joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce70
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b4798
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x46ceb1
push 0
push 0x128
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0046c150
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.0046cb00
add esp, 8
lea edx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea ecx, [edi + 0x1c]
cmovae edx, dword [ebp - 0x24]
cmp dword [ecx + 0x14], 8
jb 0x46ceed
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
and eax, 1
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46cf1a
lea ecx, [ebp - 0x24]
call fcn.00418100
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.0046d0f0
int3

Function at 0x46d060
Capabilities:
Check for software breakpoints
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x46d07f
push 0
push 0x5e
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0046c150
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46d08a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d0b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x46d0ab.4
movzx eax, byte [eax + 0x46d0cc]
jmp dword [eax*4 + 0x46d0c4]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.0046d0f0
nop
mov dl, 0xd0
inc esi
add byte [edx + 0x46d0], bh
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
invalid

Function at 0x46d0f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b47f8
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x46d450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x46d472
push 0
push 0x9f
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0046c150
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46d47d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46d490
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.0046d0f0
int3
Function at 0x46d7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057cb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x46d7ec
push 1
mov dword [ebp - 4], 0
call fcn.0057a351
add esp, 4
mov dword [edi + 4], eax
jmp 0x46d7ee
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp + 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, 0x48
mov dword [esi + 0x40], edx
and edx, 1
mov dword [esi], vtable.Poco::Base64EncoderBuf.0
cmovne eax, ecx
mov dword [esi + 0x48], 0
mov ecx, dword [ebp + 8]
test edx, edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov dword [esi + 0x54], eax
mov eax, 0x5b9750
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4778e0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x4778f0
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
push 0x288
mov dword [esp + 0xc], 0x288
mov dword [edi], eax
mov word [edi + 4], ax
call fcn.0057ce9e
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x47793d
push esi
call fcn.0057cb5b
push dword [esp + 0xc]
call fcn.0057ce9e
add esp, 8
mov esi, eax
jmp 0x477941
test eax, eax
jne 0x47799a
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x477991
xor dl, dl
mov eax, esi
test esi, esi
je 0x477991
nop dword [eax]
test dl, dl
jne 0x477991
cmp dword [eax + 0x1a0], 6
jne 0x47798b
cmp dword [eax + 0x190], 6
jne 0x47798b
mov ecx, dword [eax + 0x194]
mov dl, 1
mov dword [edi], ecx
mov cx, word [eax + 0x198]
mov word [edi + 4], cx
mov eax, dword [eax]
test eax, eax
jne 0x477960
push esi
call fcn.0057cb5b
add esp, 4
pop edi
pop esi
pop ecx
ret
Function at 0x4779a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057cb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x4779ec
push 1
mov dword [ebp - 4], 0
call fcn.0057a351
add esp, 4
mov dword [edi + 4], eax
jmp 0x4779ee
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
push 0x100
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0057ce9e
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::RandomBuf.0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x478c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4d34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00477570
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::Crypto::CipherKeyImpl.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00409d70
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ebx, [esi + 0x34]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.00478820
mov byte [ebp - 4], 4
call fcn.00478b90
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x478caa
mov eax, dword [edi]
push eax
call fcn.004be100
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x478d9e
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x14], 0x10
jb 0x478cc9
mov eax, dword [eax]
push eax
call fcn.004be130
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x478de0
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00479070
push eax
lea ecx, [ebp - 0x1c]
call fcn.0044a530
mov edi, eax
lea ecx, [esi + 0x28]
cmp ecx, edi
je 0x478d24
call fcn.00430c10
mov ecx, dword [edi]
mov dword [esi + 0x28], ecx
mov eax, dword [edi + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00430c10
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00479060
push eax
lea ecx, [ebp - 0x1c]
call fcn.0044a530
mov edi, eax
cmp ebx, edi
je 0x478d71
mov ecx, ebx
call fcn.00430c10
mov ecx, dword [edi]
mov dword [ebx], ecx
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00430c10
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00478f40
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
push edi
lea eax, [ebp - 0x28]
push str.Cipher
push eax
call fcn.0040ee20
push str._was_not_found
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.0044a840
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.00464490
push 0x65d930
lea eax, [ebp - 0x6c]
push eax
call fcn.0057f277
push edi
lea eax, [ebp - 0x40]
push str.Digest
push eax
call fcn.0040ee20
push str._was_not_found
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.0044a840
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.00464490
push 0x65d930
lea eax, [ebp - 0x6c]
push eax
call fcn.0057f277
int3
Function at 0x47a240
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057cb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x47a28c
push 1
mov dword [ebp - 4], 0
call fcn.0057a351
add esp, 4
mov dword [edi + 4], eax
jmp 0x47a28e
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call fcn.0057ce9e
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cdf90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057d8f0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4ce010
mov cl, byte [edi]
test cl, cl
je 0x4ce010
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4cdfc0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4ce120
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057d8f0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x4ce1a5
mov al, byte [ebx]
test al, al
je 0x4ce1a5
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.004f8f30
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or eax, esi
xor eax, edi
mov esi, eax
mov al, byte [ebx]
mov dword [esp + 0x10], esi
test al, al
jne 0x4ce147
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4dc7b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4dc7d7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4dc7c6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x59f5a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059f24a

Function at 0x59f5ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059f3d4

Function at 0x5ac7b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057cb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x5ac7fc
push 1
mov dword [ebp - 4], 0
call fcn.0057a351
add esp, 4
mov dword [edi + 4], eax
jmp 0x5ac7fe
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryEncoderBuf.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0x48
mov dword [esi + 0x48], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5acd50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057cb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x5acd9c
push 1
mov dword [ebp - 4], 0
call fcn.0057a351
add esp, 4
mov dword [edi + 4], eax
jmp 0x5acd9e
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryDecoderBuf.0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x513040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbc000]
push edi
jmp 0x51305a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x513061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x513050
mov eax, 1
add ebx, ebx
jne 0x513073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x513084
jne 0x5130a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5130a3
dec eax
add ebx, ebx
jne 0x513090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x513068
add ebx, ebx
jne 0x51309f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5130f5
xor ecx, ecx
sub eax, 3
jb 0x5130bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51312a
sar eax, 1
mov ebp, eax
jmp 0x5130c6
add ebx, ebx
jne 0x5130c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x513094
inc ecx
add ebx, ebx
jne 0x5130d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x513094
add ebx, ebx
jne 0x5130e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5130d6
jne 0x5130f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5130d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x513114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x513106
jmp 0x513056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x513114
add edi, ecx
jmp 0x513056
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x513132
cmp byte [edi], 0x11
jne 0x513132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x513137
lea edi, [esi + 0x10c000]
mov eax, dword [edi]
or eax, eax
je 0x5131af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14d1d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14d350]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x513164
mov ecx, edi
jns 0x513193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14d354]
or eax, eax
je 0x5131a9
mov dword [ebx], eax
add ebx, 4
jmp 0x513181
call dword [esi + 0x14d364]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5131e0
cmp al, 0xef
ja 0x5131d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5131b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5131c2
mov ebp, dword [esi + 0x14d358]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x513214
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x929370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x92938e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x952074
push ecx
mov edi, eax
call fcn.0093d198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9293cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0093d02e
push esi
call fcn.0093cfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret