joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad6a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
cmp eax, 0x8876017c
jne 0x5ad709
mov ecx, dword [0x75b974]
push 1
call fcn.005c4b90
mov eax, dword [0x75b93c]
cmp dword [eax + 0x184], 0
mov esi, dword [esi + 8]
mov edi, esi
je 0x5ad6df
push 6
push esi
xor edi, edi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.005ac690
push 0x1010
push str.Error
push str.Out_of_video_memory_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x6dba14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
ret 4
cmp eax, 0x8007000e
jne 0x5ad7b4
mov eax, dword [esi + 0x1025ec]
push 1
mov dword [esi + 0x1025ec], 0
push 1
mov dword [esi + 0x1025f0], 0
push eax
mov dword [esi + 0x1025f4], 0
call fcn.005ab990
add esp, 0xc
push 0
mov ecx, esi
call fcn.005abb10
mov eax, dword [esi + 0x480]
test eax, eax
je 0x5ad76c
push 1
push eax
mov ecx, esi
call fcn.005becb0
mov eax, dword [esi + 0x480]
test eax, eax
jne 0x5ad758
mov edx, dword [0x75b93c]
cmp dword [edx + 0x184], 0
mov esi, dword [esi + 8]
mov edi, esi
je 0x5ad790
push 6
push esi
xor edi, edi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.005ac690
push 0x1010
push str.Error
push str.Out_of_system_memory_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x6dba14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
ret 4

Function at 0x5ae150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5fd458
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5ae21d
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, bind
test ebx, ebx
js 0x5ae19e
shr eax, 1
test ebx, eax
je 0x5ae198
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005b33c0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esp + 0x10]
cmp ecx, ebp
jbe 0x5ae1d3
mov eax, edi
sub edx, edi
jmp 0x5ae1c0
cmp eax, ebp
je 0x5ae1cb
mov ebp, dword [edx + eax]
mov dword [eax], ebp
xor ebp, ebp
add eax, 4
sub ecx, 1
jne 0x5ae1c0
mov eax, dword [esi + 4]
lea eax, [edi + eax*4]
cmp eax, ebp
je 0x5ae1e5
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.005ab990
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov edx, dword [esi]
lea ecx, [edx + eax*4]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x5ae232
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5b7c70
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5fd01b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x763d4c
lea ecx, [esp + 0x18]
call fcn.005ac890
mov edi, dword [esp + 0x130]
cmp byte [edi], 0
mov dword [esp + 0x128], 0
je 0x5b7ce3
cmp byte [edi + 0x104], 0
je 0x5b7ce3
cmp byte [edi + 0x105], 0xff
je 0x5b7ce3
or eax, 0xffffffff
cmp dword [edi + 0x106], eax
je 0x5b7ce3
cmp dword [edi + 0x10a], eax
je 0x5b7ce3
cmp dword [edi + 0x10e], eax
jne 0x5b7cfc
push 0
push 0x1b8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.fe.IsValid__
call fcn.005a9e00
add esp, 0x10
mov ebx, dword [esp + 0x138]
cmp dword [edi + 0x10e], ebx
je 0x5b7d24
push 0
push 0x1b9
push str..SourceFileSystem_r3dFileSystem.cpp
push str.fe.csize__csize
call fcn.005a9e00
add esp, 0x10
movzx eax, byte [edi + 0x105]
mov esi, dword [ebp + eax*4 + 0x340]
cmp esi, 0xffffffff
jne 0x5b7da7
inc eax
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.005b7960
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b7d99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x20]
push edx
push str.cant_open__s_for_writing___d_n
call fcn.005a9cc0
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], esi
call fcn.005ab8b0
xor al, al
jmp 0x5b7e55
movzx eax, byte [edi + 0x105]
mov dword [ebp + eax*4 + 0x340], esi
mov ecx, dword [edi + 0x106]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 0x106]
je 0x5b7dd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFilePointer_failed__d
call fcn.005a9cc0
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0x64667261
call ebp
test eax, eax
jne 0x5b7e14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_failed__d
call fcn.005a9cc0
add esp, 8
mov edx, dword [esp + 0x134]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
push esi
call ebp
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x5b7e3f
push ebx
push eax
push edi
push str.failed_to_write__s__d_vs__d_n
call fcn.005a9cc0
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], 0xffffffff
call fcn.005ab8b0
mov al, 1
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 0xc
Function at 0x5b82e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0x10e]
add esi, 4
lea eax, [esi + 1]
push 1
push eax
mov ebp, ecx
call fcn.005aba10
movzx ecx, byte [edi + 0x105]
mov ebx, dword [ebp + ecx*4 + 0x340]
add esp, 8
mov dword [esp + 0x1c], eax
cmp ebx, 0xffffffff
jne 0x5b8334
push 0
push 0x31e
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005a9e00
add esp, 0x10
mov edx, dword [edi + 0x106]
push 0
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], esi
je 0x5b8392
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_read_failed__d_n
call fcn.005a9af0
mov edx, dword [esp + 0x24]
push edx
call fcn.005aba30
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
mov al, byte [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx edx, al
mov byte [edi + 0x105], al
mov dword [edi + 0x106], ecx
mov ebx, dword [ebp + edx*4 + 0x340]
cmp ebx, 0xffffffff
jne 0x5b83ce
push 0
push 0x32f
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005a9e00
add esp, 0x10
mov eax, dword [edi + 0x106]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], esi
je 0x5b8428
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_write_failed__d_n
call fcn.005a9af0
push edi
call fcn.005aba30
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
push edi
call fcn.005aba30
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x5b8500
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5fd078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x763d4c
lea ecx, [esp + 0x2c]
call fcn.005ac890
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
xor ebp, ebp
sar eax, 2
mov dword [esp + 0x4c], ebp
test eax, eax
ja 0x5b8557
push ebp
push 0xf8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.IsValid__
call fcn.005a9e00
add esp, 0x10
cmp dword [esp + 0x54], ebp
jne 0x5b8575
push ebp
push 0xf9
push str..SourceFileSystem_r3dFileSystem.cpp
push 0x681298
call fcn.005a9e00
add esp, 0x10
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
push 1
sar esi, 2
imul esi, esi, 0x128
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x34], 0x6c667261
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], esi
call fcn.005aba10
mov edx, dword [ebx + 0x14]
sub edx, dword [ebx + 0x10]
add esp, 8
sar edx, 2
mov edi, eax
mov dword [esp + 0x24], edi
test edx, edx
jbe 0x5b8601
mov dword [esp + 0x14], edi
lea ecx, [ecx]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
sar eax, 2
cmp ebp, eax
jb 0x5b85d2
call fcn.005d0c36
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + ebp*4]
mov edi, dword [esp + 0x14]
add dword [esp + 0x14], 0x128
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
inc ebp
sar eax, 2
cmp ebp, eax
jb 0x5b85c0
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x13]
call fcn.005aa6a0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push edi
lea ecx, [esp + 0x23]
call fcn.005aa4b0
test eax, eax
jne 0x5b8630
push str.failed_to_compres_file_list_n
call fcn.005a9cc0
add esp, 4
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
sar eax, 2
push esi
push edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], edx
call fcn.005aa480
mov esi, dword [esp + 0x5c]
push esi
push 8
mov dword [esp + 0x50], eax
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.005d106e
push esi
push 0x10
lea ecx, [esp + 0x54]
push 1
push ecx
call fcn.005d106e
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push esi
push 1
push edx
push eax
call fcn.005d106e
push edi
call fcn.005aba30
mov ecx, dword [esp + 0x58]
push ecx
call fcn.005aba30
add esp, 0x40
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0xffffffff
call fcn.005ab8b0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x5b8860
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5fd09b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
push 0x763d4c
lea ecx, [esp + 0xc]
call fcn.005ac890
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.005b8010
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x6a7ba4
push eax
call fcn.00401aa0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x6a5d9c
push edx
call fcn.005d0600
mov esi, eax
add esp, 8
test esi, esi
jne 0x5b8923
mov eax, dword [esp + 0xc]
push eax
call fcn.005aba30
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.005a9af0
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.005ab8b0
xor al, al
jmp 0x5b895a
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push edx
push 1
push edi
call fcn.005d106e
push esi
call fcn.005cfec0
push edi
call fcn.005aba30
add esp, 0x18
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.005ab8b0
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x5bad10
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5fd1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
push 0x763d4c
lea ecx, [esp + 0xc]
call fcn.005ac890
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.005b7960
lea ecx, [esp + 0xc]
push 0x67ec5c
push ecx
call fcn.005d0600
mov esi, eax
add esp, 8
test esi, esi
jne 0x5badad
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.005a9af0
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.005ab8b0
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.005d53e7
push esi
call fcn.005d5621
push 0
push 0
push esi
mov edi, eax
call fcn.005d53e7
lea eax, [edi + 1]
push 1
push eax
call fcn.005aba10
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.005d5997
push esi
call fcn.005cfec0
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.005baa10
push ebp
mov bl, al
call fcn.005aba30
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.005ab8b0
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x5c32e0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c3301
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x224
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x5c335b
jmp 0x5c3320
lea ecx, [esp + 0x28]
push str..exe
push ecx
call fcn.005c4a40
add esp, 8
test eax, eax
jne 0x5c3357
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x5c3320
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5c5220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5fd458
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5c52f3
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, bind
test ebx, ebx
js 0x5c526e
shr eax, 1
test ebx, eax
je 0x5c5268
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005c5100
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.005c50c0
mov eax, dword [esi + 4]
lea edx, [eax + eax*2]
lea eax, [edi + edx*8]
add esp, 0xc
cmp eax, ebp
je 0x5c52bb
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.005ab990
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esi]
lea edx, [eax + eax*2]
lea ecx, [ecx + edx*8]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x5c5323
mov eax, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
movq xmm0, qword [eax + 8]
movq qword [ecx + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5ca4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x5ca514
mov cl, byte [edx]
test cl, cl
je 0x5ca514
mov eax, 0x811c9dc5
movsx ecx, cl
or ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x5ca4f3
xor eax, 0x2a
imul eax, eax, 0x1000193
ret
xor eax, eax
ret
Function at 0x5cfa37
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d4dfc]
jne 0x5cfa41
repz ret
jmp fcn.005d8fc1

Function at 0x5cfc5e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5cfc8f
call fcn.005d6b2e
mov dword [eax], esi
call fcn.005d6b1b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005d0c10
add esp, 0x14
push 0x16
pop eax
jmp 0x5cfce4
test dword [ebp + 0xc], 0xfffffff9
jne 0x5cfc6b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5cfcbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005d6b41
pop ecx
call fcn.005d6b1b
mov eax, dword [eax]
jmp 0x5cfce4
test al, 0x10
jne 0x5cfce2
test al, 1
je 0x5cfce2
test byte [ebp + 0xc], 2
je 0x5cfce2
call fcn.005d6b2e
mov dword [eax], 5
call fcn.005d6b1b
mov dword [eax], 0xd
jmp 0x5cfcb3
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5e3ef6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005d9139
and dword [ebp - 4], 0
cmp dword [0x77f93c], 0
mov ebx, eax
jne 0x5e3fa7
push 0x695578
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5e4058
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x69556c
push edi
call esi
test eax, eax
je 0x5e4058
push eax
call fcn.005d90c7
mov dword [esp], 0x69555c
push edi
mov dword [0x77f93c], eax
call esi
push eax
call fcn.005d90c7
mov dword [esp], 0x695548
push edi
mov dword [0x77f940], eax
call esi
push eax
call fcn.005d90c7
mov dword [esp], 0x69552c
push edi
mov dword [0x77f944], eax
call esi
push eax
call fcn.005d90c7
pop ecx
mov dword [0x77f94c], eax
test eax, eax
je 0x5e3fa7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005d90c7
pop ecx
mov dword [0x77f948], eax
mov eax, dword [0x77f948]
cmp eax, ebx
je 0x5e3fff
cmp dword [0x77f94c], ebx
je 0x5e3fff
push eax
call fcn.005d9142
push dword [0x77f94c]
mov esi, eax
call fcn.005d9142
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5e3fff
test edi, edi
je 0x5e3fff
call esi
test eax, eax
je 0x5e3ff6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5e3ff6
test byte [ebp - 0xc], 1
jne 0x5e3fff
or dword [ebp + 0x10], 0x200000
jmp 0x5e4038
mov eax, dword [0x77f940]
cmp eax, ebx
je 0x5e4038
push eax
call fcn.005d9142
pop ecx
test eax, eax
je 0x5e4038
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5e4038
mov eax, dword [0x77f944]
cmp eax, ebx
je 0x5e4038
push eax
call fcn.005d9142
pop ecx
test eax, eax
je 0x5e4038
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x77f93c]
call fcn.005d9142
pop ecx
test eax, eax
je 0x5e4058
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5e405a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5ee1e0
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5ee25b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005ecfc2
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5ee217
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5ee22e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005ecfc2
add esp, 4
test eax, eax
jbe 0x5ee25b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005ecfc2
add esp, 4
cmp esi, eax
jb 0x5ee240
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x11227426
Capabilities:
Encode data using xor

Disassembly:
cli
invalid
push ss
jns 0x112253f2
jo 0x112253c5
inc edx
sbb dword [0xee08aa3], esi
je 0x11225381
adc dword [0x3be9d17b], esi
ja 0x11225397
xchg ebp, eax
inc ecx
mov ah, 0x96
xchg esi, eax
mov dh, 0x24
invalid
pop ss
push ebx
pop ss
loopne 0x1122537d
invalid
shl dword [ecx], 1
xchg edx, eax
dec eax
movsb byte es:[edi], byte [esi]
clc
push 0x1825ea64
not al
mov word [esp], ax
cmc
call fcn.124708e1
sbb byte [ebp - 0x1763fedc], dh
jne 0x112253aa
pushfd
call fcn.12483144
insb byte es:[edi], dx
dec edx
aam 0x90
and eax, 0xd44a6c01
nop
or ch, byte [edx]
sub eax, dword [esi + eax*4]
or byte [edx + esi*8], cl
push edx
jo 0x112253b2
out 0x3e, al
dec eax
fst st(5)
outsd dx, dword [esi]
dec ebx
fldl2t
js 0x1122537f
scasb al, byte es:[edi]
xor al, 0
inc byte [ebx - 0x2de7a41]
xor ah, byte [esi + 0x55]
invalid
pushfd
lea esp, [esp + 8]
jb 0x11297c18
test bh, cl
cmc
cmp byte [edi - 1], 0
jmp 0x112253c9

Function at 0x124706bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ch, dl
cmp ecx, 0xffff
pushfd
pushal
lea esp, [esp + 0x24]
jbe 0x12483dd0
btr di, 9
bsf di, di
stc
cmc
mov edi, dword [edx + 0x24]
clc
add edi, eax
or cx, 0xb1db
xadd ebx, ecx
mov ebx, dword [edx + 0x20]
ror cx, cl
cmp bh, bh
add ebx, eax
neg ch
stc
xor cx, si
mov dword [ebp - 8], 0
shl cx, 0xa
sal cx, cl
bsf ecx, ecx
shl cl, cl
mov ecx, dword [edx + 0x18]
call fcn.12476fdf
call 0x11225e0d
lea esp, [esp + 8]
je 0x11228ddc
test ah, 0xe3
mov si, 0x95e
bsr esi, eax
btr dx, ax
mov esi, dword [eax + 0x3c]
movsx dx, bl
add dx, 0xf8bb
shr dh, 3
add esi, eax
or dh, cl
rcl dx, cl
mov edx, dword [esi + 0x78]
test di, sp
test edx, edx
ja 0x11227b7a
pushal
lea esp, [esp + 0x20]
je 0x11228ddc
mov cl, ah
cmc
push 0x4439cb57
xor cl, 0xcf
add edx, eax
sbb cl, bl
movzx cx, dl
pushal
mov ecx, dword [esi + 0x7c]
cmp ch, 0xaf
add ecx, edx
jmp 0x12483281
jbe 0x12487a4b
pushal
jmp 0x12482c25
mov dword [esp + 8], ecx
push dword [esp + 0x10]
push ebp
lea esp, [esp + 0x28]
jbe 0x12483dd0
and ch, bh
bsf cx, bx
mov edi, dword [edx + 0x24]
xor cx, 0x3283
stc
adc bl, dl
add edi, eax
ror ecx, cl
xchg ecx, ebx
mov ebx, dword [edx + 0x20]
cmc
bswap ecx
add ebx, eax
cmp dh, bl
mov dword [ebp - 8], 0
setp ch
mov ecx, dword [edx + 0x18]
jmp 0x1122735d
cmp ecx, 0xffff
jmp 0x124739b8
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x138884e9]
mov ecx, dword [ebp + 0xc]
sub esp, 0xffffffdc
ja 0x12470c9f
push eax
pushal
test al, al
cmp ecx, 0xffff
call fcn.124713b2
call fcn.124762ca
jmp 0x11227a64

Function at 0x12471696
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, 0x2e
cmc
pushal
pushfd
repne scasb al, byte es:[edi]
push dword [esp]
call fcn.124832ca
push dword [edi]
pop dword [esp + 4]
pushal
push dword [esp + 0xc]
cmp edi, ebx
pushfd
lea esp, [esp + 0x2c]
ja 0x12486e84
adc al, 0x2e
seta al
sar al, cl
sub ebx, edi
or al, 0xd3
bswap edi
shld di, ax, cl
bswap di
add ebx, esp
btr di, 5
rol edi, cl
movsx edi, bl
mov edi, ebx
ror al, cl
cmp dh, bh
jmp 0x11225829
Function at 0x12472a78
Capabilities:
Encode data using xor

Disassembly:
push ebx
jmp 0x12486e89
call fcn.1129661c
lodsd eax, dword [esi]
and eax, 0x5024bd4b
sub al, 8
insb byte es:[edi], dx
or byte [esi + 0x6c], ah
mov eax, 0xa08436ee
neg ebx
cmpsb byte [esi], byte es:[edi]
test al, 0x7c
adc ah, byte [edx]
mov esp, 0xfe60c955
aad 0x2d
arpl word [ecx + 0x5961fbdd], di
xchg esi, eax
push ebp
xor esi, dword [ebx + 0x213e9a20]
xor al, 0x1f
inc ebp
stosb byte es:[edi], al
add dword [ebp - 0x7c5dbfbd], eax
add esp, dword [ecx]
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
jnp 0x12486e95
int3

Function at 0x12486b6f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0xb35fcb34
lea esp, [esp + 0x34]
ja 0x12474450
not si
pushfd
xchg bx, si
mov esi, dword [esp + 4]
pop edi
jmp 0x12476de4
jmp 0x11226084