joyce8/EMBER2024-capa huggingface dataset:
Function at 0x573ef0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffd
cmp eax, 4
ja case.0x573f0d.4
jmp dword [eax*4 + 0x57410c]
lea eax, [edi + 0x15c]
push eax
call fcn.005735e0
movzx ecx, ax
add esp, 4
movzx eax, word [edi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
je 0x573f49
push eax
push ecx
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.0054f950
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea esi, [edi + 0x160]
mov word [edi + 0x40], cx
push 4
push esi
mov dword [edi + 0x18], 0
call fcn.00573640
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.00573620
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x57407f
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [edi + 0x14c], eax
lea eax, [edi + 0x38]
push eax
setl cl
lea ecx, [ecx*2 + 1]
mov dword [edi], ecx
call fcn.005c6f70
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
lea esi, [edi + 0x160]
push 4
push esi
mov word [edi + 0x40], ax
mov dword [edi + 0x18], eax
call fcn.00573640
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.00573620
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x57407f
lea eax, [edi + 0x38]
mov dword [edi], 1
push eax
call fcn.005c6f70
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, word [edi + 0x40]
inc dword [edi + 0x18]
inc eax
push dword [edi + 0x18]
movzx eax, ax
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.0054f950
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x57405b
mov dword [edi + 8], 0xffffff9d
xor eax, eax
mov dword [edi], 3
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x5740e5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.0055dc00
push eax
push 0x5ed04c
push ebx
call fcn.0054f8b0
add esp, 0x14
mov eax, 0x37
pop edi
pop esi
pop ebx
pop ebp
ret
lea esi, [edi + 0x160]
push 5
push esi
call fcn.00573640
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.00573620
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [edi], 3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push str.tftp_rx:_internal_error
push 0x5ed04c
push ebx
call fcn.0054f8b0
add esp, 0xc
mov eax, 0x47
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5745d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x5745e2
jmp dword [edx*4 + 0x574638]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00574120
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00573ef0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.005747e0
push str.TFTP_finished
push 0x5fc1dc
push eax
call fcn.0054f950
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x5ed04c
push eax
call fcn.0054f8b0
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x574a90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005d196d
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x574af4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [ebp - 0x108], 0
je 0x574af4
lea eax, [ebp - 0x108]
push eax
call dword [0x661240]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret

Function at 0x574b10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00574a90
Function at 0x5780a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x661234]
mov edi, eax
add esp, 4
test edi, edi
jne 0x5780cd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x578114
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x57811a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x57817b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x578140
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x5781a7
mov eax, dword [esi + 4]
push 1
push 0x6030fc
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6030fd
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x578180
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5781d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x578203
push 0x2e
push edi
call fcn.005b9fa0
add esp, 8
test eax, eax
je 0x578201
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x57ba9e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x57bac1
or esi, 1
push 1
call edi
test ax, ax
jns 0x57bacd
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x57bad9
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x57bae5
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x57e1de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx + 4]
je 0x57e211
cmp esi, dword [ebx + 0x60]
je 0x57e2d3
cmp byte [ebx + 0xc4], 0
jne 0x57e211
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [ebx + 0x60]
je 0x57e2d3
cmp dword [ebx + 0x60], 0
push edi
je 0x57e264
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x118]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x60]
call fcn.0057dee7
mov dword [ebx + 0x60], edi
test esi, esi
je 0x57e2d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
cmp eax, ebx
jne 0x57e2d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd8]
test al, al
je 0x57e2d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe4]
test al, al
je 0x57e2d2
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x60], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x118]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x60]
call fcn.0057dee7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x57f2da
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x57f30c
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x5830d8
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x5e711f
call fcn.0054d955
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.00583467
call fcn.0057b788
push eax
lea ecx, [ebp - 0x94]
call fcn.0057f4c4
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0057b78e
mov ecx, eax
call fcn.0057fce2
test al, al
je 0x5831ee
push ebx
lea ecx, [ebp - 0x94]
call fcn.0057f75f
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0057f729
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x58315f
push str.Error_opening_file
jmp 0x5832cf
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x583268
cmp edi, 0x400000
ja 0x583279
and dword [ebp - 0x2c8], 0
push edi
call fcn.0054c502
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x5831d7
push ebx
call fcn.0054c50b
pop ecx
mov ecx, esi
call fcn.00583467
push 0
push str.Could_not_read_file
jmp 0x5832cf
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0058331a
push dword [ebp - 0x2cc]
jmp 0x5832fd
call fcn.0057b78e
push eax
lea ecx, [ebp - 0x94]
call fcn.0057f742
call fcn.0057b8c1
test al, al
je 0x58320f
call fcn.0057b794
jmp 0x583226
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0057f729
push eax
call fcn.005a004a
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x583237
push eax
push str.Error_opening_zip_file
jmp 0x5832cf
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0059fa89
add esp, 0x14
test eax, eax
je 0x58325e
push 0
push str.Could_not_find_ziped_file
jmp 0x5832cf
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x583271
push 0
push str.File_is_empty
jmp 0x5832cf
cmp ebx, 0x400000
jbe 0x583282
push 0
push 0x638450
jmp 0x5832cf
push ebx
call fcn.0054c502
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.005a040a
add esp, 0x18
test eax, eax
je 0x5832da
cmp eax, 0x600
je 0x5832da
push dword [ebp - 0x2c8]
call fcn.0054c50b
pop ecx
call fcn.0057b8c1
test al, al
jne 0x5832c8
push edi
call fcn.0059f8e3
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0058348f
mov bl, al
jmp 0x583305
call fcn.0057b8c1
test al, al
jne 0x5832ea
push edi
call fcn.0059f8e3
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0058331a
push edi
mov bl, al
call fcn.0054c50b
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0057f61f
mov al, bl
call fcn.0054d910
ret 8
Function at 0x58b9b7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp + 8]
jne 0x58ba16
cmp byte [esi + 0x36], 0
je 0x58b9e8
add dword [esi + 0x38], 0xf
mov ecx, 0xff
cmp dword [esi + 0x38], ecx
jle 0x58ba0b
push eax
push dword [esi + 4]
mov dword [esi + 0x38], ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x58ba0b
add dword [esi + 0x38], 0xfffffffb
cmp dword [esi + 0x38], 0
jg 0x58ba0b
and dword [esi + 0x38], 0
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x38]
lea ecx, [esi + 0x44]
call fcn.0057e721
pop esi
pop ebp
ret 4
Function at 0x59f2d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4ec], edi
je 0x59f342
cmp dword [ebp + 8], 0x100
jne 0x59f331
cmp word [ebp + 0xc], 0xd
jne 0x59f331
cmp byte [esi + 0x4f2], 0
je 0x59f318
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x59f331
cmp byte [esi + 0x4f3], 0
jne 0x59f331
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x59f32d
push edi
push edi
push edi
push str.return
push esi
call fcn.0057dee7
xor eax, eax
jmp 0x59f345
mov eax, dword [esi + 0x4ec]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x59f935
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x59f9eb
movzx eax, word [esi]
test ax, ax
je 0x59f9eb
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x59f975
cmp ax, 0x5c
jne 0x59f977
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x59f969
cmp edi, esi
je 0x59f9be
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.005c7c13
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x59f9fb
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0059f935
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005d35f9
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005d35c8
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
call fcn.0054c633
int3

Function at 0x59ffc2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x5a003e
cmp dword [edi + 4], 0xffffffff
jne 0x5a003e
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x650ab8
push esi
call fcn.005d35c8
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x5a0010
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x5a0010
mov eax, 0x2000000
jmp 0x5a0043
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a24de
add esp, 0x10
test eax, eax
jne 0x5a002e
mov eax, dword [ebp - 4]
jmp 0x5a0043
push eax
call fcn.005a2be6
mov dword [edi], eax
mov eax, dword [0x670330]
pop ecx
jmp 0x5a0043
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5a25eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x5a261f
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5a261a
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x5a2646
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x5a262f
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005b96a0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x5a27b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x5a27c7
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x5a2886
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
sub edi, 1
jne 0x5a27df
pop edi
test esi, esi
je 0x5a28a2
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63c048]
inc edx
sub esi, 1
jne 0x5a288a
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x5aac82
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x5aacef
cmp dword [esi + 0x10], 0
je 0x5aacef
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0054d1f0
mov ebx, esp
test ebx, ebx
je 0x5aacef
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1bc
call fcn.0057f6bd
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0057dee7
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5abacc
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x5e8617
call fcn.0054d955
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.0057b788
push eax
lea ecx, [ebp - 0x94]
call fcn.0057f4c4
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0057b78e
mov ecx, eax
call fcn.0057fce2
test al, al
je 0x5abbba
push ebx
lea ecx, [ebp - 0x94]
call fcn.0057f75f
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0057f729
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5abb5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0057f61f
jmp 0x5abc9b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x5abb49
push esi
mov dword [ebp - 0x2c8], edi
call fcn.0054c502
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x5abc86
push edi
call fcn.0054c50b
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0057f61f
jmp 0x5abc99
call fcn.0057b78e
push eax
lea ecx, [ebp - 0x94]
call fcn.0057f742
call fcn.0057b8c1
test al, al
je 0x5abbdb
call fcn.0057b794
jmp 0x5abbf2
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0057f729
push eax
call fcn.005a004a
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x5abb49
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.0059fa89
add esp, 0x14
test eax, eax
jne 0x5abb49
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x5abb49
push esi
call fcn.0054c502
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.005a040a
add esp, 0x18
test eax, eax
je 0x5abc76
cmp eax, 0x600
je 0x5abc76
push edi
call fcn.0054c50b
pop ecx
call fcn.0057b8c1
test al, al
jne 0x5abba6
push ebx
call fcn.0059f8e3
jmp 0x5abba5
call fcn.0057b8c1
test al, al
jne 0x5abc86
push ebx
call fcn.0059f8e3
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0057f61f
test edi, edi
jne 0x5abd0d
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5abd09
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x5abd09
push esi
mov dword [ebp - 0x2d0], edi
call fcn.0054c502
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x5abd05
push edi
call fcn.0054c50b
pop ecx
xor edi, edi
test edi, edi
jne 0x5abd0d
xor eax, eax
jmp 0x5abd28
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.005abd30
push 1
push edi
mov esi, eax
call fcn.0054c4f4
pop ecx
pop ecx
mov eax, esi
call fcn.0054d910
ret 4
Function at 0x5b47cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x5b47f0
cmp dword [esi + 8], edi
jge 0x5b47e8
push esi
call fcn.005b2a6d
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x5b4819
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x5b47fc
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x5b4836
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x5b4824
xor eax, eax
jmp 0x5b482c
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x5b481b
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x5b486b
push str.zlib_corrupt
call fcn.005b2928
add esp, 4
jmp 0x5b48a8
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x5b487b
push str.read_past_buffer
jmp 0x5b4861
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x5b4892
push edi
push esi
call fcn.005b2937
pop ecx
pop ecx
test eax, eax
je 0x5b48a8
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005b96a0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x5db354
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005db014

Function at 0x5deae8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005de967