00552e60
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00552e60
add esp, 0x10
lea ecx, [ebp - 0x2cc]
call fcn.0053f670
push eax
lea ecx, [ebp - 0x244]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2cc]
setne bl
mov byte [ebp - 4], 3
call fcn.0053e210
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 2
call fcn.0053e210
test bl, bl
jne 0x5536eb
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x5536eb
call fcn.00561e70
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.0056ca90
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0
call fcn.0053e210
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.0053e210
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0x553740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63aa21
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, edi
mov dword [ebp - 0xac], eax
mov dword [esi], 0xffffffff
call fcn.0053f480
test eax, eax
jne 0x5537b0
test ebx, ebx
je 0x5537a9
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
push str.GetAttributes:_filename_is_empty
mov ecx, ebx
call edx
xor al, al
jmp 0x5538d6
lea ecx, [ebp - 0x134]
call fcn.0053e160
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.0053fa80
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0053f190
lea ecx, [ebp - 0x134]
call fcn.0053f480
lea ecx, [ebp - 0xa8]
mov edi, eax
call fcn.0056ca70
mov bl, 1
mov byte [ebp - 4], bl
cmp edi, 0x104
jge 0x553839
lea ecx, [ebp - 0x134]
call fcn.0053e7c0
test al, al
jne 0x553820
lea ecx, [ebp - 0xa8]
call fcn.0056caa0
test al, al
je 0x553839
lea ecx, [ebp - 0x134]
call fcn.0053e9e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x55389d
test edi, edi
jle 0x553886
lea ecx, [ebp - 0x1bc]
call fcn.0053e160
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x134]
push eax
mov byte [ebp - 4], 2
call fcn.00552e60
add esp, 8
lea ecx, [ebp - 0x1bc]
call fcn.0053e650
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x1bc]
mov dword [esi], eax
mov byte [ebp - 4], bl
call fcn.0053e210
jmp 0x55389a
lea ecx, [ebp - 0x134]
call fcn.0053e650
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x5538ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.0056ca90
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.0053e210
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0x553900
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63aa7c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x158]
call fcn.0053e160
push esi
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0
call fcn.0053fa80
push 0x5c
push 0x2f
lea ecx, [ebp - 0x158]
call fcn.0053f190
lea ecx, [ebp - 0xa8]
call fcn.0056ca70
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.0056caa0
lea ecx, [ebp - 0x158]
test al, al
je 0x553995
call fcn.0053e9e0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x5539fe
call fcn.0053f480
test eax, eax
jle 0x5539ea
lea ecx, [ebp - 0x1e0]
call fcn.0053e160
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x158]
push ecx
mov byte [ebp - 4], 2
call fcn.00552e60
add esp, 8
push 0
lea ecx, [ebp - 0x1e0]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x1e0]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0053e210
jmp 0x553a00
push 0
lea ecx, [ebp - 0x158]
call fcn.0053f670
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x553a4d
test edi, edi
je 0x553a4b
lea ecx, [ebp - 0xd0]
call fcn.0053ba20
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.0053df90
mov ebx, dword [edi]
lea ecx, [ebp - 0xd0]
call fcn.00595640
mov edx, dword [ebx + 0x28]
push eax
push str.errorMsg
mov ecx, edi
call edx
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.0053bcf0
test esi, esi
lea ecx, [ebp - 0xa8]
setne bl
mov byte [ebp - 4], 0
call fcn.0056ca90
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0xffffffff
call fcn.0053e210
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0x5543d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00553530

Function at 0x55aa50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x55a210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x55aaa6
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
mov byte [esi + 0x130], al
call fcn.0055bb40
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x10]
push str.Failed_to_start_thread
lea ecx, [esi + 0x10]
call eax
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x24]
lea ecx, [esi + 0x10]
call eax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.0055bb40
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x14]
push str.Task_started_in_background_thread.
