joyce8/EMBER2024-capa huggingface dataset:
Function at 0x561af2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, pe_nt_image_headers32
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocString
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x561b82
cmp eax, ebx
je 0x561b82
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x561b8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x561d35
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x561e87
xor edx, edx
cmp eax, edx
je 0x561e87
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x561d6a
cmp eax, ecx
jb 0x561d6a
xor ecx, ecx
jmp 0x561d6f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x561d89
jg 0x561e87
cmp eax, dword [esi + 8]
ja 0x561e87
cmp ecx, edx
jne 0x561da3
cmp eax, dword [esi + 0x42c]
ja 0x561da3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x561de8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x561dc3
cmp edi, edx
jb 0x561dc3
xor edx, edx
jmp 0x561dc8
mov edx, 1
cmp ecx, ebx
ja 0x561de8
cmp dword [esp + 0x14], edx
jg 0x561de8
jl 0x561dd8
cmp eax, edi
ja 0x561de8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00561ea0
test eax, eax
je 0x561e87
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x561e36
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x561e77
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x561e77
jmp 0x561e46
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x561e77
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x561e77
cmp dword [edi], ebp
jne 0x561e77
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x5622d0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5dceb8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x562302
call fcn.00539e80
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x562313
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x562368
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x56234e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x562494
cmp dword [esp + 0x18], ebx
jne 0x562368
cmp dword [esp + 0x14], ebx
je 0x562494
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x562379
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.005ac2b0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x5623bf
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x5623bf
call fcn.0047e290
test eax, eax
je 0x5623bf
push 0x6224d4
lea ecx, [esp + 0x14]
call fcn.005ac6da
push ebx
lea ecx, [esp + 0x14]
call fcn.005ac970
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x56246e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x5623fb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x56246e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x562449
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x56244c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x562444
mov dword [esi + 0x10], ebx
jmp 0x56244c
mov dword [esi + 0x10], ecx
jmp 0x56244c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.005ac543
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005ac543
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5622ea
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5dceb8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x562302
call fcn.00539e80
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x562313
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x562368
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x56234e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x562494
cmp dword [esp + 0x18], ebx
jne 0x562368
cmp dword [esp + 0x14], ebx
je 0x562494
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x562379
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.005ac2b0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x5623bf
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x5623bf
call fcn.0047e290
test eax, eax
je 0x5623bf
push 0x6224d4
lea ecx, [esp + 0x14]
call fcn.005ac6da
push ebx
lea ecx, [esp + 0x14]
call fcn.005ac970
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x56246e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x5623fb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x56246e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x562449
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x56244c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x562444
mov dword [esi + 0x10], ebx
jmp 0x56244c
mov dword [esi + 0x10], ecx
jmp 0x56244c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.005ac543
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005ac543
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x562fe0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00453240
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x563029
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x563029
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x633108
call fcn.005a7810
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0055f263
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x56313b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x56313b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x56313b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56313b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x56313b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00453240
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x56313b
mov ecx, dword [ebp - 4]
push 0x5eb654
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.004528f3
add esp, 8
test eax, eax
je 0x56313b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x566a90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00453240
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x566abb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x566acd
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x566c39
push esi
call fcn.0056e560
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x566b03
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.00563160
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x566b42
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.00565b10
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.00565c80
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.00565d80
add esp, 0x24
jmp 0x566b81
test ebp, ebp
jl 0x566b4e
cmp ebp, 0x80
jle 0x566b62
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.00563160
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x566ba6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x566baf
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.00565b10
push esi
call fcn.0056e560
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00565c80
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x566beb
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.00565b10
push esi
call fcn.0056e560
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00565c80
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.00565e30
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x566c1e
jmp 0x566bad
Function at 0x5a76d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5a76dd
xor eax, eax
ret 0xc
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5a77e0
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5fdfcc]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fdfcc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fdfcc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fdfcc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fdfcc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fdfcc]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fdfcc]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5fdfcc]
xor eax, edx
inc ecx
dec edi
jne 0x5a76f8
pop edi
test esi, esi
je 0x5a7802
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5fdfcc]
xor eax, edx
inc ecx
dec esi
jne 0x5a77e4
pop esi
pop ebx
not eax
ret 0xc
Function at 0x5adbde
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x5adc0e
push edi
call ebx
push eax
call fcn.005b35dc
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x5adc38
test byte [ebp - 4], 1
je 0x5adc38
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x5adc38
push edi
call ebx
push eax
call fcn.005b35dc
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x5adcde
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.005adb2b
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x5adc6a
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.005adb2b
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x5adc80
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.005adb2b
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5adcaa
push 0
call ebx
push eax
call fcn.005b35dc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x5adcc8
push eax
call ebx
push eax
call fcn.005b35dc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x5adcdc
push eax
call ebx
push eax
call fcn.005b35dc
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x5add05
test byte [ebp - 4], 1
jne 0x5add05
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x5add05
push edi
call ebx
push eax
call fcn.005b35dc
pop edi
pop ebx
leave
ret 8

Function at 0x5af66c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5af6a4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005aca01
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005ac9d8
jmp 0x5af6b0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x5b1471
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5b14b3
call fcn.005bdb12
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x5b14b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5b14aa
xor eax, eax
jmp 0x5b14bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005b14c1
pop edi
pop esi
pop ebx
ret 4
Function at 0x1039c53c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1039c546
pushal
call 0x1039c54c
pop ebp
sub ebp, 0x10
sub ebp, 0x39c53c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1039c570
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1039c579
mov eax, 0x39c53c
add eax, ebp
add eax, 0x63
mov ecx, 0x610
add byte [eax], al
add byte [ecx + 0x610], bh
mov edx, 0x7d3f6ac8
xor byte [eax], dl
inc eax
dec ecx
jne 0x1039c590
jmp 0x1039c5a3
inc ebx
add eax, 0xc8f44143
enter 0x49c8, 9
xor al, cl
enter 0xffffffffffffcbc8, 5
jo 0x1039c57e
enter 0xffffffffffffc8c8, 0x72
loopne 0x1039c583
enter 0x3fc8, 0x2a
retf
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x82b944
Capabilities:
Encode data using xor

Disassembly:
jmp 0x82b94e
pushal
call 0x82b954
pop ebp
sub ebp, 0x10
sub ebp, 0x42b944
mov al, byte [esp + 0x28]
cmp al, 1
je 0x82b978
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x82b981
mov eax, 0x42b944
add eax, ebp
add eax, 0x63
mov ecx, 0x628
mov edx, 0x98b2e075
xor byte [eax], dl
inc eax
dec ecx
jne 0x82b998
jmp 0x82b9ab
invalid
Function at 0x6d304d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x6d304d4f
pop dword [ebp - 0x50]
mov eax, 0x1dcc71c5
sub eax, 0xb09c2476
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x72170f7d
add dword [ebp - 0x60], 0xdc3b35ce
mov dword [ebp - 0x5c], 0xb178eac4
add dword [ebp - 0x5c], 0x80ba6181
mov dword [ebp - 0x58], 0xc6811f55
sub dword [ebp - 0x58], 0x7a34db27
mov dword [ebp - 0x54], 0xe74e0b4e
sub dword [ebp - 0x54], 0xe74e0b4e
lea eax, [ebp - 0x60]
push eax
mov eax, 0x622bf5ee
add eax, 0xb049a5e
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x967650f1
add dword [ebp - 0x60], 0xddfc1865
mov dword [ebp - 0x5c], 0xcdf252cc
sub dword [ebp - 0x5c], 0x8c85f157
mov dword [ebp - 0x58], 0x47d03f05
add dword [ebp - 0x58], 0x1b9f2d67
mov dword [ebp - 0x54], 0x58f30179
add dword [ebp - 0x54], 0xa70cfe87
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xcd042d5
add eax, 0x60604d83
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3abfc
push 0
call eax
mov ecx, 0x58ed
xor edx, edx
add edx, eax
mov ebx, 0xf567dc95
add ebx, 0x77c93d6b
add ebx, dword [ebp - 0x50]
mov edi, 0x9d4f7ad3
add edi, 0x6db54508
xor dword [ebp - 0x2c], 0xba1cc4c
mov esi, dword [ebx]
mov dword [ebp - 8], 0x6e54d21b
xor esi, edi
add dword [ebp - 0x4c], esi
mov dword [edx], esi
sub dword [ebp - 0x44], 0xdd333140
add edx, 0x250f147c
add edx, 0xdaf0eb88
add ebx, 4
loop 0x6d304e6d
add eax, 0x15687
mov ebx, eax
add eax, 0x2fb1123a
sub eax, 0x2fb11235
mov ecx, 0x33133004
add ecx, 0x3a1bcffc
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x105c0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105c01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105c007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105c006a
add dl, dl
jne 0x105c0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105c00dc
xor eax, eax
add dl, dl
jne 0x105c0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105c017d
add dl, dl
jne 0x105c00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105c00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105c00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105c00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105c00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105c0075
mov eax, 1
add dl, dl
jne 0x105c00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105c00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105c00e1
sub eax, ebx
mov ebx, 1
jne 0x105c0128
mov ecx, 1
add dl, dl
jne 0x105c010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105c0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105c0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105c0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105c013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105c014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105c0136
cmp eax, 0x7d00
jae 0x105c016d
cmp eax, 0x500
jb 0x105c0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105c0075
cmp eax, 0x7f
ja 0x105c0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105c0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105c019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105c0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10