joyce8/EMBER2024-capa huggingface dataset:
Function at 0x564047
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00568851
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x56407e
push edi
call dword [sym.imp.kernel32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00563c59
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x5640d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x5640f6
cmp dword [edi + 0x54], 0
jne 0x5640f6
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00568851
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0056409d
push ebx
mov esi, eax
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x565802
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5fdf3f
call fcn.005a33b3
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x565827
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.user32.dll_GetWindowTextA]
jmp 0x565873
call fcn.00564d6e
push eax
lea ecx, [ebp - 0x10]
call fcn.00401220
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0056430c
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_lstrlen]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401250
mov eax, esi
call fcn.005a348b
ret 8
Function at 0x569ae1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x569af7
mov edi, dword [esi + 0xc]
jmp 0x569b37
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x569b10
call fcn.0056f30f
push edi
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x569b25
call fcn.0056f30f
push edi
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x569b37
call fcn.0056f30f
call fcn.00568851
cmp dword [eax + 0x3c], 0
je 0x569b4c
push edi
mov ecx, ebx
call fcn.00568974
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.005699fb
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x569b6a
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x569b76
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x572ef0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6963f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x572f30
push 0x6216dc
push 4
push eax
call fcn.005aa23e
push eax
call fcn.0041bc90
add esp, 0x10
jmp 0x572f42
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x572fb0
push edi
call fcn.005a8a41
mov edi, dword [eax]
call fcn.005a8a41
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0059e23e
add esp, 0x18
mov ebx, eax
call fcn.005a8a41
cmp dword [eax], 0
je 0x572f90
call fcn.005a8a41
push dword [eax]
call fcn.004e9c50
pop ecx
jmp 0x572f97
call fcn.005a8a41
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x572fb0
cmp ebx, esi
jae 0x572fb0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x572fb2
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0059e0c2
leave
ret
Function at 0x575817
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x57585d
call fcn.00568851
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x57585d
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x5758a0
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x575889
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x575889
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x57589d
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x59e0c2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6963f4]
jne 0x59e0cc
repz ret
jmp fcn.005ac961

Function at 0x5a0a34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x5a0a61
call fcn.005a8a54
mov dword [eax], esi
call fcn.005a8a41
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005a3b2d
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x5a0a3d
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5a0a90
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.005a8a67
pop ecx
call fcn.005a8a41
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x5a0ab7
test al, 1
je 0x5a0ab7
test byte [esp + 0xc], 2
je 0x5a0ab7
call fcn.005a8a54
mov dword [eax], 5
call fcn.005a8a41
mov dword [eax], 0xd
jmp 0x5a0a87
xor eax, eax
pop esi
ret
Function at 0x5a1e72
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x5a1eaf
cmp dword [ebp + 0x14], edi
je 0x5a1eaf
cmp ecx, edi
jne 0x5a1eb6
call fcn.005a8a41
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.005a3b2d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x5a1eca
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x5a1eeb
cmp ebx, 0xffffffff
je 0x5a1eda
push ebx
push edi
push ecx
call fcn.005a3bb0
add esp, 0xc
cmp esi, edi
je 0x5a1e97
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x5a1e97
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x5a1f07
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x5a1f0e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x5a1fff
test word [esi + 0xc], 0x10c
je 0x5a1f62
mov eax, dword [esi + 4]
test eax, eax
je 0x5a1f62
jl 0x5a2060
cmp ebx, eax
mov edi, ebx
jb 0x5a1f33
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x5a2007
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0059e0d1
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x5a1ff7
cmp ebx, dword [ebp - 0xc]
jb 0x5a1fcf
cmp dword [ebp - 0xc], 0
je 0x5a1f8c
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x5a1f81
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x5a1f88
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x5a1f97
mov eax, SysReAllocString
cmp ebx, eax
ja 0x5a1f97
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x5a2033
push eax
push dword [ebp - 8]
push esi
call fcn.005a44e9
pop ecx
push eax
call fcn.005a6c8e
add esp, 0xc
test eax, eax
je 0x5a2072
cmp eax, 0xffffffff
je 0x5a2060
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x5a1ff7
push esi
call fcn.005af9ec
cmp eax, 0xffffffff
pop ecx
je 0x5a2064
cmp dword [ebp - 4], 0
je 0x5a2033
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x5a1f16
mov eax, dword [ebp + 0x14]
jmp 0x5a1eb1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x5a201e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.005a3bb0
add esp, 0xc
call fcn.005a8a41
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x5a1ea7
cmp dword [ebp + 0xc], 0xffffffff
je 0x5a2049
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.005a3bb0
add esp, 0xc
call fcn.005a8a41
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x5a1ea7
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x5a1eb1
or dword [esi + 0xc], 0x10
jmp 0x5a2064
Function at 0x5b1f56
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x6971a0]
je 0x5b1f71
inc edi
cmp edi, 0x17
jb 0x5b1f62
cmp edi, 0x17
jae 0x5b20f1
push ebp
push 3
call fcn.005b9b71
cmp eax, 1
pop ecx
je 0x5b20bd
push 3
call fcn.005b9b71
test eax, eax
pop ecx
jne 0x5b1fa5
cmp dword [0x6963f0], 1
je 0x5b20bd
cmp ebx, 0xfc
je 0x5b20f0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6a8aa0
push ebp
call fcn.005aa23e
add esp, 0xc
test eax, eax
je 0x5b1fdb
push esi
push esi
push esi
push esi
push esi
call fcn.005a3a31
add esp, 0x14
push 0x104
mov esi, 0x6a8ab9
push esi
push 0
mov byte [0x6a8bbd], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5b201f
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.005aa23e
add esp, 0xc
test eax, eax
je 0x5b201f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.005a3a31
add esp, 0x14
push esi
call fcn.005a3830
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x5b2064
push esi
call fcn.005a3830
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6a8db4
push 0x64a578
sub ecx, eax
push ecx
push eax
call fcn.005a8760
add esp, 0x14
test eax, eax
je 0x5b2064
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.005a3a31
add esp, 0x14
jmp 0x5b2066
xor esi, esi
push 0x63f430
push ebx
push ebp
call fcn.005aa3aa
add esp, 0xc
test eax, eax
je 0x5b2086
push esi
push esi
push esi
push esi
push esi
call fcn.005a3a31
add esp, 0x14
push dword [edi*8 + 0x6971a4]
push ebx
push ebp
call fcn.005aa3aa
add esp, 0xc
test eax, eax
je 0x5b20a8
push esi
push esi
push esi
push esi
push esi
call fcn.005a3a31
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.005c369f
add esp, 0xc
jmp 0x5b20f0
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x5b20f0
cmp ebp, 0xffffffff
je 0x5b20f0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6971a4]
push dword [esi]
call fcn.005a3830
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x5b9740
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005ac3e2
xor ebx, ebx
cmp dword [0x6a8fac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x5b9816
push 0x62ebf4
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x5b98f6
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x5b98f6
push eax
call fcn.005ac374
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6a8fac], eax
call esi
push eax
call fcn.005ac374
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6a8fb0], eax
call esi
push eax
call fcn.005ac374
mov dword [0x6a8fb4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.005a04d8
test eax, eax
pop ecx
pop ecx
je 0x5b97e4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005a3a31
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x5b9816
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.005ac374
cmp eax, ebx
pop ecx
mov dword [0x6a8fbc], eax
je 0x5b9816
push 0x62eb90
push edi
call esi
push eax
call fcn.005ac374
pop ecx
mov dword [0x6a8fb8], eax
mov eax, dword [0x6a8fb8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x5b989b
cmp dword [0x6a8fbc], ecx
je 0x5b989b
push eax
call fcn.005ac3eb
push dword [0x6a8fbc]
mov esi, eax
call fcn.005ac3eb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x5b989b
cmp edi, ebx
je 0x5b989b
call esi
cmp eax, ebx
je 0x5b9868
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5b9868
test byte [ebp - 0x18], 1
jne 0x5b989b
lea eax, [ebp - 0x10]
push eax
call fcn.005a050f
test eax, eax
pop ecx
je 0x5b9883
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005a3a31
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x5b9892
or dword [ebp + 0x10], 0x200000
jmp 0x5b98d6
or dword [ebp + 0x10], 0x40000
jmp 0x5b98d6
mov eax, dword [0x6a8fb0]
cmp eax, dword [ebp - 8]
je 0x5b98d6
push eax
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5b98d6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5b98d6
mov eax, dword [0x6a8fb4]
cmp eax, dword [ebp - 8]
je 0x5b98d6
push eax
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5b98d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6a8fac]
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5b98f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5b98f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c369f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005ac3e2
xor ebx, ebx
cmp dword [0x6a900c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x5c3775
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x5c3855
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x5c3855
push eax
call fcn.005ac374
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6a900c], eax
call esi
push eax
call fcn.005ac374
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6a9010], eax
call esi
push eax
call fcn.005ac374
mov dword [0x6a9014], eax
lea eax, [ebp - 0xc]
push eax
call fcn.005a04d8
test eax, eax
pop ecx
pop ecx
je 0x5c3743
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005a3a31
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x5c3775
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.005ac374
cmp eax, ebx
pop ecx
mov dword [0x6a901c], eax
je 0x5c3775
push 0x62eb90
push edi
call esi
push eax
call fcn.005ac374
pop ecx
mov dword [0x6a9018], eax
mov eax, dword [0x6a9018]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x5c37fa
cmp dword [0x6a901c], ecx
je 0x5c37fa
push eax
call fcn.005ac3eb
push dword [0x6a901c]
mov esi, eax
call fcn.005ac3eb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x5c37fa
cmp edi, ebx
je 0x5c37fa
call esi
cmp eax, ebx
je 0x5c37c7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5c37c7
test byte [ebp - 0x18], 1
jne 0x5c37fa
lea eax, [ebp - 0x10]
push eax
call fcn.005a050f
test eax, eax
pop ecx
je 0x5c37e2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005a3a31
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x5c37f1
or dword [ebp + 0x10], 0x200000
jmp 0x5c3835
or dword [ebp + 0x10], 0x40000
jmp 0x5c3835
mov eax, dword [0x6a9010]
cmp eax, dword [ebp - 8]
je 0x5c3835
push eax
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5c3835
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5c3835
mov eax, dword [0x6a9014]
cmp eax, dword [ebp - 8]
je 0x5c3835
push eax
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5c3835
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6a900c]
call fcn.005ac3eb
cmp eax, ebx
pop ecx
je 0x5c3855
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5c3857
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c7233
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x6963f4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.005c71c8
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.005a3bb0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x5c7282
cmp dword [ebp - 0x1c], 5
jb 0x5c729a
jmp 0x5c7296
cmp dword [ebp - 0x10], 1
jne 0x5c729a
cmp dword [ebp - 0x1c], 4
ja 0x5c7296
jne 0x5c729a
cmp dword [ebp - 0x18], 0
jbe 0x5c729a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x632bdc
call fcn.005c70b9
test eax, eax
jge 0x5c72bb
mov byte [0x6b556c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0059e0c2
add ebp, 0x78
leave
ret

Function at 0x5ddd7a
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
jbe 0x5ddd99
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub ecx, eax
push esi
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x5ddd8d
pop esi
ret

Function at 0x5ddd9a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, eax
or ebx, edx
or ebx, ecx
test bl, 3
pop ebx
jne 0x5dddc2
shr ecx, 2
push ecx
push edx
push eax
call fcn.005ddd7a
add esp, 0xc
ret
test ecx, ecx
jbe 0x5dddd5
push esi
sub edx, eax
mov esi, ecx
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x5dddcb
pop esi
ret

Function at 0x5df4a0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x18]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push eax
push 0x1000
push 1
push ecx
call fcn.005a210e
add esp, 0x10
test eax, eax
ja 0x5df502
mov al, byte [esi + 0x24]
test al, al
je 0x5df4dc
mov edx, dword [edi]
push edi
mov dword [edx + 0x14], 0x2a
mov eax, dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi]
push 0xffffffffffffffff
push edi
mov dword [ecx + 0x14], 0x78
mov edx, dword [edi]
call dword [edx + 4]
mov eax, dword [esi + 0x20]
add esp, 8
mov byte [eax], 0xff
mov ecx, dword [esi + 0x20]
mov eax, 2
mov byte [ecx + 1], 0xd9
mov edx, dword [esi + 0x20]
mov dword [esi + 4], eax
mov dword [esi], edx
mov byte [esi + 0x24], 0
pop edi
mov al, 1
pop esi
ret
Function at 0x5df570
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5df5a0
push esi
call fcn.005e2790
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x5df599
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5df623
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x5df60f
mov eax, dword [esi + 8]
test eax, eax
je 0x5df5c4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5df60b
cmp eax, 2
je 0x5df60f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5df5b7
cmp eax, 3
je 0x5df5ea
cmp eax, 1
jne 0x5df5b7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5df5b7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5df5b7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.005df650
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x5df643
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.005df650
add esp, 4
pop esi
ret

Function at 0x5e04b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
cmp ecx, 0xc
jb 0x5e056a
mov eax, dword [esp + 8]
cmp byte [eax], 0x41
jne 0x5e056a
cmp byte [eax + 1], 0x64
jne 0x5e056a
cmp byte [eax + 2], 0x6f
jne 0x5e056a
cmp byte [eax + 3], 0x62
jne 0x5e056a
cmp byte [eax + 4], 0x65
jne 0x5e056a
push ebx
xor ecx, ecx
mov cl, byte [eax + 7]
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dl, byte [eax + 8]
xor ecx, ecx
mov cl, byte [eax + 9]
mov esi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
shl ebp, 8
add ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
xor ebx, ebx
mov bl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], edi
shl edx, 8
add ecx, 0x18
add edx, ebx
mov ebx, dword [esp + 0x1c]
push 1
mov dword [ecx], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebx
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x4c
mov ecx, dword [esi]
call dword [ecx + 4]
add esp, 8
mov byte [esi + 0x108], 1
mov byte [esi + 0x109], bl
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
push 1
push eax
mov edx, dword [eax]
mov dword [edx + 0x14], 0x4e
mov edx, dword [esp + 0x18]
add ecx, edx
mov edx, dword [eax]
mov dword [edx + 0x18], ecx
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
ret