joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5004d0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
lea ecx, [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x501cd0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [eax + 8], 0
call fcn.004af144
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
jne 0x50051b
xor esi, esi
inc esi
jmp 0x500536
mov dword [ebp - 0x20], eax
lea ecx, [ebp + 8]
call fcn.004af144
mov ecx, dword [ebp - 0x20]
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
lea ecx, [ebp + 8]
call fcn.004aeec0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x500566
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x88], eax
mov ecx, edi
push 0
call fcn.004aef38
xor ebx, ebx
dec ebx
test al, al
jne 0x500726
push edi
call fcn.004fef10
add esp, 4
test al, al
je 0x500726
mov eax, dword [ebp + 0xc]
cmp al, 2
ja 0x5005c9
movsx eax, al
mov ecx, dword [eax*4 + 0x743870]
mov dword [esp + 0xc], ecx
mov esi, dword [eax*4 + 0x74387c]
jmp 0x5005d4
xor esi, esi
inc esi
mov dword [esp + 0xc], connect
mov ecx, edi
call fcn.004af144
sub esp, 0x1c
movaps xmm0, xmmword [0x743450]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], esi
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
je 0x500652
mov ebx, dword [ebp + 0x14]
cmp byte [ebp + 0x10], 0
je 0x50064b
xor eax, eax
dec eax
lea edi, [esp + 0x80]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [edi]
bt eax, 0x1f
jb 0x50064b
xor ecx, ecx
lea edx, [esp + 0x7c]
push ebx
push ecx
push ecx
push eax
push edx
call fcn.0050073e
add esp, 0x14
mov ebx, esi
jmp 0x500726
movups xmm0, xmmword [0x7a9568]
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
mov ecx, edi
push 0
mov esi, eax
call fcn.004af666
mov byte [esp + 0x20], 2
mov dword [esp + 0x28], eax
mov eax, esi
sar eax, 0x1f
mov byte [esp + 0x10], 0
mov dword [esp + 0x1c], eax
mov edi, esi
mov dword [esp + 0x18], esi
sub esp, 0x78
movaps xmm0, xmmword [esp + 0xd8]
movups xmmword [esp + 0x68], xmm0
movaps xmm0, xmmword [esp + 0xc8]
movups xmmword [esp + 0x58], xmm0
movaps xmm0, xmmword [esp + 0xb8]
movups xmmword [esp + 0x48], xmm0
movaps xmm0, xmmword [esp + 0xa8]
movups xmmword [esp + 0x38], xmm0
movups xmm0, xmmword [esp + 0x98]
movups xmmword [esp + 0x28], xmm0
movups xmm0, xmmword [esp + 0x88]
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.OpenFile_erro___d__filePath___s
mov dword [esp + 0x10], str.FileUtils
mov dword [esp + 0xc], str.openFile
mov dword [esp + 8], 0x20a
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileUtils.cpp
mov dword [esp], 4
call fcn.004ee380
add esp, 0x78
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x500726
mov dword [eax], edi
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x50073e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor eax, eax
dec eax
lea edi, [esp + 0xa0]
mov dword [edi + 4], eax
mov dword [edi], eax
mov eax, dword [esi]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
sub esp, 8
mov edx, dword [edi]
mov ecx, dword [edi + 4]
xor ebx, ebx
mov eax, edx
or eax, ecx
je 0x5008e4
mov eax, edx
not eax
or eax, ecx
je 0x5008e4
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp edx, edi
sbb ecx, eax
jae 0x5007af
xor ebx, ebx
jmp 0x5008e4
mov ecx, dword [ebp + 0x14]
cmp ecx, 2
je 0x5007e8
cmp ecx, 1
jne 0x50081c
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], eax
mov eax, dword [esi]
movsd xmm0, qword [esp + 0x98]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 1
jmp 0x500812
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], eax
mov eax, dword [esi]
movsd xmm0, qword [esp + 0x90]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
jmp 0x500848
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], eax
mov eax, dword [esi]
movsd xmm0, qword [esp + 0x88]
movsd qword [esp + 4], xmm0
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
sub esp, 0x14
mov esi, eax
test eax, eax
jne 0x5008df
mov edi, dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x50086a
mov dword [edi], eax
mov byte [esp + 0x78], 0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], 0
movups xmm0, xmmword [0x7a9568]
movups xmmword [esp + 0x68], xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x28], xmm0
movups xmm0, xmmword [esp + 0x78]
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.seekFile_erro___d
mov dword [esp + 0x10], str.FileUtils
mov dword [esp + 0xc], str.seekFile
mov dword [esp + 8], 0x281
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileUtils.cpp
mov dword [esp], 4
call fcn.004ee380
test esi, esi
setne bl
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x500900
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov edx, dword [ebp + 8]
lea eax, [esi + 0x30]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x501ce0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
test edx, edx
je 0x5009f9
cmp word [edx], 0
je 0x5009f9
xor eax, eax
dec eax
lea edi, [esi + 0x10]
mov dword [edi + 0x10], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
mov ecx, edi
push eax
push edx
call fcn.004aea40
mov dword [esi + 0x38], 0
push edi
call fcn.004fef10
add esp, 4
xor ebx, ebx
test al, al
je 0x500a23
sub esp, 0x1c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
movdqa xmm0, xmmword [0x6fba70]
movdqu xmmword [esp + 4], xmm0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x5009fd
mov edi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test eax, eax
jle 0x5009eb
mov dword [esi + 8], edi
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ebx
push ebx
call fcn.00517f7c
mov dword [esi + 0xc], 0
mov ecx, dword [ebp + 0xc]
call fcn.004b45c0
lea ecx, [esi + 0xc]
push 0
push ecx
mov ebx, dword [esi + 4]
push ebx
push eax
mov edi, dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setg bl
jmp 0x500a23
xor ebx, ebx
jmp 0x500a2b
lea ecx, [esi + 0x10]
push 0
call fcn.004af666
push 0
push eax
push 0x2ca
push str.read
push str.FileUtils
call fcn.005c4178
add esp, 0x14
xor ebx, ebx
lea ecx, [esi + 0x10]
call fcn.004aeec0
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x501224
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x68], eax
push esi
call fcn.004ff268
add esp, 4
xor edi, edi
test al, al
je 0x501289
push edi
push edi
push edi
push esi
call fcn.00500566
add esp, 0x10
cmp eax, 0xffffffff
je 0x501354
mov esi, eax
xor eax, eax
dec eax
lea ebx, [esp + 0x60]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x501372
cmp byte [ebp + 0xc], 0
mov ebx, 0
je 0x501372
movups xmm0, xmmword [0x7a9568]
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov ecx, esi
push 0
call fcn.004af666
mov byte [esp], 2
mov dword [esp + 8], eax
sub esp, 0x78
movaps xmm0, xmmword [esp + 0xc8]
movups xmmword [esp + 0x68], xmm0
movaps xmm0, xmmword [esp + 0xb8]
movups xmmword [esp + 0x58], xmm0
movaps xmm0, xmmword [esp + 0xa8]
movups xmmword [esp + 0x48], xmm0
movaps xmm0, xmmword [esp + 0x98]
movups xmmword [esp + 0x38], xmm0
movaps xmm0, xmmword [esp + 0x88]
movups xmmword [esp + 0x28], xmm0
movups xmm0, xmmword [esp + 0x78]
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.file_not_exist__s
mov dword [esp + 0x10], str.FileUtils
mov dword [esp + 0xc], str.fileSize
mov dword [esp + 8], 0x3c3
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileUtils.cpp
mov dword [esp], 2
call fcn.004ee380
add esp, 0x78
xor edi, edi
xor ebx, ebx
jmp 0x501372
push edi
push edi
push 0x3c8
push str.fileSize
push str.FileUtils
call fcn.005c4178
add esp, 0x14
xor edi, edi
dec edi
mov ebx, edi
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.006c9121
mov eax, edi
mov edx, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5057b0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi], ecx
mov dword [esi + 0xc], esp
lea ebx, [esi + 0x30]
mov dword [ebx - 4], esp
xor edx, edx
dec edx
mov dword [ebx + 8], edx
mov dword [ebx + 4], 0x5062f0
mov eax, dword fs:[0]
mov dword [ebx], eax
mov dword fs:[0], ebx
mov dword [esi + 0x20], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x10], xmm0
push eax
sub esp, 0x28
mov edi, esp
lea ecx, [edi + 0x18]
mov dword [esi + 4], ecx
push edx
push 0x743f10
call fcn.004aea40
mov dword [esi + 8], edi
lea ecx, [edi + 4]
mov dword [ebx + 8], 0
xor eax, eax
dec eax
push eax
push str.setConfigPeriod
call fcn.004aea40
lea edi, [esi + 0x10]
mov eax, dword [esi + 8]
mov dword [eax], edi
mov dword [esi + 0x38], 0xffffffff
mov ecx, dword [esi]
call fcn.005051f0
mov esp, dword [esi + 0xc]
xor eax, eax
inc eax
mov dword [esi + 0x38], eax
mov ecx, edi
push eax
call fcn.004aef38
xor edi, edi
mov ebx, 0
test al, al
jne 0x50588d
lea ecx, [esi + 0x10]
push 0
call fcn.004af666
push eax
call fcn.004f0180
add esp, 4
mov ecx, edx
mov edx, 0xea60
mov dword [esi], eax
mul edx
mov edi, eax
imul ebx, ecx, 0xea60
add ebx, edx
xor eax, eax
cmp dword [esi], 0x1e
sbb ecx, eax
cmovl edi, eax
cmovl ebx, eax
lea ecx, [esi + 0x10]
call fcn.004aeec0
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov eax, edi
mov edx, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x50d4d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [eax - 4], esp
xor edi, edi
dec edi
mov dword [eax + 8], edi
mov dword [eax + 4], 0x50da00
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [esi + 0x20], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x10], xmm0
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
sub eax, ebx
sar eax, 4
imul eax, eax, 0xaaaaaaab
mov dword [esi + 0xc], eax
lea edx, [eax + 1]
cmp edx, 0x5555556
jae 0x50d5a7
mov edi, dword [ecx + 8]
sub edi, ebx
sar edi, 4
imul eax, edi, 0xaaaaaaab
lea ebx, [eax + eax]
cmp ebx, edx
cmovb ebx, edx
cmp eax, 0x2aaaaaa
mov edx, 0x5555555
cmovb edx, ebx
mov dword [esi + 8], ecx
lea ebx, [ecx + 0xc]
lea edi, [esi + 0x10]
mov ecx, edi
push ebx
push dword [esi + 0xc]
push edx
call fcn.0050d1c8
mov eax, dword [edi + 8]
mov dword [esi + 0x38], 0
push dword [ebp + 8]
push eax
push ebx
call fcn.0050d5d0
add esp, 0xc
add dword [esi + 0x18], 0x30
mov ecx, dword [esi + 8]
lea eax, [esi + 0x10]
push eax
call fcn.0050d650
lea ecx, [esi + 0x10]
call fcn.0050d6c6
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00456e1c
push ebp
sub esp, 0xc
lea esi, [ebp - 0x3c]
mov ebp, dword [esi + 0x28]
lea ecx, [esi + 0x10]
call fcn.0050d6c6
add esp, 0xc
pop ebp
ret
Function at 0x517100
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [eax - 4], esp
xor edi, edi
dec edi
mov dword [eax + 8], edi
mov dword [eax + 4], 0x5175a0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [esi + 0x20], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x10], xmm0
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
sub eax, ebx
sar eax, 4
imul eax, eax, 0xcccccccd
lea edx, [eax + 1]
cmp edx, 0x3333334
jae 0x517220
mov edi, dword [ecx + 8]
sub edi, ebx
sar edi, 4
imul ebx, edi, 0xcccccccd
lea edi, [ebx + ebx]
cmp edi, edx
cmovb edi, edx
cmp ebx, 0x1999999
mov edx, 0x3333333
cmovb edx, edi
mov dword [esi + 0xc], ecx
lea edi, [ecx + 0xc]
lea ebx, [esi + 0x10]
mov ecx, ebx
push edi
push eax
push edx
call fcn.00517266
mov eax, dword [ebx + 8]
mov ecx, dword [ebp + 8]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
movsd xmm0, qword [ecx + 0x10]
mov edx, ecx
movsd qword [eax + 0x10], xmm0
mov dword [esi + 8], eax
lea ecx, [eax + 0x18]
lea eax, [edx + 0x18]
mov dword [esi + 0x38], 0
push eax
call fcn.004f4bc0
mov eax, dword [ebp + 8]
movsd xmm0, qword [eax + 0x38]
mov ecx, dword [esi + 8]
movsd qword [ecx + 0x38], xmm0
movups xmm0, xmmword [eax + 0x28]
movups xmmword [ecx + 0x28], xmm0
add ecx, 0x40
add eax, 0x40
mov dword [esi + 0x38], 1
push eax
call fcn.004f4bc0
add dword [esi + 0x18], 0x50
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
push eax
call fcn.005172ce
lea ecx, [esi + 0x10]
call fcn.005173a2
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00456e1c
nop
push ebp
sub esp, 0xc
lea esi, [ebp - 0x3c]
mov ebp, dword [esi + 0x28]
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x517249
mov ecx, dword [esi + 8]
mov dword [ecx + 0x1c], eax
push eax
call fcn.006c90e6
add esp, 4
add esp, 0xc
pop ebp
ret
Function at 0x51b165
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
movzx edi, ax
shr edi, 0xf
push 2
call esi
movzx eax, ax
shr eax, 0xf
lea edi, [eax + edi*8]
push 1
call esi
lea ebx, [edi + 2]
test ax, ax
cmovns ebx, edi
push 0x10
call esi
lea edi, [ebx + 4]
test ax, ax
cmovns edi, ebx
push 0x12
call esi
mov ecx, edi
or ecx, 0x20
test ax, ax
cmovns ecx, edi
mov eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5213fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movzx eax, word [ebp + 0x10]
mov ecx, edi
shr ecx, 4
inc ecx
movzx ecx, cx
push eax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
xor eax, eax
test esi, esi
je 0x5214d8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5214d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x5214d6
mov ebx, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
and edi, 0xf
je 0x521489
test eax, eax
jle 0x521489
mov edx, ebx
add edx, eax
dec edi
movzx eax, word [ebx]
lea ebx, [ebx + eax*2]
add ebx, 2
cmp ebx, edx
setb cl
add edi, 0xffffffff
jae 0x521489
cmp ebx, edx
jb 0x521472
test cl, cl
je 0x5214d6
movzx esi, word [ebx]
test esi, esi
mov eax, 0
je 0x5214d8
test ebx, ebx
je 0x5214d8
lea eax, [ebx + 2]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x14]
mov ecx, edi
push esi
call fcn.00438b18
movzx ecx, word [ebx]
push ecx
push dword [ebp - 0x10]
push esi
push eax
call fcn.00438aa2
add esp, 0x10
mov eax, dword [edi]
cmp dword [eax - 8], esi
jl 0x5214e2
mov dword [eax - 0xc], esi
mov eax, dword [edi]
mov word [eax + esi*2], 0
xor eax, eax
inc eax
jmp 0x5214d8
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push 0x80070057
call fcn.006c989c

Function at 0x521f7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.DuiLib::ResLoaderZip.0
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x521fe2
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x521fdb
mov ebx, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x521fdb
push ebx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 8], edi
push 3
push ebx
push eax
call fcn.005d2c91
add esp, 0xc
mov dword [esi + 4], eax
jmp 0x521fe2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x558500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x48], eax
xor edi, edi
cmp dword [ebp + 8], 0x30
ja 0x55868a
mov ebx, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
lea eax, [ecx + 0xf4]
mov dword [esp + 0xc], eax
lea edi, [ecx + 0xfc]
mov edx, 1
call fcn.00558930
mov ecx, dword [esi + 0xf4]
call dword [section..00cfg]
lea eax, [esp + 0x10]
push esi
push eax
push edi
call ecx
add esp, 0xc
mov ecx, esi
mov edx, 1
call fcn.00558930
mov ecx, dword [esi + 0xf4]
call dword [section..00cfg]
push esi
lea eax, [esp + 0x24]
push eax
push edi
call ecx
add esp, 0xc
mov ecx, esi
mov edx, 1
call fcn.00558930
mov ecx, dword [esi + 0xf4]
call dword [section..00cfg]
push esi
lea eax, [esp + 0x34]
push eax
push edi
call ecx
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x55865f
xor eax, eax
cmp edx, 8
jb 0x558650
xor eax, eax
cmp edx, 0x10
jb 0x55861e
mov eax, edx
and eax, 0xfffffff0
movdqu xmm0, xmmword [ebx]
pxor xmm0, xmmword [esp + 0x10]
movdqa xmmword [esp + 0x10], xmm0
cmp eax, 0x10
je 0x558615
movdqu xmm0, xmmword [ebx + 0x10]
pxor xmm0, xmmword [esp + 0x20]
movdqa xmmword [esp + 0x20], xmm0
cmp eax, 0x20
je 0x558615
movdqu xmm0, xmmword [ebx + 0x20]
pxor xmm0, xmmword [esp + 0x30]
movdqa xmmword [esp + 0x30], xmm0
cmp eax, edx
je 0x55865f
test dl, 8
je 0x558650
mov ecx, eax
mov eax, edx
and eax, 0xfffffff8
nop word cs:[eax + eax]
nop
movq xmm0, qword [ebx + ecx]
movq xmm1, qword [esp + ecx + 0x10]
pxor xmm1, xmm0
movq qword [esp + ecx + 0x10], xmm1
add ecx, 8
cmp eax, ecx
jne 0x558630
cmp eax, edx
je 0x55865f
movzx ecx, byte [ebx + eax]
xor byte [esp + eax + 0x10], cl
add eax, 1
cmp edx, eax
jne 0x558650
push 0x20
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push esi
call fcn.0053d5e0
add esp, 0x14
mov dword [esi + 0xf8], eax
lea eax, [esp + 0x30]
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
mov edi, 1
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.006c9121
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56dc50
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7c0200], 0
jne 0x56dc82
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x56dc7a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov dword [0x7c0204], eax
mov dword [0x7c0200], ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
push str..._.._base_allocator_partition_allocator_partition_tls_win.cc_38__Check_failed:_g_destructor__nullptr
call fcn.00458eb0
add esp, 4
jmp 0x56dc5c

Function at 0x56dcb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x56dcc1
test eax, eax
jne 0x56dd11
test eax, eax
jne 0x56dcd7
mov ecx, dword [0x7c0208]
test ecx, ecx
je 0x56dcd7
call dword [section..00cfg]
call ecx
cmp dword [0x7c0200], 0
je 0x56dd11
mov esi, dword [0x7c0204]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x56dd17
test esi, esi
je 0x56dd11
mov ecx, dword [0x7c0200]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x56dcff
jmp 0x56dd11
Function at 0x5832b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7c0278]
mov ecx, dword [0x7bafb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x5832db
mov ecx, 0x7c0270
pop ebp
jmp fcn.0046cea0
push 0x7c0278
call fcn.006c9157
add esp, 4
cmp dword [0x7c0278], 0xffffffff
jne 0x5832d0
mov dword [0x7c0274], 0
mov dword [0x7c0270], 0
mov ecx, 0x7c0270
push 0
call fcn.0046cf10
push 0x7c0278
call fcn.006c91cd
add esp, 4
jmp 0x5832d0
Function at 0x590880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
test esi, esi
je 0x590932
cmp dword [esi + 4], 0
je 0x590932
push 0
call fcn.0060a3a0
add esp, 4
mov ecx, eax
test eax, eax
je 0x590943
cmp dword [esi + 4], 0
je 0x590982
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ecx
jmp 0x5908f2
mov eax, dword [esi + ebx + 8]
mov dword [ecx + ebx + 8], eax
movzx eax, word [esi + ebx + 0xc]
mov word [ecx + ebx + 0xc], ax
add edi, 1
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 4]
add ebx, 0x14
cmp edi, eax
jae 0x59093e
mov esi, dword [esi]
push dword [ecx + ebx + 4]
call fcn.004c9be0
mov ecx, dword [ebp - 0x10]
add esp, 4
xorps xmm0, xmm0
movups xmmword [ecx + ebx], xmm0
mov dword [ecx + ebx + 0x10], 0
mov eax, dword [esi + ebx]
mov dword [ecx + ebx], eax
mov eax, dword [esi + ebx + 4]
test eax, eax
je 0x5908d0
push eax
call fcn.004c9fb0
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ecx + ebx + 4], eax
jmp 0x5908d0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0058fe90
add eax, 0xffffffff
jmp 0x590987
push 0x14c
call fcn.004c9bb0
add esp, 4
test eax, eax
je 0x590997
push 0x14c
push 0
push eax
mov edi, eax
call fcn.006ccfc0
add esp, 0xc
push 0x5909a0
push edi
push 0
call fcn.0060a440
mov ecx, edi
add esp, 0xc
test eax, eax
jne 0x5908b2
jmp 0x590997
mov eax, 0xffffffff
mov dword [ecx + 0x140], eax
mov dword [ecx + 0x144], 0xf
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret