joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d090
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4666e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [esp + 0x68]
mov dword [esp + 4], 0x4675b0
test eax, eax
mov dword [esp + 0x24], 0x4675a8
jne 0x45d0c5
mov eax, 0x47d770
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x78]
push 0
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0040b32a
lea edx, [esp + 0x3c]
mov dword [esp + 0x70], 0
push edx
call fcn.0045cce0
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov ecx, eax
mov byte [esp + 0x88], 1
call fcn.0040bbda
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x78], edi
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x5c]
neg eax
sbb eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, ecx
mov byte [esp + 0x70], 5
mov edx, dword [eax]
mov esi, dword [edx + 4]
add esi, eax
call ebx
lea ecx, [esp + 0x3c]
mov dword [esi], eax
neg ecx
sbb ecx, ecx
lea eax, [esp + 0x50]
and ecx, eax
call fcn.00405562
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x40]
neg ecx
sbb ecx, ecx
push 1
and ecx, edx
mov byte [esp + 0x74], 4
call fcn.0040b5a4
mov byte [esp + 0x70], 3
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [esp + ecx + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
mov ebp, eax
lea esi, [eax + eax + 2]
mov eax, dword [esp + 0x2c]
cmp esi, eax
mov eax, dword [esp + 0x28]
jae 0x45d1a9
test eax, eax
jne 0x45d1c7
push eax
call fcn.0043abc6
shr esi, 6
inc esi
shl esi, 6
push esi
mov dword [esp + 0x34], esi
call fcn.0043b8cf
add esp, 8
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x2c]
push 0
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0040c1e4
lea edx, [esp + 0x10]
push 0
mov eax, dword [esp + 0x2c]
push edx
push ebp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
je 0x45d1fc
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45d1fc
push edi
call eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
neg eax
sbb eax, eax
and eax, ecx
mov edx, dword [eax]
mov esi, dword [edx + 4]
add esi, eax
call ebx
mov dword [esi], eax
lea esi, [esp + 0x14]
neg esi
sbb esi, esi
lea eax, [esp + 0x28]
and esi, eax
mov ecx, dword [esi]
push ecx
call fcn.0043abc6
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 4
push edx
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x18]
neg esi
sbb esi, esi
xor ebx, ebx
and esi, eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x45d26a
mov cl, byte [eax - 1]
test cl, cl
je 0x45d264
cmp cl, 0xff
je 0x45d264
dec cl
mov byte [eax - 1], cl
jmp 0x45d26a
add eax, 0xfffffffe
push eax
call edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [esp + edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x60]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 4
Function at 0x45d826
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
lea eax, [ebp - 0x10]
push 4
push eax
xor edi, edi
push dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x7863513
push dword [ebp + 0xc]
call fcn.0045d9ba
add esp, 0x10
mov dword [ebp - 4], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x18], ebx
je 0x45d981
push esi
lea eax, [ebp - 0xc]
push dword [ebp + 0x18]
mov dword [ebp + 8], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0045d9f8
add esp, 0xc
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x45d977
push edi
push edi
push edi
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [ebp + 0xc], eax
je 0x45d96e
mov ebx, dword [ebp + 8]
xor ecx, ecx
or ebx, esi
xor esi, esi
cmp ecx, edi
mov dword [ebp - 0x1c], edi
jl 0x45d944
jg 0x45d8e8
cmp ebx, edi
jbe 0x45d944
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x14], edi
cdq
push edx
push eax
push dword [ebp - 0x1c]
push esi
je 0x45d911
call fcn.0043da30
mov ecx, dword [ebp - 4]
mov al, byte [eax + ecx]
push eax
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
push eax
call fcn.0045d990
jmp 0x45d929
call fcn.0043da30
mov ecx, dword [ebp - 4]
mov al, byte [eax + ecx]
push eax
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
push eax
call fcn.0045d9a5
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx], al
add esi, 1
adc dword [ebp - 0x1c], edi
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
jl 0x45d8e8
jg 0x45d944
cmp esi, ebx
jb 0x45d8e8
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x45d962
mov eax, dword [esi + 4]
cmp eax, edi
je 0x45d962
push dword [esi + 8]
push ecx
push ebx
push dword [ebp + 0xc]
call eax
add esp, 0x10
mov dword [esi + 0xc], eax
push 1
pop edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push dword [ebp - 4]
call fcn.0043abc6
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x45d9ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
call fcn.0043b8cf
xor esi, esi
pop ecx
cmp dword [ebp + 0xc], esi
mov ebx, eax
jle 0x45d9f2
push edi
mov edi, dword [ebp + 8]
sub edi, ebx
mov eax, esi
lea ecx, [esi + ebx]
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov al, byte [edx + eax]
xor al, byte [edi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [ecx], al
jl 0x45d9d7
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x403b1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x403b99
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x403b99
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b99
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403b80
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x403b90
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x403b7e
xor al, al
jmp 0x403b8c

Function at 0x4042a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x4042da
push edi
push 0
push str.OZACMS
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4435ba
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4042d9
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4042d9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4042d9
mov ecx, dword [ebx]
push 0
push edi
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
push edx
push edx
push edx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x4042d9
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439004]
jne 0x40100a
repz ret
jmp fcn.004016ac

Function at 0x409144
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d07
and dword [ebp - 4], 0
cmp dword [0x43f4e0], 0
mov ebx, eax
jne 0x4091f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092a6
push eax
call fcn.00403c95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43f4e0], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f4e4], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f4e8], eax
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x43f4f0], eax
test eax, eax
je 0x4091f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x43f4ec], eax
mov eax, dword [0x43f4ec]
cmp eax, ebx
je 0x40924d
cmp dword [0x43f4f0], ebx
je 0x40924d
push eax
call fcn.00403d10
push dword [0x43f4f0]
mov esi, eax
call fcn.00403d10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40924d
test edi, edi
je 0x40924d
call esi
test eax, eax
je 0x409244
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409244
test byte [ebp - 0xc], 1
jne 0x40924d
or dword [ebp + 0x10], 0x200000
jmp 0x409286
mov eax, dword [0x43f4e4]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409286
mov eax, dword [0x43f4e8]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f4e0]
call fcn.00403d10
pop ecx
test eax, eax
je 0x4092a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x562810d9
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
cmp eax, 1
je 0x56281105
test eax, eax
je 0x56281195
cmp eax, 3
jne 0x562810fb
push 0
call fcn.5628501d
add esp, 4
mov eax, 1
pop esi
pop ebx
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
mov ebx, eax
and esi, 0xff
cmp esi, 3
je 0x56285c4b
inc dword [section..data]
call fcn.56283918
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x562b100c], eax
mov dword [sym.MSVCRT20.dll__winmajor], esi
shl esi, 8
mov al, bh
shr ebx, 0x10
and eax, 0xff
add esi, eax
mov dword [sym.MSVCRT20.dll__winminor], eax
mov dword [sym.MSVCRT20.dll__winver], esi
mov dword [sym.MSVCRT20.dll__osver], ebx
call fcn.562850b9
test eax, eax
je 0x56285c75
call fcn.56283727
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [sym.MSVCRT20.dll__acmdln], eax
call fcn.5628379a
mov dword [sym.MSVCRT20.dll__wcmdln], eax
call fcn.56282e20
call fcn.562837ff
call fcn.562851ee
jmp 0x562810fb
mov eax, dword [section..data]
test eax, eax
jle 0x56285c8b
dec eax
cmp dword [0x562b12a4], 0
mov dword [section..data], eax
je 0x56285c81
call fcn.56285697
call fcn.562857e4
jmp 0x562810fb
test ebx, 0x80000000
je 0x5628111e
push 0x12000
push 0x562b1018
push str.Error:_This_version_of_MSVCRT20.DLL_is_not_compatible_nwith_Win32s.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x56281100
call fcn.562857e4
xor eax, eax
jmp 0x56281100
call sym.MSVCRT20.dll__c_exit
jmp 0x562811b5
xor eax, eax
jmp 0x56281100

Function at 0x56284fbb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x70
xor edi, edi
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
cmp esi, edi
je 0x56288c5d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push 0x56284f54
mov dword [esi + 0x48], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x56288c55
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCRT20.dll_free
add esp, 4
test edi, edi
je 0x56288c73
push edi
call fcn.56290737
add esp, 4
xor eax, eax
jmp 0x56285019
Function at 0x5628501d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x562b1434], 0xffffffff
push esi
je 0x56285088
mov esi, dword [esp + 8]
test esi, esi
je 0x5628508a
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x56288c7a
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x56288c88
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x56288c96
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x56288ca4
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x56288cb2
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x56288cc0
push esi
call sym.MSVCRT20.dll_free
add esp, 4
push 0
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x5628507a
jmp 0x5628502f
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x5628503a
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285045
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285050
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x5628505b
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285066
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285071

Function at 0x5628509e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x56288cce
mov eax, esi
pop esi
ret
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
test esi, esi
je 0x56288d13
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x56288d13
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
jmp 0x562850b5
push 0x10
call sym.MSVCRT20.dll__amsg_exit
add esp, 4
jmp 0x562850b5

Function at 0x562850b9
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.56283706
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x562b1434], eax
cmp eax, 0xffffffff
je 0x56288d22
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
test esi, esi
je 0x56288d22
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x56288d22
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], 0x562b11e0
mov dword [esi + 0x14], 1
pop esi
ret
xor eax, eax
jmp 0x56285120
Function at 0x56285943
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.56281d69
mov dword [0x562b12a4], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x562b12a0], bl
jne 0x562859a4
cmp dword [0x562afbc4], 0
je 0x56285992
mov esi, dword [0x562afbc0]
sub esi, 4
cmp esi, dword [0x562afbc4]
jb 0x56285992
mov eax, dword [esi]
test eax, eax
je 0x56285987
call eax
sub esi, 4
cmp esi, dword [0x562afbc4]
jae 0x5628597f
push 0x562b8314
push 0x562b8304
call sym.MSVCRT20.dll__initterm
add esp, 8
push 0x562b831c
push 0x562b8318
call sym.MSVCRT20.dll__initterm
add esp, 8
test ebx, ebx
jne 0x56288f7b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.562851e3
pop esi
pop ebx
ret

Function at 0x56290f57
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x56290f7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x56290fa3
test byte [esp + 8], 2
je 0x56290fa3
call sym.MSVCRT20.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT20.dll___doserrno
mov dword [eax], 5
mov eax, 0xffffffff
jmp 0x56290f7a
xor eax, eax
jmp 0x56290f7a

Function at 0x56291016
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
xor edi, edi
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
cmp esi, edi
je 0x5629106d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push esi
mov dword [esi + 0x48], eax
push 4
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
push esi
push 0x5629109b
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov edi, eax
test edi, edi
jne 0x5629108b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCRT20.dll_free
add esp, 4
test edi, edi
je 0x56291083
push edi
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x56291065
mov eax, edi
jmp 0x56291088

Function at 0x5629127f
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x562912e4
lea eax, [ebp - 0x10c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x562912e4
mov byte [ebp - 4], 0x3d
movzx eax, byte [ebp - 0x10c]
push eax
call sym.MSVCRT20.dll__mbctoupper
add esp, 4
lea ecx, [ebp - 4]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
mov byte [ebp - 3], al
lea eax, [ebp - 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
mov eax, 0
jne 0x562912f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x562912fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x5629133a
cmp byte [ebp - 0x103], 0x3a
jne 0x5629133a
movzx eax, byte [ebp - 0x104]
push eax
call sym.MSVCRT20.dll_toupper
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x56291341
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 1
jl 0x562913ac
cmp ebx, 0x1f
jg 0x562913ac
push 0xc
add bl, 0x40
call fcn.56281b67
add esp, 4
mov byte [ebp - 4], bl
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea ebx, [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x5629138c
push 0xc
call fcn.562810c3
add esp, 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
push 0xc
call fcn.562810c3
add esp, 4
mov eax, 0xffffffff
jmp 0x56291387
call sym.MSVCRT20.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT20.dll___doserrno
mov dword [eax], 0xf
jmp 0x562913a5

Function at 0x562913c4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x562913ef
test byte [esp + 0xc], 0x80
je 0x56291405
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
mov eax, 0
jne 0x56291403
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
pop esi
ret
or al, 1
jmp 0x562913de
Function at 0x562c5530
Capabilities:
Encode data using xor

Disassembly:
call 0x562c54a9
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x562c54d9
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x562c54f5
xor edx, 0
jmp 0x562c5500
xor edx, edx
jmp 0x562c5517
jmp 0x562c5523
xor eax, eax
push 0x8427d7c0
call 0x562c5530
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x562c556c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x562c5545
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x562c5583
add eax, 0
jno 0x562c5588
add esi, 0
ret 0x10

Function at 0x562c62f1
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x562c6313
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x562c64b5
cmp edi, dword [ebp + 0x10]
jb 0x562c64b5
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.562c5ddd
inc edi
jmp 0x562c639c
jmp 0x562c63a9
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.562c5ddd
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.562c5ddd
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x562c63fd
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x562c63e1
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.562c642b
add dword [eax], 0x39
jle 0x562c6407
sub al, 0xf5
mov ch, al
call fcn.562c6440
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10