joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x408cef
pop dword [ebp - 0x10]
mov eax, 0xae4aee6f
sub eax, 0xae0a6180
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x16a59f1e
sub dword [ebp - 0x20], 0xc85359d3
mov dword [ebp - 0x1c], 0xbaa5009b
sub dword [ebp - 0x1c], 0x8871b456
mov dword [ebp - 0x18], 0x24403ba2
sub dword [ebp - 0x18], 0xd7f3f774
mov dword [ebp - 0x14], 0xb333858b
add dword [ebp - 0x14], 0x4ccc7a75
lea eax, [ebp - 0x20]
push eax
mov eax, 0xda0d66e5
add eax, 0x26336967
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x76291164
add dword [ebp - 0x20], 0xfe4957f2
mov dword [ebp - 0x1c], 0xe9d39be1
sub dword [ebp - 0x1c], 0xa8673a6c
mov dword [ebp - 0x18], 0xec3ced35
add dword [ebp - 0x18], 0x77327f37
mov dword [ebp - 0x14], 0xeb5c6d1e
add dword [ebp - 0x14], 0x14a392e2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xfe331319
sub eax, 0xfdf242d1
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3946e
push 0
call eax
mov ecx, 0xedd131ce
sub ecx, 0xedd0ea94
mov esi, eax
mov edx, 0x6a5de08a
sub edx, 0x6a1c308a
add edx, dword [ebp - 0x10]
mov ebx, 0x3f542ddf
sub dword [ebp - 0xc], 0x4f15d797
mov edi, dword [edx]
mov dword [ebp - 0xc], 0x6ab3647a
sub edi, ebx
mov dword [esi], edi
xor dword [ebp - 4], ecx
add esi, 0xd656fa93
add esi, 0x29a90571
add edx, 0xafbcf122
add edx, 0x50430ee2
loop 0x408e0b
add eax, 0x78863930
add eax, 0x877ad68b
mov ebx, eax
add eax, 0x2117e53f
sub eax, 0x2117e53a
mov ecx, 0x941666d
add ecx, 0xf6fe9993
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40bdc8
pop dword [ebp - 0x14]
mov eax, 0xdcc0945d
add eax, 0x2380296b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x9d885edf
sub dword [ebp - 0x24], 0x4f361994
mov dword [ebp - 0x20], 0x4a3250c0
add dword [ebp - 0x20], 0xe800fb85
mov dword [ebp - 0x1c], 0xc26334f2
sub dword [ebp - 0x1c], 0x7616f0c4
mov dword [ebp - 0x18], 0x5fe249a1
add dword [ebp - 0x18], 0xa01db65f
lea eax, [ebp - 0x24]
push eax
mov eax, 0xbdb98104
add eax, 0x42874f50
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb6c5a7f4
add dword [ebp - 0x24], 0xbdacc162
mov dword [ebp - 0x20], 0xea715273
add dword [ebp - 0x20], 0x56fb0f02
mov dword [ebp - 0x1c], 0x159b8aa5
sub dword [ebp - 0x1c], 0xb22c1e39
mov dword [ebp - 0x18], 0x30b7cafc
sub dword [ebp - 0x18], 0x30b7cafc
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x5450b03c
sub eax, 0x540fdff0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39112
push 0
call eax
mov ecx, 0x8a6fb4c2
sub ecx, 0x8a6f6e92
xor edx, edx
add edx, eax
mov ebx, 0x9e6e102f
add ebx, 0x61d39fd1
add ebx, dword [ebp - 0x14]
mov esi, 0x6bb9d57b
sub esi, 0x101dfffb
sub dword [ebp - 0x10], edi
mov edi, dword [ebx]
xor dword [ebp - 4], esi
add edi, esi
sub dword [ebp - 4], 0xe05417b9
mov dword [edx], edi
add dword [ebp - 8], 0xb11b7475
add edx, 0xbc9adfba
sub edx, 0xbc9adfb6
add ebx, 0xea69605
add ebx, 0xf15969ff
loop 0x40beec
add eax, 0x10b93
mov ebx, eax
add eax, 5
mov ecx, 0x19e1296f
invalid
invalid
xchg ecx, eax

Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8
Function at 0x59040f6e
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop esi
ret 0xc

Function at 0x59040f9a
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x59040fa5
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x59047054
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047067
mov eax, 0x80004003
jmp 0x590470ee
push 5
push 0x6c
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047093
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x5904709a
mov eax, 0x8000ffff
jmp 0x590470ee
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x590472a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590472bc
mov eax, 0x80004003
jmp 0x59047343
push 5
push 0x6d
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x590472e8
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x590472ef
mov eax, 0x8000ffff
jmp 0x59047343
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x590474b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590474c9
mov eax, 0x80004003
jmp 0x59047550
push 5
push 0x6b
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x590474f5
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x590474fc
mov eax, 0x8000ffff
jmp 0x59047550
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x590476c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590476d6
mov eax, 0x80004003
jmp 0x5904775d
push 5
push 0x6e
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047702
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047709
mov eax, 0x8000ffff
jmp 0x5904775d
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x590478d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590478e3
mov eax, 0x80004003
jmp 0x5904796a
push 5
push 0x6f
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x5904790f
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047916
mov eax, 0x8000ffff
jmp 0x5904796a
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x59047add
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047af0
mov eax, 0x80004003
jmp 0x59047b77
push 5
push 0x69
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047b1c
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047b23
mov eax, 0x8000ffff
jmp 0x59047b77
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x59047cea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047cfd
mov eax, 0x80004003
jmp 0x59047d84
push 5
push 0x70
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047d29
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047d30
mov eax, 0x8000ffff
jmp 0x59047d84
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x59047ef7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047f0a
mov eax, 0x80004003
jmp 0x59047f91
push 5
push 0x71
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047f36
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047f3d
mov eax, 0x8000ffff
jmp 0x59047f91
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x59048104
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59048117
mov eax, 0x80004003
jmp 0x5904819e
push 5
push 0x72
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59048143
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x5904814a
mov eax, 0x8000ffff
jmp 0x5904819e
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x59048311
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59048324
mov eax, 0x80004003
jmp 0x590483ab
push 5
push 0x6a
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59048350
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59048357
mov eax, 0x8000ffff
jmp 0x590483ab
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.590a5e2d
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x5905b0de
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
push ebx
push dword [esp + 0x10]
call dword [sym.imp.vsansi.dll_GetWindowTextW]
test eax, eax
jle 0x5905b141
mov ax, word [ebx]
test ax, ax
je 0x5905b137
cmp ax, 0x22
jne 0x5905b137
push esi
push edi
lea esi, [ebx + 2]
push esi
call dword [sym.imp.MSVCR70.dll_wcslen]
cmp word [esi + eax*2 - 2], 0x22
pop ecx
jne 0x5905b120
and word [esi + eax*2 - 2], 0
dec eax
lea edi, [eax + eax]
push edi
push esi
push ebx
call dword [sym.imp.MSVCR70.dll_memmove]
add esp, 0xc
and word [edi + esi - 2], 0
pop edi
pop esi
mov ecx, dword [esp + 0x14]
push ebx
call fcn.5901940d
pop ebx
ret 0x10
Function at 0x5905b145
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa4
push esi
push edi
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_IsWindowUnicode]
push dword [ebp + 0x78]
mov dword [ebp + 0x68], eax
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.vsansi.dll_SendMessageW]
push 0
push 0
mov edi, eax
push 0x147
push edi
call esi
cmp eax, 0xffffffff
je 0x5905b1ce
lea ecx, [ebp - 0x38]
push ecx
push eax
push 0x148
push edi
call esi
cmp eax, 0xffffffff
je 0x5905b1f2
cmp word [ebp - 0x38], 0x28
je 0x5905b1f2
cmp dword [ebp + 0x68], 0
lea eax, [ebp - 0x38]
push eax
jne 0x5905b1ea
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.590aa0d0
mov eax, esp
push 0
push esi
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.59031a43
jmp 0x5905b1e9
push edi
call dword [sym.imp.vsansi.dll_GetWindowTextLengthW]
test eax, eax
jle 0x5905b1f2
push 0x50
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.vsansi.dll_GetWindowTextW]
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x7c]
call fcn.5901940d
lea esp, [ebp - 0x40]
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc

Function at 0x5905b4c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0xca
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x402
push dword [esi + 0x2c]
mov edi, eax
push edi
call dword [sym.imp.vsansi.dll_GetWindowTextW]
push 0x5900a014
push dword [esi + 0x2c]
mov ebp, eax
call dword [sym.imp.MSVCR70.dll_wcscspn]
push dword [esi + 0x2c]
mov ebx, eax
call dword [sym.imp.MSVCR70.dll_wcslen]
add esp, 0xc
cmp ebx, eax
jne 0x5905b52f
test ebp, ebp
jle 0x5905b51e
push dword [esi + 0x2c]
lea ecx, [esi + 0x28]
call fcn.5901940d
movzx eax, word [esp + 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x5905b54a
push 0x406
push 0x4d4
push 0x30
push dword [esi + 4]
call fcn.590a5e2d
push edi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x590a5e2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x590a5e3c
pop dword [ebp - 0x50]
mov eax, 0x590a5e3c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd179e17e
sub dword [ebp - 0x60], 0x83279c33
mov dword [ebp - 0x5c], 0x3a648893
sub dword [ebp - 0x5c], 0x8313c4e
mov dword [ebp - 0x58], 0xec385103
add dword [ebp - 0x58], 0x6013f32b
mov dword [ebp - 0x54], 0xa6524f95
sub dword [ebp - 0x54], 0xa6524f95
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xebea924c
add dword [ebp - 0x60], 0x8887d70a
mov dword [ebp - 0x5c], 0xfd519592
add dword [ebp - 0x5c], 0x441acbe3
mov dword [ebp - 0x58], 0x8cfafe11
add dword [ebp - 0x58], 0xd6746e5b
mov dword [ebp - 0x54], 0x75c6bb4b
sub dword [ebp - 0x54], 0x75c6bb4b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xf44d3d75
add eax, 0x64b2d3b3
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x45279
push 0
call eax
mov ecx, 0x50153f13
sub ecx, 0x5014fbeb
xor edx, edx
add edx, eax
mov esi, 0xe8fbb4f2
add esi, 0x70123b0e
add esi, dword [ebp - 0x50]
mov ebx, 0x8ea66b44
sub dword [ebp - 0x38], esi
mov edi, dword [esi]
sub dword [ebp - 0x34], 0xc09696ff
xor edi, ebx
sub dword [ebp - 0x2c], eax
mov dword [edx], edi
mov dword [ebp - 0x44], 0xabcc751e
add edx, 4
add esi, 4
loop 0x590a5f50
add eax, 0xbf8d4b3b
add eax, 0x4073b438
mov ebx, eax
add eax, 0xe13ae1f4
add eax, 0x1ec51e11
mov ecx, 0x6ef35d57
add ecx, 0xea0ca2a9
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x590aa293
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.590aa27c
and byte [esi + 0xc], 0
mov eax, 0x59000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x590aa2ed
cmp dword [ebp - 0x18], 5
jb 0x590aa305
jmp 0x590aa301
cmp dword [ebp - 0xc], 1
jne 0x590aa305
cmp dword [ebp - 0x18], 4
ja 0x590aa301
jne 0x590aa305
cmp dword [ebp - 0x14], 0
jbe 0x590aa305
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x590ad0d0
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret