joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dcc3c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5dcc53
add esp, 0xfffffff0
call fcn.004093a8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bf694
mov eax, dword [0x627ed0]
cmp byte [eax], 0
jne 0x5dcc80
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x628274]
cmp word [eax + 2], 0
jne 0x5dcc9a
mov eax, dword [0x628274]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005def10
mov eax, dword [0x6283d4]
cmp word [eax + 2], 0
jne 0x5dccb4
mov eax, dword [0x6283d4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005df114
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4ef160]
call fcn.004f52b0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5df68c
mov dl, 1
mov eax, dword [0x488424]
call fcn.00408d0c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x488424]
call fcn.00408d0c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f3b88]
call fcn.004fe8c0
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5dce9c
mov eax, dword [0x628100]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fed58
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5df974
mov dl, 1
mov eax, dword [0x488424]
call fcn.00408d0c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x628100]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425928
test eax, eax
je 0x5dcdce
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425764
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0042590c
test eax, eax
je 0x5dcde6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b834
push ebx
push 0x5de8ec
call fcn.005d24d0
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x627ed0]
cmp byte [eax], 0
jne 0x5dce37
mov eax, ebx
call fcn.005dd080
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005dfbac
mov eax, ebx
call fcn.005e0818
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5dce94
call fcn.00409400
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dd3c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5dd466
cmp dword [ebx + 0xac], 0
jne 0x5dd460
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5dd300
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5dd460
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5dd426
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5dd460
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004aa630
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5dd435
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5dd6a4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x62e784]
cmp dword [eax + 0x188], 0
je 0x5dd81e
test bl, bl
jne 0x5dd769
cmp dword [esi + 0xb4], 0
jne 0x5dd75e
mov eax, esi
call fcn.005e0668
push eax
push 0x5dd598
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5dd72f
mov eax, dword [0x62e784]
cmp byte [eax + 0xeb], 0
je 0x5dd72f
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5dd710
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5dd72f
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5dd718
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5dd75e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aa630
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5dd73e
inc dword [esi + 0xb4]
jmp 0x5dd81e
cmp dword [esi + 0xb4], 0
jle 0x5dd81e
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5dd81e
cmp dword [esi + 0x58], 0
je 0x5dd7d3
mov eax, dword [0x62e784]
cmp byte [eax + 0xeb], 0
je 0x5dd7d3
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5dd7b4
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5dd7d3
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5dd7bc
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5dd802
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aa630
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5dd7e2
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ced54]
call fcn.0040cd30
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5de478
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5de4d5
cmp byte [ebx + 0xeb], 0
jne 0x5de4d5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040ad08
mov eax, dword [esi]
test eax, eax
je 0x5de4c2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5de4e2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040af60
jmp 0x5de4e2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040af60
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5dfd94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5dfe05
mov eax, esi
call fcn.00528e08
test al, al
je 0x5dfe05
mov eax, dword [ebx + 0x98]
call fcn.00528a38
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5dfe05
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5dfdf6
push 0
mov eax, dword [ebx + 0x98]
call fcn.00528a38
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0051f654
jmp 0x5dfe05
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005dfbcc
pop esi
pop ebx
ret
Function at 0x5ec86c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac64
xor eax, eax
push ebp
push 0x5ec917
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [esi], eax
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b778
push eax
call sub.KERNEL32.DLL_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5ec901
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize_1
mov dword [esi], eax
mov eax, dword [esi]
call fcn.00406a6c
mov dword [edi], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edi]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile_1
test eax, eax
je 0x5ec8f2
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
je 0x5ec8f6
xor eax, eax
jmp 0x5ec8f8
mov al, 1
mov byte [ebp - 5], al
push ebx
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec91e
lea eax, [ebp - 4]
call fcn.0040ab80
ret

Function at 0x5ec92c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac64
xor eax, eax
push ebp
push 0x5ec9b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 2
push 0
push 0
push 3
mov eax, dword [ebp - 4]
call fcn.0040b778
push eax
call sub.KERNEL32.DLL_CreateFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x5ec99c
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 8]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile_1
test eax, eax
je 0x5ec990
cmp edi, dword [ebp - 0xc]
je 0x5ec994
xor ebx, ebx
jmp 0x5ec996
mov bl, 1
push esi
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec9b9
lea eax, [ebp - 4]
call fcn.0040ab80
ret
Function at 0x5edf9c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x5edfb0
add esp, 0xfffffff0
call fcn.004093a8
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00408d0c
push esi
push 0x5ee5b4
call fcn.004c2120
mov dword [esi + 0x448], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [esi + 0x444], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [esi + 4], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [esi + 8], eax
push 0xfa0
lea eax, [esi + 0x41c]
push eax
call sub.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_GetSystemInfo_1
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x440], eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, eax
sub eax, 2
mov dword [esi + 0x10], eax
cmp eax, 0x100
jle 0x5ee03f
mov dword [esi + 0x10], pe_nt_image_headers32
mov eax, esi
test bl, bl
je 0x5ee054
call fcn.00409400
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5eede0
Capabilities:
Access peb ldr_data

Disassembly:
call sub.KERNEL32.DLL_GetCurrentThreadId_1
mov ecx, eax
call fcn.005eed3c
cmp eax, ecx
je 0x5eee90
mov eax, dword [0x62e7c8]
call fcn.005ee124
mov eax, 0x62e80c
push eax
call sub.KERNEL32.DLL_EnterCriticalSection_1
pop edx
mov eax, 0x62e7cc
mov dword [eax], ecx
mov dword [eax + 8], edx
mov dword [eax + 0xc], ebp
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], edi
mov dword [eax + 0x34], esi
xor eax, eax
push ebp
push 0x5eee88
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push edx
mov ecx, 0x5eec94
push ecx
call fcn.005ed120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
mov eax, 0x62e7cc
mov ebp, dword [eax + 0xc]
mov ecx, dword [eax + 0x38]
dec ecx
js 0x5eee65
mov eax, dword [eax + 0x3c]
mov edx, ecx
shl edx, 2
add eax, edx
mov edx, dword [eax]
add eax, 0xfffffffc
push edx
dec ecx
jns 0x5eee5c
mov eax, 0x62e7cc
mov edx, dword [eax + 0x10]
push edx
mov eax, 0x62e7cc
mov ebx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
mov esi, dword [eax + 0x34]
mov eax, 0x62e80c
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection_1
ret
inc dword [0x62e7d0]
ret
Function at 0x5f05d4
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esi], ecx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push edi
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x5f065d
push 0
push 0x96
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x5f0654
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0x6610
push edi
call sub.advapi32.dll_CryptDeriveKey
test eax, eax
je 0x5f0654
push esi
mov eax, dword [ebp - 4]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDecrypt
test eax, eax
je 0x5f064b
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDestroyKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5f0780
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.KERNEL32.DLL_GetSystemInfo_1
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x5f54bc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5f54ea
mov eax, ebx
call fcn.005f5f78
cmp dword [ebx + 0x40], 0
je 0x5f54e3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5f555b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5f554d
cmp dword [ebx + 8], 0
je 0x5f550c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5f551e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5f554d
cmp dword [ebx + 8], 0
je 0x5f54ff
cmp eax, 3
je 0x5f5531
dec eax
jne 0x5f54ff
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5f54ff
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5f54ff
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5f5579
cmp dword [ebx + 0x14], 0xcc
je 0x5f5579
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005f5584
pop ebx
ret

Function at 0x609b44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x62ecd0], 0
jne 0x609b5b
call fcn.00609b00
mov eax, edi
dec eax
test eax, eax
jl 0x609b83
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x62e8d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x609b65
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x60c878
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x60c912.0
jmp dword [ecx*4 + 0x60c8ab]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x60c8dd
sub dl, 8
je 0x60c8ec
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c544
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c598
jmp case.0x60c912.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x60c912.0
movzx ecx, byte [ecx + 0x60c919]
jmp dword [ecx*4 + 0x60c92a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c638
jmp case.0x60c912.0
cmp dl, 3
jne 0x60c957
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c690
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c64c
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c6d4
jmp case.0x60c912.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x60c982
sub dl, 8
je 0x60c98e
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c700
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c764
jmp case.0x60c912.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x60c9ad
sub dl, 8
je 0x60c9b9
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c814
jmp case.0x60c912.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60c83c
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x60ca5b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0060ba8c
test eax, eax
je 0x60ca5b
mov eax, ebx
call fcn.0060ca64
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x60c9f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x60ca64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x60ca95
dec al
je 0x60cad0
dec al
je 0x60cb0d
dec al
je 0x60cb76
jmp 0x60cc00
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x60cc00
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x60caa5
jmp 0x60cc00
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60cc00
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x60cae0
jmp 0x60cc00
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60cc00
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x60cb3c
xor ebp, ebp
jmp 0x60cb4c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x60cb55
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x60cb1d
jmp 0x60cc00
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60cc00
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x60cbcf
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00609b8c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x60cb8a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x614dac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x614f16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x614f30
call fcn.0040af60
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x628398]
mov eax, dword [eax]
call fcn.005df604
mov eax, dword [ebp - 0x14]
call fcn.0040b778
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x614ef3
mov eax, ebx
call fcn.00406a6c
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x628398]
mov eax, dword [eax]
call fcn.005df604
mov eax, dword [ebp - 0x18]
call fcn.0040b778
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x614eec
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x614f74
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x614eec
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
push edi
shr ebx, 0x10
movzx eax, bx
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x614f84
call fcn.00425bf8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
and eax, 2
cmp eax, 2
jne 0x614eec
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [edi]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0x11
lea edx, [ebp - 0x44]
xor ecx, ecx
mov eax, 0x614fa8
call fcn.00425bf8
mov edx, dword [ebp - 0x3c]
mov eax, edi
call fcn.0040af60
mov eax, esi
call fcn.00406a88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x614f1d
lea eax, [ebp - 0x3c]
call fcn.0040ab80
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040abe0
ret
Function at 0x402fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x484020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403038
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403018
xor eax, eax
push ebp
push 0x403011
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403054
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403018
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x484020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x484020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d44
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48604c], 0
je 0x403da5
cmp word [0x486220], 0xd7b2
jne 0x403d6d
cmp dword [0x486228], 0
jbe 0x403d6d
mov eax, 0x48621c
call dword [0x486238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403dcc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x484030], 0
jne 0x403dc1
push 0
push 0x484064
push 0x48406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret