joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56bfcd
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x56c03f
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, ebp
and ecx, dword [esp + 0x14]
push esi
push edi
push dword [ebx]
cmp ecx, 0xffffffff
cmove ebp, eax
call fcn.0056b78e
push ebp
push dword [ebx]
mov edi, eax
call fcn.0056b767
add esp, 0xc
mov esi, eax
push 0
push ebp
push 0x130c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebx]
call fcn.0056c05f
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x5710c6
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
leave
ret 4

Function at 0x571109
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x571185
cmp dword [0x7e9298], 1
je 0x571185
push ebx
mov ebx, 0x7e92a0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [0x7e92bc]
and dword [0x7e92c4], 0
mov dword [0x7e92c0], esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x7e92b8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [0x7e92bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x57117d
push 0
push dword [0x7e929c]
mov dword [0x7e9298], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop esi
ret 4
Function at 0x571451
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x7e8dc0], 0
jne 0x571522
push ebx
push ebp
push esi
xor ebp, ebp
inc ebp
push 0x7ea800
mov dword [0x7e8dc0], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x640
push eax
push 8
push dword [0x7e42f8]
mov dword [0x7e9284], eax
mov dword [0x7e8dc4], 0x1f4
call esi
mov dword [0x7e9294], eax
mov eax, dword [0x7e8dc4]
add eax, eax
push eax
push 8
push dword [0x7e42f8]
call esi
xor ebx, ebx
mov dword [0x7e9290], eax
push 0x7e92a0
mov dword [0x7e9288], ebx
mov dword [0x7e928c], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebp
push ebx
call esi
push ebx
push ebx
push ebp
push ebx
mov dword [0x7e92b8], eax
call esi
mov dword [0x7e92bc], eax
cmp dword [0x7e92b8], ebx
je 0x571519
test eax, eax
je 0x571519
lea eax, [esp + 0xc]
mov dword [0x7e9298], ebx
push eax
push ebx
push ebx
push 0x570eaf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x7e929c], eax
jmp 0x57151f
mov dword [0x7e9298], ebp
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x571524
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5715c9
cmp dword [esp + 0xc], 0
je 0x5715c9
cmp dword [0x7e9298], 1
je 0x5715c9
push edi
push 0x1f
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5715c8
push ebp
mov ebp, 0x7e92a0
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [0x7e92bc]
mov dword [0x7e92c0], esi
mov dword [0x7e92c4], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x7e92b8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [0x7e92bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x5715c0
push 0
push dword [0x7e929c]
mov dword [0x7e9298], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop edi
pop esi
ret 8
Function at 0x571be3
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x571d2b
xor ecx, ecx
cmp word [eax], cx
je 0x571d2b
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0067fc5b
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.005236eb
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x571c3c
cmp eax, 3
jne 0x571c76
cmp word [esp + 0xa], 0x3a
jne 0x571c76
cmp eax, 2
jne 0x571c5a
lea eax, [esp + 8]
push 0x69a0b0
push eax
call fcn.0067fc2a
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x571d2b
push 0xfffffffffffffffe
pop edi
jmp 0x571d2b
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x571c8b
cmp ax, bx
jne 0x571c95
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x571c7e
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x571cd4
test byte [esp + 0x21c], 0x10
je 0x571cbb
push 0xfffffffffffffffe
pop edi
jmp 0x571ccb
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x571d29
cmp word [esp + 0x10], bp
jne 0x571ce2
cmp word [esp + 0x12], bp
je 0x571d01
cmp word [esp + 0x10], bx
jne 0x571cf0
cmp word [esp + 0x12], bx
je 0x571d01
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x571d29
cmp word [esp + 0x12], ax
jne 0x571d29
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x571d16
test al, 0x10
je 0x571d29
jmp 0x571d26
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x571d29
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x571f1c
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x571f45
test byte [esp + 8], 2
je 0x571f39
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x571f47
xor eax, eax
ret 8

Function at 0x571f58
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x571f78
cmp dword [esp + 8], 0
je 0x571f78
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x571f7a
xor eax, eax
ret 8
Function at 0x572101
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x572179
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.0067fc5b
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.005236eb
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x57215a
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x572157
cmp ecx, 0x5c
je 0x572157
cmp ecx, 0x2f
jne 0x572164
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x572144
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x57217b
xor eax, eax
leave
ret 4

Function at 0x572246
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x7e92cc]
push esi
push edi
test eax, eax
jne 0x57226c
push fcn.00572375
push 0x10
push 0x258
call fcn.0058c94c
mov dword [0x7e92cc], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.0058c8cf
mov esi, eax
test esi, esi
je 0x57236d
cmp dword [esp + 0x14], ebx
mov eax, 0x69cd88
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x5722a4
xor ecx, ecx
cmp word [ebp], cx
jne 0x5722ad
mov ebp, 0x6b4e7c
mov dword [esp + 0x1c], ebp
push eax
call fcn.005236eb
push ebp
mov dword [esp + 0x20], eax
call fcn.005236eb
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x57235a
push dword [esp + 0x14]
push ebp
call fcn.0067fc08
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x57230d
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x57230d
push 0x69a0b0
push ebp
call fcn.0067fc2a
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.0067fc2a
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x572332
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x572346
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x572348
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x57236c
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x7e92cc]
call fcn.0058c86e
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc
Function at 0x5725fd
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x572766
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x572749
sub eax, 1
jne 0x572766
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.005725b6
pop ecx
test eax, eax
je 0x572674
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x5726aa
inc edi
jmp 0x5726aa
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x572766
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x572745
sub ecx, 1
je 0x572741
sub ecx, 1
je 0x572723
sub ecx, 1
je 0x5726e7
sub ecx, 4
jne 0x572766
test eax, eax
jne 0x572766
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x572766
sub eax, 0
je 0x572716
sub eax, 1
je 0x572709
sub eax, 1
je 0x572702
sub eax, 1
jne 0x572766
push 0x69
pop esi
push 0x64
jmp 0x57271b
push 0x5a
pop esi
push 0x5f
jmp 0x57270e
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x572766
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x572766
sub eax, 0
je 0x57273d
sub eax, 1
je 0x572739
sub eax, 1
jne 0x572766
push 0x41
pop esi
push 0x3c
jmp 0x57271b
push 0x3c
jmp 0x572765
push 0x32
jmp 0x572765
push 0x14
jmp 0x572765
push 5
jmp 0x572765
mov eax, dword [esp + 0x14]
test eax, eax
je 0x572763
cmp eax, 0xa
je 0x57275f
cmp eax, 0x5a
jne 0x572766
push 0x28
jmp 0x572765
push 0x1e
jmp 0x572765
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x572e88
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x7ea860]
call fcn.0058c8a8
mov esi, eax
test esi, esi
je 0x572f64
cmp dword [ebp + 0xc], 0
je 0x572ed4
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x572ec5
cmp dword [esi + 0x1c], 0
jne 0x572ec5
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x572f64
test byte [ebp + 0x10], 3
push ebx
push 4
pop ebx
je 0x572ef2
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.005743d5
cmp dword [esi + 0x3c], 0xffffffff
je 0x572f16
xor eax, eax
cmp dword [esi + 0x3c], 0x1000000
sete al
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x572f2e
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
mov eax, dword [ebp + 8]
test dword [ebp + 0x10], 0x2000000
je 0x572f49
test eax, eax
je 0x572f3f
push 8
jmp 0x572f4f
push 7
test ecx, ecx
pop eax
cmovne ebx, eax
jmp 0x572f5a
test eax, eax
je 0x572f52
push 3
pop ebx
jmp 0x572f5a
xor ebx, ebx
test ecx, ecx
setne bl
inc ebx
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x573478
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0xc]
xor esi, esi
push dword [0x7ea860]
call fcn.0058c8a8
mov edi, eax
test edi, edi
je 0x57349b
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
push dword [esp + 0x10]
push esi
call fcn.0058d430
test esi, esi
je 0x5734b8
lea ecx, [esi + 1]
push ecx
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x5734bd
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
ret 8

Function at 0x574555
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x5745eb
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x5745e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x5745e8
lea eax, [esi - 1]
push eax
push dword [0x7ea860]
call fcn.0058c8a8
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x5745ea
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x5745d8
mov edx, 0xfa01
cmp word [ecx], dx
je 0x5745e3
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x5745c8
jmp 0x5745e8
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x574691
push eax
call esi
test al, al
jns 0x574691
push 0x11
call esi
test al, al
js 0x574691
push 0x10
call esi
test al, al
js 0x574691
push 0x12
call esi
test al, al
js 0x574691
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x574691
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.005239c3
add esp, 0xc
test eax, eax
je 0x574665
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.005239c3
add esp, 0xc
test eax, eax
jne 0x57467c
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x5746d2
lea eax, [esp + 0x18]
push 0x69fbec
push eax
call fcn.0067fbc8
pop ecx
pop ecx
test eax, eax
je 0x5746d2
test ebp, ebp
je 0x5746b5
push 0x11
call esi
test al, al
js 0x5746ad
push 0x10
call esi
test al, al
js 0x5746ad
push 0x12
call esi
test al, al
jns 0x5746b5
push 1
push ebp
call fcn.005746de
test ebx, ebx
je 0x5746c9
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x5746d2
test edi, edi
je 0x5746d2
mov eax, dword [edi + 8]
jmp 0x5746d4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x577d79
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x577def
cmp dword [esp + 8], esi
push ebx
push ebp
mov ebx, 0x69cd88
cmovne ebx, dword [esp + 0x10]
push edi
push ebx
call fcn.005236eb
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x577de6
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x577de6
push ebp
push ebx
push eax
call fcn.0052d690
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
ret 4

Function at 0x577df5
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
push esi
mov ebx, esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x577e36
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x577e2e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x577e2e
push esi
call fcn.005236eb
pop ecx
mov ebx, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x577e39
mov edi, dword [ebp + 8]
push dword [ebp + 8]
push ebx
call fcn.0058d430
test esi, esi
je 0x577e61
lea ecx, [ebx*2 + 2]
push ecx
push esi
push eax
call fcn.0052d690
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x577e66
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x57835c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x5783b9
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x5783b9
mov eax, dword [esi + 0x70]
test eax, eax
je 0x578398
push ebx
push esi
call eax
push esi
push ebx
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x7ea8c4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x7ea8c0], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x578eae
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x7ea8c4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x7ea8c0], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0057bfd4
mov dword [esi + 0x58], 0x579e94
mov eax, esi
mov dword [esi + 0x5c], 0x579ee0
mov dword [esi + 0x10], fcn.005799cc
mov dword [esi + 0x30], 0x5797a7
mov dword [esi + 0x64], 0x579f75
mov dword [esi + 0x60], 0x579f29
mov dword [esi + 0x34], 0x579272
mov dword [esi + 0x24], 0x579249
mov dword [esi + 0x28], 0x57921e
mov dword [esi + 0x2c], 0x579172
