joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b1c30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x374]
mov edx, dword [eax + 0x388]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 0x2c]
mov ecx, dword [eax + 0x338]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x33c]
mov eax, dword [edi]
mov ebp, dword [eax + 0x12c]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x68]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x118]
xor esi, esi
add ebp, edx
cmp ecx, esi
jbe 0x5b1d21
mov dword [esp + 0x14], esi
mov ebx, dword [edi]
mov eax, 1
xor edx, edx
mov ecx, esi
call fcn.006cfb80
and eax, dword [ebx + 0x90]
and edx, dword [ebx + 0x94]
or eax, edx
je 0x5b1d05
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 0x18c]
mov ax, word [eax + ecx + 6]
test al, al
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push edx
jns 0x5b1cd2
mov eax, dword [esp + 0x1c]
push eax
push ecx
push ebp
push esi
push edi
call fcn.005ce5c0
add esp, 0x18
jmp 0x5b1d01
test ah, 4
mov eax, dword [esp + 0x1c]
push eax
push ecx
push ebp
push esi
push edi
je 0x5b1cf0
call fcn.005c29d0
push eax
push ebp
push esi
push edi
call fcn.005cd010
jmp 0x5b1cfe
call fcn.005c29d0
push eax
push ebp
push esi
push edi
call fcn.005b0c30
add esp, 0x28
test eax, eax
jne 0x5b1d2b
mov ecx, dword [esp + 0x14]
mov edx, dword [edi]
mov eax, dword [edx + 0x118]
inc esi
add ecx, 0x3c
cmp esi, eax
mov dword [esp + 0x14], ecx
jb 0x5b1c83
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
call fcn.005e0030
cmp dword [eax], 0x79
jne 0x5b1dbf
test esi, esi
mov dword [edi + 0x10c], esi
jbe 0x5b1dbf
mov eax, esi
imul eax, eax, 0x3c
jmp 0x5b1d50
mov eax, dword [esp + 0x14]
mov edi, edi
mov ebx, dword [edi]
sub eax, 0x3c
dec esi
mov dword [esp + 0x14], eax
mov eax, 1
xor edx, edx
mov ecx, esi
call fcn.006cfb80
and eax, dword [ebx + 0x90]
and edx, dword [ebx + 0x94]
or eax, edx
je 0x5b1dbb
mov eax, dword [ebx + 0x18c]
mov ecx, dword [esp + 0x14]
mov dl, byte [eax + ecx + 6]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
test dl, dl
mov edx, dword [esp + 0x1c]
push edx
push eax
push ecx
push ebp
push esi
push edi
jns 0x5b1da6
call fcn.005ce620
add esp, 0x18
jmp 0x5b1db7
call fcn.005c29d0
push eax
push ebp
push esi
push edi
call fcn.005bbee0
add esp, 0x28
test eax, eax
jne 0x5b1dbf
test esi, esi
ja 0x5b1d4a
mov eax, dword [esp + 0x24]
mov cl, byte [eax + 0x36a]
test cl, cl
je 0x5b1ddf
mov edx, dword [eax + 0x374]
mov eax, dword [edx + 0x30]
mov ecx, dword [edi + 0xd8]
sub dword [eax + 0x64], ecx
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
Function at 0x5b72b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x374]
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
movzx ecx, word [eax + 0x15e]
mov ebp, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x20], ecx
mov cl, byte [eax]
cmp cl, 0xff
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
je 0x5b72f3
movzx edi, cl
inc edi
jmp 0x5b7308
movzx cx, byte [ebp + 0xd]
movzx di, byte [ebp + 0xe]
shl ecx, 8
add ecx, edi
movzx edi, cx
add edi, 3
lea ecx, [edi + ebp + 0xc]
mov dword [esp + 0x14], ecx
cmp dword [ebp], 0
je 0x5b7391
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push edx
push ebx
call fcn.005b38f0
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
add esp, 0x14
test eax, eax
lea esi, [ecx + edx]
mov dword [esp + 0x10], esi
jne 0x5b7447
jmp 0x5b7342
mov esi, dword [esp + 0x10]
cmp esi, dword [ebp]
jae 0x5b7447
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x24]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.005b38f0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
add edx, ecx
add esp, 0x14
test eax, eax
mov dword [esp + 0x10], edx
je 0x5b733e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ebx
call fcn.005b3d40
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
neg eax
mov edx, eax
mov ecx, eax
mov byte [edi + ebp + 0xf], al
shr edx, 8
mov byte [edi + ebp + 0xe], dl
mov edx, dword [esp + 0x18]
shr ecx, 0x10
mov byte [edi + ebp + 0xd], cl
mov ecx, dword [esp + 0x14]
shr eax, 0x18
mov byte [edx], al
mov edx, dword [ecx + 0x74]
mov eax, dword [ebx + 0x348]
mov ecx, dword [edx + eax*8 + 4]
mov edx, dword [edx + eax*8]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
lea eax, [edi + ebp + 0x10]
push eax
push ecx
call fcn.005ca5a0
mov edx, dword [esi + 0x30]
mov eax, dword [edx + 0x78]
mov ecx, dword [esi + 0x3c]
imul eax, eax, 0x41c
sub ecx, eax
mov dword [esi + 0x38], ecx
mov eax, dword [ebx + 0x348]
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x18c]
mov edx, eax
imul edx, edx, 0x3c
add edx, edi
mov dword [ebx + 0x36c], edx
mov ecx, dword [ecx + 0x74]
mov dword [ecx + eax*8], 0xffffffff
mov dword [ecx + eax*8 + 4], 0xffffffff
mov eax, dword [esp + 0x38]
add esp, 0x14
test eax, eax
jne 0x5b7447
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x38]
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
push eax
push ebx
call fcn.005b38f0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5cdb50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov eax, dword [0x93e25c]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x78]
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], eax
movzx eax, word [edi + 0x14]
mov ecx, dword [edx + eax*8 + 4]
mov dword [edx + eax*8 + 4], ebx
lea edx, [edx + eax*8]
mov eax, dword [edx]
mov dword [edx], ebp
mov edx, ecx
shr edx, 8
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], cl
mov edx, ecx
shr ecx, 0x18
shr edx, 0x10
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], dl
mov byte [esp + 0x17], al
mov ecx, eax
shr ecx, 8
mov edx, eax
mov byte [esp + 0x16], cl
shr edx, 0x10
shr eax, 0x18
mov byte [esp + 0x14], al
mov eax, dword [esi]
mov byte [esp + 0x15], dl
or byte [eax + 0xb4], 0x20
mov edx, dword [esi + 0x110]
mov eax, dword [esi]
xor ecx, ecx
test edx, edx
movzx edx, word [edi + 0xa]
setne cl
push ecx
push edx
mov edx, dword [esp + 0x38]
push 8
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax + 0x210]
push edx
mov edx, dword [eax + 0x1bc]
push ebx
push ebp
push ecx
push edx
call fcn.005e4ec0
mov ecx, dword [esp + 0x3c]
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
call fcn.006cedd0
add esp, 0xc
ret

Function at 0x5ce830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
push ebp
push edi
mov edi, dword [eax + 4]
xor ebp, ebp
cmp edi, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], 4
jae 0x5ce93d
push ebx
push esi
movzx edx, byte [edi + 0x12]
mov al, byte [edi + 0x14]
test al, al
movzx ebx, word [edi + 0x10]
mov dword [esp + 0x10], edx
je 0x5ce88a
mov ecx, dword [edi + 8]
mov esi, dword [esp + 0x24]
test byte [esi + ecx], al
je 0x5ce88a
mov edx, ebp
shl edx, 8
shr ebp, 0x18
lea ebp, [edx + ebp + 0x1ff]
jmp 0x5ce929
mov eax, dword [esp + 0x24]
mov esi, dword [edi + 4]
add esi, eax
mov ax, word [edi + 0xe]
test al, 8
je 0x5ce8b6
movzx ecx, byte [edi + 0x15]
cmp ecx, 1
jne 0x5ce8a9
movzx eax, byte [esi]
jmp 0x5ce8ac
movzx eax, word [esi]
add esi, ecx
cmp ebx, eax
jbe 0x5ce8dd
mov ebx, eax
jmp 0x5ce8dd
test al, 0x20
je 0x5ce8dd
movzx eax, byte [edi + 0x15]
push esi
push eax
call fcn.005c42b0
movzx ecx, byte [edi + 0x15]
mov esi, dword [ecx + esi]
add esp, 8
test ebx, ebx
je 0x5ce8d7
cmp ebx, eax
jbe 0x5ce8d9
mov ebx, eax
mov edx, dword [esp + 0x10]
cmp edx, 1
lea eax, [esi + ebx]
je 0x5ce90b
cmp edx, 0xf
je 0x5ce90b
cmp edx, 0x11
je 0x5ce90b
cmp esi, eax
je 0x5ce929
movzx ecx, byte [esi]
mov edx, ebp
shl edx, 8
shr ebp, 0x18
add edx, ebp
add edx, ecx
inc esi
cmp esi, eax
mov ebp, edx
jne 0x5ce8f3
jmp 0x5ce929
mov eax, dword [edi]
mov edx, dword [eax + 0x68]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
push ecx
push ebx
push esi
push eax
call dword [edx + 0x24]
mov eax, dword [esp + 0x28]
add esp, 0x14
xor ebp, eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 8]
add edi, 0x18
cmp edi, eax
jb 0x5ce857
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 0xc
ret
Function at 0x5d7fc0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x2c]
cmp ecx, 1
jne 0x5d7fdc
mov ecx, dword [eax]
mov dword [eax + 4], ecx
mov ecx, dword [ecx]
mov dword [esp + 4], ecx
jmp fcn.005af910
cmp ecx, 2
jne 0x5d7ff5
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov dword [eax + 4], ecx
mov eax, dword [ecx]
mov dword [esp + 4], eax
jmp fcn.005af910
call fcn.005e0030
mov dword [eax], 0x83
mov eax, 0x83
ret