lea ecx, [esi + 0x10]
call eax
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x24]
lea ecx, [esi + 0x10]
call eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x55bba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b6a2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x703eb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.ClsBgTask.0
mov word [esi + 8], 0x100
mov byte [esi + 0xa], bl
call fcn.00555500
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
call fcn.0053e160
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 1
call fcn.005400f0
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 2
mov dword [esi + 0xd8], ebx
call fcn.0058f5a0
lea ecx, [esi + 0x1a8]
mov byte [ebp - 4], 3
call fcn.00579c00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55c830
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x55c860
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.Md5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0x55ca80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0053acf0
push eax
mov ecx, edi
call fcn.00595640
push eax
mov ecx, esi
call fcn.0055c8c0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0055c9b0
pop edi
pop esi
pop ebp
ret 8
Function at 0x55cae0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0055c8c0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.0055c9b0
pop esi
pop ebp
ret 0xc

Function at 0x55cb30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0061c880
push eax
mov ecx, edi
call fcn.00595640
push eax
mov ecx, esi
call fcn.0055c8c0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0055c9b0
pop edi
pop esi
pop ebp
ret 8
Function at 0x55d470
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
lea ecx, [eax + eax*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv dword [esi + 4]
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3f1
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x120], edi
lea eax, [eax + ecx + 3]
push eax
mov ecx, edi
call fcn.0053b4f0
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x55d6cd
cmp ebx, ecx
je 0x55d6cd
mov eax, 0x55555556
imul dword [ebp + 0xc]
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x124], eax
test eax, eax
jle 0x55d607
mov dword [ebp - 0x11c], eax
jmp 0x55d516
mov ebx, dword [ebp - 0x110]
movzx eax, byte [ebx + esi]
movzx edx, byte [ebx + esi + 2]
movzx edi, byte [ebx + esi + 1]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x6aea50]
mov byte [ebp + ecx - 0x10c], bl
and eax, 3
shl eax, 4
mov ebx, edi
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x6aea50]
mov byte [ebp + ecx - 0x10b], al
mov eax, edx
sar eax, 6
and edi, 0xf
and eax, 3
add edi, edi
add edi, edi
or eax, edi
movzx eax, byte [eax + 0x6aea50]
and edx, 0x3f
mov dl, byte [edx + 0x6aea50]
mov byte [ebp + ecx - 0x10a], al
mov eax, dword [ebp - 0x114]
mov byte [ebp + ecx - 0x109], dl
mov edx, dword [ebp - 0x118]
add eax, 4
add esi, 3
add ecx, 4
mov dword [ebp - 0x114], eax
cmp eax, dword [edx + 4]
jl 0x55d5bd
mov word [ebp + ecx - 0x10c], 0xa0d
add ecx, 2
mov dword [ebp - 0x114], 0
mov edi, dword [ebp - 0x120]
cmp ecx, 0x100
jl 0x55d5dc
push ecx
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call fcn.0053b820
xor ecx, ecx
dec dword [ebp - 0x11c]
jne 0x55d510
test ecx, ecx
je 0x55d5fb
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.0053b820
mov eax, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x110]
lea edx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
sub eax, edx
sub eax, 0
je 0x55d6bb
dec eax
je 0x55d679
dec eax
jne 0x55d6cd
movzx eax, byte [ebx + esi]
movzx esi, byte [ebx + esi + 1]
mov dword [ebp - 0x118], eax
sar eax, 2
and eax, 0x3f
movzx eax, byte [eax + 0x6aea50]
push eax
mov ecx, edi
call fcn.0053b010
mov eax, dword [ebp - 0x118]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + 0x6aea50]
push edx
mov ecx, edi
call fcn.0053b010
and esi, 0xf
movzx eax, byte [esi*4 + 0x6aea50]
push eax
jmp 0x55d6ab
movzx esi, byte [ebx + esi]
mov ecx, esi
sar ecx, 2
and ecx, 0x3f
movzx edx, byte [ecx + 0x6aea50]
push edx
mov ecx, edi
call fcn.0053b010
and esi, 3
shl esi, 4
movzx eax, byte [esi + 0x6aea50]
push eax
mov ecx, edi
call fcn.0053b010
push 0x3d
mov ecx, edi
call fcn.0053b010
push 0x3d
mov ecx, edi
call fcn.0053b010
push 0xd
mov ecx, edi
call fcn.0053b010
push 0xa
mov ecx, edi
call fcn.0053b010
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55daa0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x11c], edi
test esi, esi
je 0x55dca1
test ebx, ebx
je 0x55dca1
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv esi
push 0x3f0
lea eax, [eax + ecx + 3]
push eax
mov ecx, edi
call fcn.0053b4f0
mov eax, 0x55555556
imul dword [ebp + 0xc]
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x110], eax
test eax, eax
jle 0x55dbf6
mov dword [ebp - 0x118], eax
jmp 0x55db36
mov ebx, dword [ebp - 0x114]
movzx eax, byte [ebx + esi]
movzx edx, byte [ebx + esi + 2]
movzx edi, byte [ebx + esi + 1]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x6aea50]
mov byte [ebp + ecx - 0x10c], bl
and eax, 3
mov ebx, edi
shl eax, 4
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x6aea50]
mov byte [ebp + ecx - 0x10b], al
and edi, 0xf
mov eax, edx
sar eax, 6
add edi, edi
and eax, 3
add edi, edi
or eax, edi
movzx eax, byte [eax + 0x6aea50]
mov edi, dword [ebp - 0x11c]
and edx, 0x3f
mov dl, byte [edx + 0x6aea50]
mov byte [ebp + ecx - 0x10a], al
mov byte [ebp + ecx - 0x109], dl
add ecx, 4
add esi, 3
cmp ecx, 0x100
jl 0x55dbcb
push ecx
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call fcn.0053b820
xor ecx, ecx
dec dword [ebp - 0x118]
jne 0x55db30
test ecx, ecx
je 0x55dbea
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.0053b820
mov eax, dword [ebp - 0x110]
mov ebx, dword [ebp - 0x114]
lea edx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
sub eax, edx
dec eax
je 0x55dc5f
dec eax
jne 0x55dca1
movzx eax, byte [ebx + esi]
movzx esi, byte [ebx + esi + 1]
mov dword [ebp - 0x110], eax
sar eax, 2
and eax, 0x3f
movzx eax, byte [eax + 0x6aea50]
push eax
mov ecx, edi
call fcn.0053b010
mov eax, dword [ebp - 0x110]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + 0x6aea50]
push edx
mov ecx, edi
call fcn.0053b010
and esi, 0xf
movzx eax, byte [esi*4 + 0x6aea50]
push eax
jmp 0x55dc91
movzx esi, byte [ebx + esi]
mov ecx, esi
sar ecx, 2
and ecx, 0x3f
movzx edx, byte [ecx + 0x6aea50]
push edx
mov ecx, edi
call fcn.0053b010
and esi, 3
shl esi, 4
movzx eax, byte [esi + 0x6aea50]
push eax
mov ecx, edi
call fcn.0053b010
push 0x3d
mov ecx, edi
call fcn.0053b010
push 0x3d
mov ecx, edi
call fcn.0053b010
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0x55e770
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x55e787
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi], 0
test eax, eax
je 0x55e91f
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x55e91f
lea ecx, [eax + eax*4]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea eax, [edx + eax + 4]
push eax
mov dword [esi], eax
call fcn.00419f69
mov esi, eax
add esp, 4
test esi, esi
je 0x55e91f
mov eax, 0x55555556
imul dword [ebp + 0xc]
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x55e86a
mov dword [ebp - 4], eax
mov edi, edi
movzx eax, byte [edi + ebx]
movzx edx, byte [edi + ebx + 1]
movzx ebx, byte [edi + ebx + 2]
mov dword [ebp - 8], ebx
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x6aea50]
mov byte [ecx + esi], bl
mov ebx, edx
sar ebx, 4
and eax, 3
and ebx, 0xf
shl eax, 4
or ebx, eax
movzx eax, byte [ebx + 0x6aea50]
mov byte [ecx + esi + 1], al
mov eax, dword [ebp - 8]
and edx, 0xf
mov ebx, eax
sar ebx, 6
add edx, edx
and ebx, 3
add edx, edx
or ebx, edx
mov dl, byte [ebx + 0x6aea50]
mov ebx, dword [ebp + 8]
mov byte [ecx + esi + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x6aea50]
mov byte [ecx + esi + 3], al
add edi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x55e7f0
mov eax, dword [ebp - 0xc]
lea edx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
sub eax, edx
dec eax
je 0x55e8dc
dec eax
jne 0x55e90b
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x6aea50]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x6aea50]
mov byte [ecx + esi + 1], al
and edi, 0xf
movzx edx, byte [edi*4 + 0x6aea50]
mov byte [ecx + esi + 2], dl
mov edx, dword [ebp + 0x10]
mov byte [ecx + esi + 3], 0x3d
pop edi
add ecx, 4
mov byte [ecx + esi], 0
pop ebx
mov eax, esi
mov dword [edx], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x6aea50]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x6aea50]
mov byte [ecx + esi + 1], al
mov word [ecx + esi + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x10]
pop edi
mov byte [ecx + esi], 0
pop ebx
mov eax, esi
mov dword [edx], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x560770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov byte [eax], 0
mov ebx, ecx
mov dword [edi], 0
test esi, esi
je 0x560823
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x560823
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x5607ea
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5607d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x560814
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x560836
push eax
call fcn.00561f10
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14
cmp dword [edi], 0
jne 0x5607e1
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x560836
push eax
push esi
push 1
push ecx
call fcn.00527859
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
je 0x56081a
mov eax, dword [ebx + 8]
push eax
call fcn.005275e7
add esp, 4
test eax, eax
jne 0x560836
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x560836
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14