mov dword [esi + 0x44], 0x579c64
mov dword [esi + 0x68], 0x578f6f
mov dword [esi + 0x6c], 0x57a177
pop esi
ret 4
Function at 0x57e477
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul ecx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ecx
test ebx, ebx
je 0x57e545
push ebp
mov ebp, dword [esp + 0x24]
push esi
imul esi, dword [esp + 0x2c], 3
imul eax, dword [esp + 0x24], 3
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov edx, eax
imul edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
add edi, esi
mov esi, dword [eax + 0xcc]
add edi, dword [esp + 0x20]
imul esi, ebp
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x38]
test ecx, ecx
jle 0x57e512
mov ebx, 0xff
mov ebp, ecx
sub ebx, dword [esp + 0x40]
movzx eax, byte [edi]
imul eax, dword [esp + 0x40]
movzx ecx, byte [esi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc edi
mov byte [esi], al
inc esi
sub ebp, 1
jne 0x57e4e5
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
xor esi, esi
dec ebx
or eax, 0xffffffff
inc esi
mov dword [esp + 0x3c], ebx
inc ebp
cmp dword [ecx + 0xe8], 0
mov ecx, dword [esp + 0x10]
cmovne eax, esi
mov dword [esp + 0x2c], ebp
mov esi, dword [esp + 0x14]
add eax, edx
test ebx, ebx
jne 0x57e4ac
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28

Function at 0x57eb56
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x30]
mov ebp, dword [esi + 0xd4]
test edi, edi
je 0x57ebf9
imul ecx, dword [esp + 0x24], 3
mov eax, dword [esp + 0x28]
push ebx
mov ebx, ebp
imul ebx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x1c]
imul edx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
add edx, ecx
mov ecx, dword [esi + 0xcc]
add edx, dword [esp + 0x18]
imul ecx, eax
add ecx, dword [esi + 0xc8]
add ecx, ebx
cmp dword [esp + 0x30], 0
jle 0x57ebd7
mov esi, dword [esp + 0x30]
mov al, byte [edx + 2]
xor byte [ecx + 2], al
mov al, byte [edx + 1]
xor byte [ecx + 1], al
mov al, byte [edx]
lea edx, [edx + 3]
xor byte [ecx], al
add ecx, ebp
sub esi, 1
jne 0x57ebb5
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc eax
xor ecx, ecx
mov dword [esp + 0x24], eax
inc ecx
or eax, 0xffffffff
cmp dword [esi + 0xe8], 0
cmovne eax, ecx
add eax, dword [esp + 0x34]
sub edi, ecx
mov ecx, dword [esp + 0x28]
jne 0x57eb84
pop ebx
pop edi
pop esi
pop ebp
ret 0x24
Function at 0x57f0cb
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x57f2d7
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
imul esi, dword [esp + 0x24], 3
push edi
mov edi, 0xff
shl ebx, 2
mov dword [esp + 0x28], edx
cmp dword [esp + 0x40], edi
jne 0x57f1e7
mov dword [esp + 0x40], ebx
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x24]
imul ebp, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
add ebp, ebx
mov ebx, dword [eax + 0xcc]
add ebp, dword [esp + 0x20]
imul ebx, edx
add ebx, dword [eax + 0xc8]
add ebx, esi
cmp dword [esp + 0x38], 0
jle 0x57f1b0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x57f141
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
dec ecx
or eax, 0xffffffff
mov dword [esp + 0x3c], ecx
inc edx
push 1
cmp dword [esi + 0xe8], 0
mov esi, dword [esp + 0x14]
pop ebx
cmovne eax, ebx
mov dword [esp + 0x28], edx
add eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x40]
test ecx, ecx
jne 0x57f10c
jmp 0x57f2d3
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x24]
imul ebp, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
add ebp, ebx
mov ebx, dword [eax + 0xcc]
add ebp, dword [esp + 0x20]
imul ebx, edx
add ebx, dword [eax + 0xc8]
add ebx, esi
cmp dword [esp + 0x38], 0
jle 0x57f2a1
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
movzx eax, byte [ebp + 3]
mov esi, 0xff
imul eax, dword [esp + 0x40]
movzx ecx, byte [ebx + 2]
cdq
idiv edi
mov edi, eax
movzx eax, byte [ebp + 2]
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
mov edi, 0xff
add eax, ecx
cdq
idiv edi
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x57f228
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
dec ecx
or eax, 0xffffffff
mov dword [esp + 0x3c], ecx
inc edx
push 1
cmp dword [esi + 0xe8], 0
mov esi, dword [esp + 0x18]
pop ebx
cmovne eax, ebx
mov dword [esp + 0x28], edx
add eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x10]
test ecx, ecx
jne 0x57f1ef
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28