Function at 0x5d8010
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x5d802c
call fcn.005e0030
mov dword [eax], 0x85
mov eax, 0x85
ret
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp fcn.005baea0

Function at 0x5d8b50
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x5d8b5f
mov edi, 1
push edi
call fcn.006d0da2
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5d8bb3
push esi
call fcn.006cee9e
mov esi, eax
call fcn.005e0030
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x5d8b96
mov edx, dword [fcn.005e5540]
mov dword [fcn.005e5540], edx
test al, 0x18
je 0x5d8ba7
push edi
push 0x64
push 5
call fcn.005db890
add esp, 0xc
test esi, esi
pop esi
je 0x5d8bce
push 1
call fcn.006cf0c8
test byte [esp + 0x10], 0x20
je 0x5d8bce
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x5d96d0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push 0x200
push 0x976998
mov dword [0x97ad60], 0x7cce20
mov edi, 0x97ad64
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x5d9704
mov dword [0x97ad64], 0x976998
mov edi, 0x97ad68
push str.GetSystemWindowsDirectoryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push 0x200
push 0x976598
je 0x5d972d
call eax
jmp 0x5d975d
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
cmp esi, 8
jbe 0x5d975b
lea eax, [esi + 0x976590]
push str.System32
push eax
call fcn.006e2468
add esp, 8
test eax, eax
jne 0x5d975b
sub esi, 8
mov byte [esi + 0x976598], al
mov eax, esi
test eax, eax
je 0x5d97a6
mov esi, 0x976598
mov eax, 0x976998
jmp 0x5d9770
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5d9794
test cl, cl
je 0x5d9790
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5d9794
add eax, 2
add esi, 2
test cl, cl
jne 0x5d9770
xor eax, eax
jmp 0x5d9799
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5d97a6
mov dword [edi], 0x976598
add edi, 4
push str.MYSQL_HOME
call fcn.006cee5f
add esp, 4
test eax, eax
je 0x5d97bc
mov dword [edi], eax
add edi, 4
push 0x200
push 0x976798
mov dword [edi], 0x73a01c
push 0
add edi, 4
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x5d9840
push 0x976798
xor esi, esi
call fcn.0062b6a0
add esp, 4
cmp eax, 0x976798
jbe 0x5d9837
cmp byte [eax], 0x5c
jne 0x5d97fc
test esi, esi
jne 0x5d9816
mov esi, eax
dec eax
cmp eax, 0x976798
ja 0x5d97f1
mov dword [edi], 0x976798
add edi, 4
mov dword [edi], 0
pop edi
pop esi
ret
cmp eax, 0x976798
je 0x5d9833
mov byte [eax + 1], 0
mov dword [edi], 0x976798
add edi, 4
mov dword [edi], 0
pop edi
pop esi
ret
mov byte [esi + 1], 0
mov dword [edi], 0x976798
add edi, 4
mov dword [edi], 0
pop edi
pop esi
ret
Function at 0x5db730
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
mov eax, dword [0x93e25c]
mov dword [esp + 0xc], eax
mov eax, dword [0x976bac]
test eax, eax
jne 0x5db7a7
mov ax, word [0x7cd1d4]
mov cl, byte [0x7cd1d6]
push esi
push edi
push 7
mov word [esp + 0xc], ax
xor edx, edx
lea eax, [esp + 0xe]
push eax
mov dword [esp + 0x13], edx
push 0x1004
mov word [esp + 0x1b], dx
push 0x800
mov byte [esp + 0x1a], cl
mov byte [esp + 0x21], dl
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edi, str.cp932
lea esi, [esp + 8]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
mov eax, 0x877190
je 0x5db7a2
mov eax, 0x844320
mov dword [0x976bac], eax
mov ecx, dword [esp + 0xc]
call fcn.006cedd0
add esp, 0x10
ret

Function at 0x5dbd70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa08
mov eax, dword [0x93e25c]
push 0x73a01c
push 2
mov dword [esp + 0xa0c], eax
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.006d343f
add esp, 8
call fcn.006d2a20
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5dbe81
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x5dbe74
nop
push 0
lea eax, [esp + 0x118]
push eax
push 0x74620c
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x524]
push edx
call fcn.006313a0
lea eax, [esp + 0x528]
push eax
call fcn.006e290b
push eax
call fcn.006e4314
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
mov eax, esi
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x5dbe00
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [esp + 0xa04]
call fcn.006cedd0
add esp, 0xa08
ret

Function at 0x5dbf30
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x93e25c]
mov dword [esp + 0x190], eax
call fcn.005dbea0
test al, al
je 0x5dbf87
lea eax, [esp]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x5dbf65
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp]
push ecx
jmp 0x5dbf75
cmp word [esp], 2
je 0x5dbf80
call sub.WSOCK32.dll_WSACleanup
lea edx, [esp]
push edx
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x5dbf87
mov byte [0x976bb4], 1
mov ecx, dword [esp + 0x190]
xor al, al
call fcn.006cedd0
add esp, 0x194
ret
Function at 0x5dff20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x97a598]
push ebx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5dffab
push esi
push 0x70
push 1
call fcn.006d3d6a
mov esi, eax
add esp, 8
test esi, esi
jne 0x5dff4b
pop esi
mov al, 1
pop ebx
ret
mov ecx, dword [0x97a598]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [esi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.005e2370
add esp, 8
push 0x97a400
mov byte [esi + 0x60], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x976bc0]
inc eax
mov dword [esi + 0x54], eax
mov ecx, dword [0x976bbc]
inc ecx
push 0x97a400
mov dword [0x976bc0], eax
mov dword [0x976bbc], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov al, bl
pop ebx
ret

Function at 0x5dffb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x97a598]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x5e0014
mov al, byte [esi + 0x60]
test al, al
je 0x5e0014
lea ecx, [esi + 4]
push ecx
call fcn.005e23e0
add esp, 4
lea edx, [esi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.006d0db4
add esp, 4
push 0x97a400
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x976bbc]
jne 0x5e0009
push 0x97a480
call fcn.005e2510
add esp, 4
push 0x97a400
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x97a598]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret

Function at 0x5e00b0
Capabilities:
Allocate thread local storage

Disassembly:
mov dword [0x977944], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x97a598], eax
mov eax, ecx
test eax, eax
je 0x5e00e9
push eax
push str.Cant_initialize_threads:_error__d_n
push 0x93e408
call fcn.006cf108
add esp, 0xc
mov al, 1
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x97a4c0
call esi
push 0x97a540
call esi
push 0x97a580
call esi
push 0x97a4e0
call esi
push 0x97a500
call esi
push 0x97a520
call esi
push 0x97a5c0
call esi
push 0x97a560
call esi
push 0x97a400
call esi
push 0
push 0x97a480
call fcn.005e2370
add esp, 8
call fcn.005e95e0
push 0x97a5a0
call esi
push 0x97a460
call esi
call fcn.005dff20
test al, al
pop esi
je 0x5e0163
call fcn.005dfe00
mov al, 1
ret
xor al, al
ret
Function at 0x5e2300
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
push edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x5e2321
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push edx
and eax, 0xfffffbff
push eax
push edi
call fcn.005dc660
mov ebx, eax
add esp, 0xc
test ebx, ebx
jge 0x5e2360
push esi
call fcn.005e0030
mov esi, dword [eax]
push 0
push edi
call fcn.005e8350
add esp, 8
call fcn.005e0030
mov dword [eax], esi
pop esi
mov eax, ebx
pop ebx
pop edi
ret
push 0x976fe8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, ebx
pop ebx
pop edi
ret

Function at 0x5e5c20
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x5e6740
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret
Function at 0x5e72d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x977888]
mov ecx, dword [0x97788c]
sub esp, 0x18
or eax, ecx
push ebx
push ebp
push esi
push edi
jne 0x5e73b2
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
sub eax, 0xd53e8000
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x18]
sbb ecx, 0x19db1de
push edx
mov dword [0x977888], eax
mov dword [0x97788c], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov dword [0x977880], eax
mov dword [0x977884], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [0x977884]
mov edi, dword [0x977880]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
push edi
push eax
push ecx
call fcn.006d1500
push 0
push 0x989680
push ebx
push ecx
mov ebp, eax
mov dword [esp + 0x34], edx
call fcn.006cfc20
push esi
push edi
push edx
push eax
call fcn.006cfcd0
push 0xffffffffffffffff
mov edi, edx
mov edx, dword [esp + 0x28]
push 0xff676980
push edx
push ebp
mov esi, eax
call fcn.006cfc20
mov ecx, dword [0x977888]
sub eax, esi
sbb edx, edi
add ecx, eax
mov eax, dword [0x97788c]
adc eax, edx
mov dword [0x977888], ecx
mov dword [0x97788c], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [0x977884]
mov edi, dword [0x977880]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push edi
push ecx
push edx
call fcn.006d1500
push 0
push 0x989680
push ebx
push ecx
mov ebp, eax
mov dword [esp + 0x34], edx
call fcn.006cfc20
push esi
push edi
push edx
push eax
call fcn.006cfcd0
push 0
mov esi, eax
mov eax, dword [esp + 0x28]
push 0x989680
push eax
push ebp
mov edi, edx
call fcn.006cfc20
mov ecx, dword [0x977888]
add esi, eax
mov eax, dword [0x97788c]
adc edi, edx
add esi, ecx
adc edi, eax
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x5e83b0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x11c
mov eax, dword [0x93e25c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x128], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x130]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x5e8419
nop
push ebx
push edi
lea eax, [esp + 0x18]
push str._s._08X.deleted
push eax
call fcn.006cf753
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x5e8419
call fcn.006cee9e
mov esi, eax
call ebp
cmp eax, 0xb7
mov dword [esi], eax
jne 0x5e8419
dec ebx
jne 0x5e83e0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x5e8441
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x118]
call fcn.006cedd0
add esp, 0x11c
ret
call fcn.005e0030
mov esi, eax
call ebp
mov ebx, dword [esp + 0x134]
test bl, 0x18
mov dword [esi], eax
je 0x5e8475
call fcn.005e0030
mov eax, dword [eax]
push eax
and ebx, 0x80
push edi
add ebx, 0x24
push ebx
push 6
call fcn.005db890
add esp, 0x10
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
call fcn.006cedd0
add esp, 0x11c
ret

Function at 0x5e86b0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 0x14]
push eax
call fcn.006d3694
add esp, 4
cmp eax, 0xffffffff
jne 0x5e86c5
or eax, eax
ret
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
push 0
push 4
push 0x841318
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x5e8719
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
and al, 2
neg al
push edi
push ecx
push edx
sbb eax, eax
and eax, 0xfffffffe
add eax, 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x5e8719
mov eax, edi
pop edi
pop esi
ret
pop edi
or eax, 0xffffffff
pop esi
ret

Function at 0x5eed30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x5eed70
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
invalid