joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4f10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c4f22
add esp, 0xfffffff0
call fcn.0040803c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bbb28
mov eax, dword [0x6271ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c53d8
mov eax, dword [0x6271bc]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c53e4
mov eax, ebx
call fcn.005c53f0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5bfa9c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c59cc
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c57fc
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c57fc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c57fc
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c57fc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c57fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c50a2
call fcn.00408094
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c559c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c5747
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c5728
mov dl, 1
mov eax, dword [0x487f54]
call fcn.004ab458
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409750
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c5717
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052b070
test al, al
je 0x5c570a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c5758
lea eax, [ebp - 0x394]
call fcn.00421dcc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c570a
xor eax, eax
push ebp
push 0x5c5703
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c57c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c56ec
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a374
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c56ec
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c570a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c560d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004ab3a8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c574e
lea eax, [ebp - 0x3a0]
call fcn.00409750
ret

Function at 0x5c62f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x62d76c]
cmp byte [eax + 0xc5], 0
jne 0x5c6366
cmp dword [0x62d790], 0
jne 0x5c6326
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x62612c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x62d790], eax
cmp dword [0x62d78c], 0
jne 0x5c6341
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x62d78c], eax
cmp dword [0x62d794], 0
jne 0x5c6366
push esp
push 0
push 0
mov eax, dword [0x626128]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x62d794], eax
pop edx
ret
Function at 0x5c6788
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c679f
add esp, 0xfffffff0
call fcn.0040803c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bbb28
mov eax, dword [0x627000]
cmp byte [eax], 0
jne 0x5c67cc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x62744c]
cmp word [eax + 2], 0
jne 0x5c67e6
mov eax, dword [0x62744c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8a5c
mov eax, dword [0x6275dc]
cmp word [eax + 2], 0
jne 0x5c6800
mov eax, dword [0x6275dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8c60
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c91d8
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
add dword [eax], eax
add dh, al
adc dword [eax + 0x1000000], 0x33
ror byte [ecx + 0x9483], 0
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4eff6c]
call fcn.004facb8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c69e8
mov eax, dword [0x627294]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fb150
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c94c0
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x627294]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421bcc
test eax, eax
je 0x5c691a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421a08
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421bb0
test eax, eax
je 0x5c6932
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
Function at 0x5c6f10
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c6fb2
cmp dword [ebx + 0xac], 0
jne 0x5c6fac
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c6e4c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c6fac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c6f72
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c6fac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a6af8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c6f81
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c71f0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x62d76c]
cmp dword [eax + 0x188], 0
je 0x5c736a
test bl, bl
jne 0x5c72b5
cmp dword [esi + 0xb4], 0
jne 0x5c72aa
mov eax, esi
call fcn.005ca1b4
push eax
push 0x5c70e4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c727b
mov eax, dword [0x62d76c]
cmp byte [eax + 0xeb], 0
je 0x5c727b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c725c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c727b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7264
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c72aa
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6af8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c728a
inc dword [esi + 0xb4]
jmp 0x5c736a
cmp dword [esi + 0xb4], 0
jle 0x5c736a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c736a
cmp dword [esi + 0x58], 0
je 0x5c731f
mov eax, dword [0x62d76c]
cmp byte [eax + 0xeb], 0
je 0x5c731f
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c7300
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c731f
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7308
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c734e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6af8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c732e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b8d04]
call fcn.0040b870
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5c7fc4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c8021
cmp byte [ebx + 0xeb], 0
jne 0x5c8021
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004098d8
mov eax, dword [esi]
test eax, eax
je 0x5c800e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c802e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409b30
jmp 0x5c802e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409b30
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c98e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c9951
mov eax, esi
call fcn.00524ba4
test al, al
je 0x5c9951
mov eax, dword [ebx + 0x98]
call fcn.005247d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c9951
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5c9942
push 0
mov eax, dword [ebx + 0x98]
call fcn.005247d4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0051b418
jmp 0x5c9951
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005c9718
pop esi
pop ebx
ret
Function at 0x5eac30
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 4], 5
ja 0x5eac5c
cmp dword [esp + 4], 5
jne 0x5eac58
cmp dword [esp + 8], 1
jae 0x5eac5c
xor eax, eax
jmp 0x5eac5e
mov al, 1
add esp, 0x114
ret

Function at 0x5f2890
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x62dec8], 0
jne 0x5f28a7
call fcn.005f284c
mov eax, edi
dec eax
test eax, eax
jl 0x5f28cf
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x62dac8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5f28b1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5f55c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5f565e.0
jmp dword [ecx*4 + 0x5f55f7]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f5629
sub dl, 8
je 0x5f5638
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5290
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f52e4
jmp case.0x5f565e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5f565e.0
movzx ecx, byte [ecx + 0x5f5665]
jmp dword [ecx*4 + 0x5f5676]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5384
jmp case.0x5f565e.0
cmp dl, 3
jne 0x5f56a3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f53dc
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5398
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5420
jmp case.0x5f565e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f56ce
sub dl, 8
je 0x5f56da
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f544c
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f54b0
jmp case.0x5f565e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f56f9
sub dl, 8
je 0x5f5705
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5560
jmp case.0x5f565e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5588
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5f57a7
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005f47d8
test eax, eax
je 0x5f57a7
mov eax, ebx
call fcn.005f57b0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5f5740
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f57b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5f57e1
dec al
je 0x5f581c
dec al
je 0x5f5859
dec al
je 0x5f58c2
jmp 0x5f594c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5f594c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5f57f1
jmp 0x5f594c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f594c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x5f582c
jmp 0x5f594c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f594c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5f5888
xor ebp, ebp
jmp 0x5f5898
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5f58a1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5f5869
jmp 0x5f594c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f594c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5f591b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005f28d8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5f58d6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5fd4ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5fd4da
mov eax, ebx
call fcn.005fdf68
cmp dword [ebx + 0x40], 0
je 0x5fd4d3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5fd54b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5fd53d
cmp dword [ebx + 8], 0
je 0x5fd4fc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5fd50e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5fd53d
cmp dword [ebx + 8], 0
je 0x5fd4ef
cmp eax, 3
je 0x5fd521
dec eax
jne 0x5fd4ef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5fd4ef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5fd4ef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5fd569
cmp dword [ebx + 0x14], 0xcc
je 0x5fd569
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005fd574
pop ebx
ret

Function at 0x60f1c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x418], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60f28a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x410]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
lea eax, [ebp - 0x208]
push eax
push 0
push 0x60f298
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
test eax, eax
jne 0x60f25a
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x418]
xor edx, edx
call fcn.0042546c
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
mov edx, 0x60f2b8
call fcn.0040a524
mov ecx, dword [ebp - 0x414]
mov dl, 1
mov eax, dword [0x4199a0]
call fcn.004269a8
call fcn.00408e4c
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f291
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.004097b0
ret
Function at 0x1004372c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100574a0]
jne 0x10043736
repz ret
jmp fcn.100439dd

Function at 0x10044fa0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x1005747c], 0x1bf1
mov dword [ebp - 8], 0
mov eax, dword [0x1005747c]
sub eax, 0xc52
mov dword [0x1005747c], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x10057480]
sub eax, 0xdcf
mov dword [0x1005747c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10045059
mov dword [ebp - 4], 1
jmp 0x10045134
jmp 0x10045071
jmp 0x1004512d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x10044ffc
jmp 0x1004511f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + eax*2]
cmp eax, 0
je 0x10045008
mov dword [0x10057480], 0x1a0a
jmp 0x10045064
jmp 0x10045124
cmp dword [ebp - 0x10], 0x104
jl 0x10045031
jmp 0x10045071
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10045059
mov dword [0x1005747c], 0xbad
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x1004512d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x18]
cmp eax, 0x6f
jne 0x1004500a
mov dword [0x1005747c], 0x698
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x10045128
mov dword [0x10057480], 0x1bf4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x10045126
mov eax, dword [ebp - 0x10]
shl eax, 1
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax - 0x12]
cmp ecx, 0x64
jne 0x10045124
mov dword [0x10057480], 0x1f99
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
je 0x1004500f
jmp 0x10045054
jmp 0x10045054
jmp 0x10045126
jmp 0x10045128
jmp 0x1004500a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret
Function at 0x10045140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.10045140]
mov ecx, 4
mov dword [ebp - 8], eax
mov eax, ecx
call fcn.100432f0
mov eax, esp
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [0x1005747c]
add edx, 0xf70
mov dword [0x1005747c], edx
mov dword [ebp - 0xc], eax
jmp 0x10045181
mov al, 1
test al, 1
jne 0x10045181
jmp 0x100451c5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
movzx ecx, word [ecx]
cmp ecx, 0x5a4d
jne 0x100451b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [eax]
cmp dword [edx + ecx], 0x4550
jne 0x100451ae
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
jmp 0x100451d6
jmp 0x100451b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
sub ecx, 0x1000
and ecx, 0xfffff000
mov dword [eax], ecx
jmp 0x10045179
mov dword [0x1005747c], 0x549
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret