joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494a85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x494a9f
call fcn.0042cbc9
mov esi, dword [eax + 0xc]
push 0x5b8c18
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x494af5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x494af5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x494ad4
xor esi, esi
jmp 0x494aea
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00494afe
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x494af7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4fb57b
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00571be9
pop ecx
test eax, eax
jne 0x4fb5bd
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00410a90
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4fb583
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x57cd3e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c9fe

Function at 0x5839a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab088
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x61de38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx], 0
jne 0x5839df
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x5de7cc
call fcn.00402790
mov edi, eax
test edi, edi
je 0x5839cc
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x6279a8
lea esi, [eax + 1]
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.004114a0
push esi
push dword [ebp - 0x18]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push str.Find
lea ecx, [ebp - 0x18]
call fcn.004041b0
test eax, eax
jne 0x583a6d
push 0x5de7dc
lea ecx, [ebp - 0x18]
call fcn.004041b0
test eax, eax
jne 0x583a6d
push eax
mov edx, 0x5de7e4
mov ecx, edi
call fcn.004026f0
add esp, 4
test eax, eax
je 0x583a6d
mov ecx, eax
call fcn.004028d0
mov esi, 1
jmp 0x583a6f
xor esi, esi
cmp dword [ebp - 0x14], 0
je 0x583a80
push dword [ebp - 0x18]
call fcn.0041a8f9
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x583aa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab0ab
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x61de38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx], 0
jne 0x583adf
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x5de794
call fcn.00402790
mov edi, eax
test edi, edi
je 0x583acc
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x6279a8
lea esi, [eax + 1]
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.004114a0
push esi
mov esi, dword [ebp - 0x18]
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x5de79c
lea ecx, [ebp - 0x18]
call fcn.004041b0
test eax, eax
jne 0x583b60
push 0x5de7a4
lea ecx, [ebp - 0x18]
call fcn.004041b0
test eax, eax
jne 0x583b60
push eax
mov edx, 0x5de7ac
mov ecx, edi
call fcn.004026f0
add esp, 4
test eax, eax
jne 0x583b62
xor edi, edi
cmp dword [ebp - 0x14], 0
je 0x583b71
push esi
call fcn.0041a8f9
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x583b90
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push edi
push 5
push dword [esp + 0x14]
call esi
push 2
push eax
call esi
push 2
push eax
call esi
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jg 0x583bc2
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.004114a0
push edi
push dword [esi]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp edi, dword [esi + 4]
mov eax, dword [esi]
cmova edi, dword [esi + 4]
mov dword [esi + 8], edi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop esi
pop ebx
ret 8

Function at 0x583ca0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
mov eax, dword [0x61de38]
xor eax, esp
mov dword [esp + 0x400], eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x583cd0
sub eax, edx
cmp eax, 3
jl 0x583d06
cmp byte [esp + eax - 1], 0x2e
jne 0x583d06
cmp byte [esp + eax - 2], 0x2e
jne 0x583d06
mov eax, 1
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0055c6fa
add esp, 0x404
ret
mov ecx, dword [esp + 0x400]
xor eax, eax
xor ecx, esp
call fcn.0055c6fa
add esp, 0x404
ret
Function at 0x584460
Capabilities:
Connect to http server
Create http request
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x414
mov eax, dword [0x61de38]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
push ebx
push esi
push edi
mov edi, dword [esp + 0x428]
mov esi, ecx
push eax
push edx
lea eax, [esp + 0x24]
push 0x5dec8c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x5844ca
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0055c6fa
add esp, 0x414
ret
push ebp
push 0
push 0
push 3
push 0
push 0
push 0x50
push esi
xorps xmm0, xmm0
push ebx
movlpd qword [esp + 0x38], xmm0
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebp, eax
test ebp, ebp
jne 0x5844fc
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x584593
push 0
push 0x4000000
lea eax, [esp + 0x20]
push eax
push 0
push 0x5dec94
lea eax, [esp + 0x34]
push eax
push 0x5deca0
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x584536
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
push ebp
call esi
xor ebx, ebx
jmp 0x584591
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x584574
mov byte [edi], al
mov eax, dword [esp + 0x10]
add edi, eax
test eax, eax
jne 0x584545
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call edi
push ebx
call edi
push ebp
call edi
push esi
mov ebx, 1
call edi
mov eax, ebx
mov ecx, dword [esp + 0x420]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055c6fa
add esp, 0x414
ret
Function at 0x5845b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.Mozilla_5.0__Windows_NT__Trident_7.0__AS__rv:11.0__like_Gecko
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebp, eax
test ebp, ebp
je 0x58473c
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [esp + 0x10]
push 4
push eax
push 2
push ebp
mov dword [esp + 0x20], 0x1388
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 6
push ebp
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 5
push ebp
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 0xb
push ebp
call ebx
push edi
push edi
push 3
push edi
push edi
push 0x1bb
push dword [esp + 0x3c]
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
je 0x58473c
push 0
push 0x801000
push 0
push 0
push 0x5deb80
push dword [esp + 0x3c]
push 0x5deb8c
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x58472b
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 4
push eax
lea eax, [esp + 0x18]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [esp + 0x14], 0x180
lea eax, [esp + 0x14]
push 4
push eax
push 0x1f
push esi
call ebx
test eax, eax
je 0x58472b
push 0x20000000
push 0xc1
push str.Accept:_text__r_nUser_Agent:_Mozilla_5.0__Windows_NT__Trident_7.0__AS__rv:11.0__like_Gecko__compatible__MSIE_5.0__Windows_NT__r_nContent_type:_application_application_x_www_form_urlencoded_r_n_r_n_r_n
push esi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
je 0x58472b
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5846c0
sub ecx, edx
mov edx, 0x61e6b0
lea eax, [edx + 1]
mov dword [esp + 0x24], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x5846d5
sub edx, dword [esp + 0x24]
push ecx
push ebx
push edx
push 0x61e6b0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x58472b
mov ebx, dword [esp + 0x30]
nop word [eax + eax]
lea eax, [esp + 0x18]
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x584720
mov byte [ebx], al
mov eax, dword [esp + 0x18]
add ebx, eax
test eax, eax
jne 0x584700
lea ebx, [eax + 1]
jmp 0x58472d
xor ebx, ebx
test esi, esi
je 0x584740
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
jmp 0x584746
xor ebx, ebx
jmp 0x584746
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
je 0x58474d
push edi
call esi
test ebp, ebp
je 0x584754
push ebp
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret 0x10
Function at 0x5847b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
test edi, edi
jne 0x5847e9
push 0
push 0
push 0
push 0
push 0x5de9f0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x5847e3
push eax
call ebp
mov dword [esi], edi
test edi, edi
je 0x584816
mov ebx, dword [esi + 4]
test ebx, ebx
jne 0x584822
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push dword [esp + 0x38]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x58480f
push eax
call ebp
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x584822
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
push 0
push 0
push 0
push 0
push 0x5dea30
push dword [esp + 0x38]
push 0x5dea3c
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x584907
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x14]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [esp + 0x10], 0x180
lea eax, [esp + 0x10]
push 4
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x584907
push 0x20000000
push 0xc1
push 0x5dea78
push esi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
je 0x584907
mov edi, dword [esp + 0x28]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5848a7
sub ecx, edx
mov edx, 0x61e6e0
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x5848b8
push ecx
push edi
sub edx, ebx
push edx
push 0x61e6e0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x584907
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, dword [esp + 0x2c]
nop
lea eax, [esp + 0x14]
push eax
push 0x400
push edi
push esi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5848fc
mov byte [edi], al
mov eax, dword [esp + 0x14]
add edi, eax
test eax, eax
jne 0x5848e0
lea edi, [eax + 1]
jmp 0x584909
xor edi, edi
test esi, esi
je 0x584910
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x587d60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x61de38]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0x104
lea eax, [esp + 8]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [esi + 0x110e0]
lea eax, [esp + 8]
push eax
push 0x5e36e8
push dword [esi + 0x110e4]
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x118]
add esp, 0x10
pop esi
xor ecx, esp
call fcn.0055c6fa
add esp, 0x108
ret

Function at 0x58a260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab3e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x61de38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.ServerConnector.0
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], vtable.THREAD_DEFAULT.0
mov dword [edi + 0xc], vtable.Event.0
mov dword [edi + 0x10], 0xffffffff
mov dword [ebp - 4], 0
mov dword [edi + 0x18], vtable.Event.0
mov dword [edi + 0x1c], 0xffffffff
lea ecx, [edi + 0xc58]
call fcn.00584990
mov dword [edi + 0xc64], 0
mov dword [edi + 0xc68], 0
mov dword [edi + 0xc60], 0x6279a8
push 0x100
lea eax, [edi + 0x73c]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.0055ed60
add esp, 0xc
lea ecx, [edi + 0xc60]
push 0
push 0x5de52f
call fcn.00411530
push 0x800
call fcn.0041a8fe
push 0x800
mov dword [edi + 0xc3c], eax
call fcn.0041a8fe
push 0x800
mov dword [edi + 0xc40], eax
call fcn.0041a8fe
push 0x1800
mov dword [edi + 0xc44], eax
call fcn.0041a8fe
push 0xfde8
mov dword [edi + 0xc48], eax
call fcn.0041a8fe
push 0x190
mov dword [edi + 0xc4c], eax
call fcn.0041a8fe
add esp, 0x18
mov dword [edi + 0xc50], eax
cmp dword [edi + 8], 0xffffffff
jne 0x58a39a
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x5898e0
push 0
push 0
call fcn.005680d2
add esp, 0x18
mov dword [edi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [edi + 0xc40]
add eax, eax
mov dword [ecx + 0x330], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov esi, 0x1f3
div esi
mov eax, dword [edi + 0xc44]
mov dword [eax + 0x640], edx
call fcn.005621fb
cdq
idiv esi
mov eax, dword [edi + 0xc3c]
inc edx
mov dword [eax + 0x4b8], edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58a550
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x414
mov eax, dword [0x61de38]
xor eax, esp
mov dword [esp + 0x40c], eax
mov edx, dword [esp + 0x41c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x424]
push edi
mov edi, ecx
mov eax, dword [edi + 0x418]
lea ebx, [edi + 0x418]
mov ecx, ebx
mov dword [esp + 0x10], edi
mov dword [ebx + 4], eax
call fcn.004043e0
mov ecx, dword [ebx + 4]
mov eax, 0xdd67c8a7
sub ecx, dword [ebx]
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x58a5bb
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x58a67f
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x400
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebx + 4]
mov eax, 0xdd67c8a7
mov esi, dword [ebx]
xor ebp, ebp
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x58a64d
lea ecx, [edi + 4]
xor edi, edi
mov dword [esp + 0x14], ecx
nop
lea eax, [esp + 0x18]
push eax
push dword [edi + esi + 8]
call fcn.005837a0
test eax, eax
je 0x58a69a
cmp dword [esp + 0x444], 0
je 0x58a649
mov ecx, dword [ebx + 4]
mov eax, 0xdd67c8a7
mov esi, dword [ebx]
inc ebp
sub ecx, esi
add edi, 0x128
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x14]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x58a600
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x438]
mov edx, dword [0x5e38c0]
mov eax, dword [eax]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax + 0x135], cl
test cl, cl
jne 0x58a660
mov dword [edi + 0x414], 1
mov eax, 1
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055c6fa
add esp, 0x414
ret 0x20
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x58a67f
Function at 0x58a985
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
cmp byte [esi + 0x2d], 0
je 0x58a9fd
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x58a9b3
cmp dword [esi + 0x40], edi
jae 0x58a9b3
push ecx
call fcn.0041a8f9
add esp, 4
mov dword [esi + 0x3c], 0
xor eax, eax
test eax, eax
jne 0x58a9c9
lea eax, [edi + edi]
push eax
call fcn.0041a8fe
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push eax
call fcn.0055e7e0
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x58a9fa
push ebp
nop dword [eax + eax]
mov eax, dword [esi + 0x3c]
lea ecx, [esi + 0x30]
mov dl, byte [ebx + eax]
call fcn.0058aac0
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x58a9e0
pop ebp
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x58aa36
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x58aa1e
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
ret 8
push edi
add ecx, edx
push ebx
push ecx
call fcn.0055e7e0
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x58aa57
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
ret 8

Function at 0x58ab00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x5e3fb0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x58ab50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x58ab57
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x58ac17
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
sub edi, 1
jne 0x58ab70
pop edi
test esi, esi
je 0x58ac3a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e3fb0]
sub esi, 1
jne 0x58ac20
not ecx
mov eax, ecx
pop esi
ret
Function at 0x58b130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab4ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x61de38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00414ff0
lea esi, [edi + 0x54]
mov ecx, esi
call fcn.00414ff0
mov ebx, dword [edi + 0x38]
test esi, esi
je 0x58b177
mov ecx, esi
call fcn.00415060
cmp ebx, 0xffffffff
jne 0x58b1ef
mov ecx, esi
lea ebx, [edi + 0x34]
call fcn.00414ff0
mov ecx, esi
call fcn.00414ff0
cmp dword [ebx + 4], 0xffffffff
jne 0x58b1d9
cmp dword [ebx + 8], 0
jne 0x58b1a4
mov ecx, ebx
call fcn.00415160
test eax, eax
je 0x58b1d9
lea eax, [ebp - 0x10]
mov dword [ebx + 0x14], 0x58b120
push eax
push 0
push ebx
push 0x415310
push 0
push 0
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], 0xfa
call fcn.005680d2
add esp, 0x18
mov dword [ebx + 4], eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
je 0x58b1ef
mov ecx, esi
call fcn.00415060
test esi, esi
je 0x58b1ef
mov ecx, esi
call fcn.00415060
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0x6279a8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0x6279a8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov esi, dword [edi + 0x1c]
push eax
mov ebx, dword [esi + 4]
push ebx
push esi
call fcn.00404bd0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [edi + 0x20]
sub ecx, eax
cmp ecx, 1
jb 0x58b2cb
inc eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
mov dword [edi + 0x20], eax
mov dword [esi + 4], edx
mov dword [ebx], edx
je 0x58b267
push dword [ebp - 0x1c]
call fcn.0041a8f9
add esp, 4
cmp dword [ebp - 0x24], 0
je 0x58b278
push dword [ebp - 0x28]
call fcn.0041a8f9
add esp, 4
mov eax, dword [edi + 0x1c]
push 5
push str.block
mov ecx, dword [eax + 4]
add ecx, 8
call fcn.00411530
mov eax, dword [edi + 0x1c]
push 3
push 0x5ec704
mov ecx, dword [eax + 4]
add ecx, 0x14
call fcn.00411530
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, edi
call fcn.00415060
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.0055dbbe
int3