joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e6168
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e61ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005e60bc
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e61b5
lea eax, [ebp - 4]
call fcn.004087b4
ret

Function at 0x5e61bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00409868
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5e61d5
test al, 0x10
je 0x5e61d9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5e6204
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00409868
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5e6222
test al, 0x10
je 0x5e6222
test ah, 4
je 0x5e6226
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5e622c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408898
xor eax, eax
push ebp
push 0x5e6325
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00408d70
mov ebx, pe_nt_image_headers32
mov eax, edi
mov ecx, ebx
xor edx, edx
call fcn.0040893c
cmp dword [ebp + 0xc], 0
je 0x5e62ab
mov eax, dword [ebp + 0xc]
call fcn.00409868
push eax
push ebx
mov eax, edi
call fcn.00408d60
push eax
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409868
push eax
mov eax, dword [ebp - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov esi, eax
jmp 0x5e62d6
push ebx
mov eax, edi
call fcn.00408d60
push eax
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409868
push eax
mov eax, dword [ebp - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_GetProfileStringW
mov esi, eax
test esi, esi
je 0x5e62ec
mov eax, dword [edi]
call fcn.00409868
call fcn.00408cc4
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov eax, ebx
sub eax, 8
cmp esi, eax
jl 0x5e62fd
cmp ebx, 0x10000
jl 0x5e6308
mov eax, edi
mov edx, esi
call fcn.004099fc
jmp 0x5e630f
add ebx, ebx
jmp 0x5e6264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e632c
lea eax, [ebp - 4]
call fcn.004087b4
ret
Function at 0x5e63f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov word [ebp - 0x10], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x5e6442
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00409868
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00409868
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x5e6466
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00409868
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_GetProfileStringW
push ebx
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e64d8
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov word [esp], 0
test ebx, ebx
je 0x5e6516
mov eax, ebx
call fcn.00409868
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x5e6548
push 0
mov eax, esi
call fcn.00409868
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x5e6534
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x5e6548
push 0
mov eax, esi
call fcn.00409868
push eax
call sub.kernel32.dll_GetProfileStringW
cmp word [esp], 0
sete al
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5e6910
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5e69a5
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x5e695b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.0040893c
jmp 0x5e698f
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x5e6972
lea eax, [ebp - 4]
call fcn.004087b4
jmp 0x5e6985
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005e6760
mov ebx, eax
test esi, esi
je 0x5e6985
dec esi
jmp 0x5e6962
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e69ac
lea eax, [ebp - 4]
call fcn.004087b4
ret

Function at 0x5e6d90
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00422fa4
add esp, 0x208
pop ebx
ret

Function at 0x5e6dbc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00422fa4
add esp, 0x208
pop ebx
ret
Function at 0x5e6e90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e6f0d
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x5e6eeb
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x5e6eeb
lea eax, [ebp - 8]
call fcn.005e6dbc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005e58e4
lea eax, [ebp - 4]
mov edx, 0x5e6f28
call fcn.00409a7c
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.005e5d08
jmp 0x5e6ef2
mov eax, esi
call fcn.004087b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e6f14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408814
ret

Function at 0x5e7154
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5e728a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5e7274
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x5e71b1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x5e7274
cmp dword [ebp - 0x14], 0
jne 0x5e71c6
mov eax, dword [ebp - 0xc]
call fcn.004087b4
mov bl, 1
jmp 0x5e7274
cmp dword [ebp - 0x14], 0x70000000
jb 0x5e71d4
call fcn.00428174
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.0040893c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00408d60
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x5e717a
test eax, eax
jne 0x5e7274
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x5e7222
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x5e7274
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x5e722a
dec esi
test esi, esi
je 0x5e7239
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x5e7229
cmp dword [ebp - 0x10], 7
jne 0x5e7244
test esi, esi
je 0x5e7244
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.004099fc
cmp dword [ebp - 0x10], 7
jne 0x5e7267
test esi, esi
je 0x5e7267
lea eax, [ebp - 4]
call fcn.00408d60
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00408b94
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7291
lea eax, [ebp - 4]
call fcn.004087b4
ret
Function at 0x5e72b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x5e7330
test esi, esi
je 0x5e72e1
cmp word [esi], 0
jne 0x5e7330
call fcn.00428e90
cmp eax, 2
je 0x5e7330
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x5e731e
cmp edi, 0xea
jne 0x5e7330
test edi, edi
jne 0x5e732d
cmp word [esp], 0
jne 0x5e732d
mov bl, 1
jmp 0x5e7330
inc esi
jmp 0x5e72ef
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5e739c
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5e73b0
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x793218], 0
jne 0x5e73d3
push 0x5e73f8
push 0x5e7418
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412f74
mov dword [0x793218], eax
cmp dword [0x793218], 0
je 0x5e73ed
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x793218]
jmp 0x5e73f2
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x5e7434
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5e75a7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x5e7468
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x5e7472
mov ebx, 0x57
jmp 0x5e7591
call fcn.00428e90
cmp eax, 2
jne 0x5e7580
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005e7374
test eax, eax
jne 0x5e7580
xor eax, eax
push ebp
push 0x5e7579
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.0040893c
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5e74cd
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408d60
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x5e7538
mov edi, dword [ebp - 4]
test edi, edi
je 0x5e7508
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x5e7562
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5e7527
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040893c
jmp 0x5e74c1
test esi, esi
jne 0x5e7562
mov eax, dword [ebp - 4]
call fcn.00409868
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.005e7434
test eax, eax
je 0x5e74c1
inc dword [ebp - 0x18]
jmp 0x5e74c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7580
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005e739c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e75ae
lea eax, [ebp - 4]
call fcn.004087b4
ret
Function at 0x5e7640
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00428e90
cmp eax, 2
je 0x5e765d
mov byte [ebp - 1], 1
jmp 0x5e7832
mov byte [ebp - 1], 0
mov eax, 0x7893b8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x5e7832
xor eax, eax
push ebp
push 0x5e782b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x5e76c6
push 0x5e783c
push 0x5e7868
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412f74
mov ebx, eax
test ebx, ebx
je 0x5e76ed
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x5e7814
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x5e7814
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x5e773e
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x5e771f
call fcn.00407f68
jmp 0x5e7832
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5e773e
call fcn.00407f68
jmp 0x5e7832
xor eax, eax
push ebp
push 0x5e780d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5e7781
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5e7781
call fcn.00407f68
call fcn.00407f68
jmp 0x5e7832
mov eax, dword [ebp - 0x14]
call fcn.004054b4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5e77b3
call fcn.00407f68
call fcn.00407f68
jmp 0x5e7832
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5e77ee
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5e77ea
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x5e77ea
mov byte [ebp - 1], 1
jmp 0x5e77ee
inc ebx
dec esi
jne 0x5e77c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7814
mov eax, dword [ebp - 0x18]
call fcn.004054d0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7832
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e8304
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5e83a1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00428e90
cmp eax, 2
jne 0x5e8347
push 1
mov eax, esi
call fcn.00409868
push eax
mov eax, edi
call fcn.00409868
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x5e838b
mov eax, esi
call fcn.00409868
mov edx, eax
lea eax, [ebp - 4]
call fcn.004098d0
mov eax, dword [ebp - 4]
call fcn.00422524
mov ebx, eax
test bl, bl
jne 0x5e8370
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x5e838b
mov eax, esi
call fcn.00409868
push eax
mov eax, edi
call fcn.00409868
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e83a8
lea eax, [ebp - 4]
call fcn.004087b4
ret

Function at 0x5ea8b8
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5edd40
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x79325c
mov eax, esi
mov edx, 8
test al, 1
je 0x5edd5c
shr eax, 1
xor eax, 0xedb88320
jmp 0x5edd5e
shr eax, 1
dec edx
jne 0x5edd4f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5edd48
pop esi
ret

Function at 0x5edd74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x793258], 0
jne 0x5edd9e
call fcn.005edd40
mov dword [esp], 0x793258
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5eddc8
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x79325c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5edda4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x600d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x600ee0
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.005ff96c
pop ecx
test al, al
jne 0x600d77
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00601014
xor ebx, ebx
jmp 0x600ee0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x600d95
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00601014
xor ebx, ebx
jmp 0x600ee0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.0061826c
test eax, eax
jne 0x600dcc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00601014
xor ebx, ebx
jmp 0x600ee0
test byte [edi + 4], 1
je 0x600ed9
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.005ff96c
pop ecx
test al, al
jne 0x600e00
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00601014
xor ebx, ebx
jmp 0x600ee0
mov edx, dword [0x5fcd0c]
mov eax, 0xc
call fcn.0040ada8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x600eab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00409390
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408d68
mov edx, dword [ebp - 4]
call fcn.005ff96c
pop ecx
test al, al
jne 0x600e6e
mov edx, dword [0x5fcd0c]
mov eax, dword [ebp - 8]
call fcn.0040adbc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00601014
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x600ee0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005f8288
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.005f86a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x600ed9
dec esi
jne 0x600d4e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60bd78
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x60bdf5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005f8918
mov eax, dword [ebp - 4]
call fcn.005f8288
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x60bddc
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x60bdd6
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.004091dc
je 0x60bddf
dec ebx
cmp ebx, 0xffffffff
jne 0x60bdb9
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bdfc
lea eax, [ebp - 4]
call fcn.004087d8
ret
Function at 0x620cdc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x793e94], 0
jne 0x620cf3
call fcn.00620c98
mov eax, edi
dec eax
test eax, eax
jl 0x620d1b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x793a94]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x620cfd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x623ce4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x623d15
dec al
je 0x623d50
dec al
je 0x623d94
dec al
je 0x623e06
jmp 0x623ea1
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x623ea1
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x623d25
jmp 0x623ea1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x623ea1
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x623d60
jmp 0x623ea1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x623ea1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x623dc7
xor edx, edx
mov dword [esp + 4], edx
jmp 0x623ddc
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x623df4
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x623da4
jmp 0x623ea1
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x623ea1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x623e6d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00620d24
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x623e22
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret