joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5192e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x558
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0050d070
xor ebx, ebx
push ebx
push 0x594f20
push str.._Resource_UniqueItemOptionList.bin
lea ecx, [esp + 0x14]
call fcn.0050ddb0
lea ecx, [esp + 8]
test eax, eax
jne 0x519321
call fcn.0050d580
pop esi
xor eax, eax
pop ebx
add esp, 0x558
ret
call fcn.0050d1f0
test eax, eax
jne 0x5194d5
push edi
lea edi, [esi + 0x4c]
push 0x84
call fcn.005617f1
add esp, 4
cmp eax, ebx
je 0x5193ac
xor ecx, ecx
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov word [eax + 0x44], bx
mov dword [eax + 0x4c], ebx
mov dword [eax + 0x50], ebx
mov dword [eax + 0x54], ebx
mov dword [eax + 0x58], ebx
mov dword [eax + 0x5c], ebx
mov dword [eax + 0x60], ebx
mov dword [eax + 0x64], ebx
mov dword [eax + 0x68], ebx
mov dword [eax + 0x6c], ebx
mov dword [eax + 0x70], ebx
mov dword [eax + 0x74], ebx
mov dword [eax + 0x78], ebx
mov dword [eax + 0x7c], ebx
mov dword [eax + 0x80], ebx
mov esi, eax
jmp 0x5193ae
xor esi, esi
lea ecx, [esp + 0xc]
call fcn.0050e000
push 0x21
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0050dfb0
push eax
lea eax, [esi + 4]
push eax
call fcn.005123c0
add esp, 0xc
push 0x21
lea ecx, [esp + 0x10]
call fcn.0050dfb0
push eax
lea ecx, [esi + 0x24]
push ecx
call fcn.005123c0
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.0050e020
lea ecx, [esp + 0xc]
mov byte [esi + 0x44], al
call fcn.0050e020
lea ecx, [esp + 0xc]
mov byte [esi + 0x45], al
call fcn.0050e000
lea ecx, [esp + 0xc]
mov dword [esi + 0x48], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x4c], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x50], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x54], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x58], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x5c], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x60], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x64], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x68], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x6c], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x70], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x74], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x78], eax
call fcn.0050dfc0
lea ecx, [esp + 0xc]
mov dword [esi + 0x7c], eax
call fcn.0050dfc0
mov edx, dword [esi]
push edx
push esi
mov ecx, edi
mov dword [esi + 0x80], eax
call fcn.0051cc80
lea ecx, [esp + 0xc]
call fcn.0050d1f0
test eax, eax
je 0x519332
pop edi
lea ecx, [esp + 8]
call fcn.0050d580
pop esi
mov eax, 1
pop ebx
add esp, 0x558
ret
Function at 0x52f2c0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x52f2ed
mov ecx, esi
call fcn.0052f280
push 0x597168
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x533d00
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x533d0f
xor eax, eax
ret 8
jmp 0x537850
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x5876c8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x537954
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x537952
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x537954
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x537956
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x585ff8]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.00537270
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8

Function at 0x535170
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x53521f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x53521f
push 0
push 1
push 0x6e1120
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x53521f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x6e110c], ecx
mov edx, dword [eax + 4]
mov dword [0x6e1110], edx
mov eax, dword [eax + 8]
mov dword [0x6e1114], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x6e1100], ecx
mov edx, dword [eax + 4]
mov dword [0x6e1104], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x6e1108], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x5350e0
push 0
push 0
mov dword [0x6e111c], ecx
mov dword [0x6e1118], edi
mov dword [0x6a2b84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x535226
push eax
push 0x6e1120
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x539280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xa0]
mov ecx, edi
call fcn.0053a6f0
mov ebp, 1
cmp dword [ebx + 0x88], ebp
jbe 0x539403
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x580710]
fstp qword [esp + 0x14]
jmp 0x5392c0
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x5392d7
mov ecx, dword [ecx]
test ecx, ecx
je 0x5392d7
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x5392ea
mov eax, dword [eax]
test eax, eax
je 0x5392ea
mov eax, dword [eax]
test eax, eax
jne 0x5392ee
xor edx, edx
jmp 0x5392f0
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x539301
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x539323
fadd dword [0x57f6f0]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x539346
mov eax, dword [eax]
test eax, eax
je 0x539346
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x539358
mov edx, dword [edx]
test edx, edx
je 0x539358
mov edx, dword [edx]
test edx, edx
jne 0x53935c
xor edx, edx
jmp 0x53935e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53936f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x539391
fadd dword [0x57f6f0]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x5393af
push 1
mov ecx, edi
call fcn.00409fd0
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x5393be
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x5393db
push 0xc
call fcn.005617f1
add esp, 4
test eax, eax
je 0x53941b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.00535270
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x5392c0
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053b220
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00561d22
push 0x5ae8e0
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00561e10
int3
Function at 0x539450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.0053a6f0
xor ebp, ebp
cmp dword [ebx + 0x88], ebp
jbe 0x5395d3
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x580710]
fstp qword [esp + 0x14]
jmp 0x539490
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x5394a7
mov ecx, dword [ecx]
test ecx, ecx
je 0x5394a7
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x5394ba
mov eax, dword [eax]
test eax, eax
je 0x5394ba
mov eax, dword [eax]
test eax, eax
jne 0x5394be
xor edx, edx
jmp 0x5394c0
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x5394d1
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x5394f3
fadd dword [0x57f6f0]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x539516
mov eax, dword [eax]
test eax, eax
je 0x539516
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x539528
mov edx, dword [edx]
test edx, edx
je 0x539528
mov edx, dword [edx]
test edx, edx
jne 0x53952c
xor edx, edx
jmp 0x53952e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53953f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x539561
fadd dword [0x57f6f0]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x53957f
push 1
mov ecx, edi
call fcn.00409fd0
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x53958e
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x5395ab
push 0xc
call fcn.005617f1
add esp, 4
test eax, eax
je 0x5395eb
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.00535270
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x539490
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053b220
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00561d22
push 0x5ae8e0
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00561e10
int3
Function at 0x548d80
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x548d9e
push 0
push 0x72
push 0x599048
call fcn.00513100
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x548db6
cmp esi, 0x11
je 0x548db6
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4
Function at 0x5599b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x5599c0
mov eax, 1
mov ecx, 0x6e2030
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x6e2058
jl 0x559a00
mov byte [0x6e4158], 0x63
mov byte [0x6e30bb], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x6e4158], al
mov byte [eax + 0x6e3058], bl
inc ebx
cmp ebx, 0x100
jl 0x559a38
xor ecx, ecx
lea ebx, [ebx]
movzx esi, byte [ecx + 0x6e4158]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x6e3d58], eax
rol eax, 8
mov dword [ecx*4 + 0x6e3958], eax
rol eax, 8
mov dword [ecx*4 + 0x6e3558], eax
rol eax, 8
mov dword [ecx*4 + 0x6e3158], eax
movzx eax, byte [ecx + 0x6e3058]
test eax, eax
je 0x559b66
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x559b6e
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x6e2c58], edx
rol edx, 8
mov dword [ecx*4 + 0x6e2858], edx
rol edx, 8
mov dword [ecx*4 + 0x6e2458], edx
rol edx, 8
mov dword [ecx*4 + 0x6e2058], edx
inc ecx
cmp ecx, 0x100
jl 0x559ab0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x55a120
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 0x118
mov eax, ecx
sub eax, 0x80
push edi
je 0x55a160
sub eax, 0x40
je 0x55a151
sub eax, 0x40
jne 0x55a324
mov edi, dword [esp + 0x120]
mov dword [edi], 0xe
jmp 0x55a16d
mov edi, dword [esp + 0x120]
mov dword [edi], 0xc
jmp 0x55a16d
mov edi, dword [esp + 0x120]
mov dword [edi], 0xa
mov eax, dword [esp + 0x124]
push esi
push ecx
push eax
lea ecx, [esp + 0x10]
lea esi, [edi + 8]
push ecx
mov dword [edi + 4], esi
call fcn.00559bc0
mov eax, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [eax]
mov dword [esi], edx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov edx, dword [eax + 8]
mov dword [esi + 8], edx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [edi]
dec ecx
add esi, 0x10
sub eax, 0x10
test ecx, ecx
jle 0x55a30d
lea esp, [esp]
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x6e4158]
mov edx, dword [edx*4 + 0x6e2058]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2458]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2858]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2c58]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x6e4158]
and edx, 0xff
movzx edx, byte [edx + 0x6e4158]
mov edx, dword [edx*4 + 0x6e2c58]
xor edx, dword [edi*4 + 0x6e2058]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2458]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2858]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x6e4158]
and edx, 0xff
movzx edx, byte [edx + 0x6e4158]
mov edx, dword [edx*4 + 0x6e2c58]
xor edx, dword [edi*4 + 0x6e2058]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2458]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2858]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x6e4158]
and edx, 0xff
movzx edx, byte [edx + 0x6e4158]
mov edx, dword [edx*4 + 0x6e2c58]
xor edx, dword [edi*4 + 0x6e2058]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2458]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x6e4158]
xor edx, dword [edi*4 + 0x6e2858]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x55a1c0
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
pop esi
pop edi
add esp, 0x118
ret
Function at 0x55b0a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x724
push ebx
mov ebx, dword [esp + 0x72c]
push esi
mov esi, ecx
test ebx, ebx
jne 0x55b0c2
pop esi
xor eax, eax
pop ebx
add esp, 0x724
ret 0x10
cmp dword [esp + 0x734], 0
je 0x55b0b5
push edi
push ebx
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call fcn.00561bf5
push 0x200
xor edi, edi
lea ecx, [esp + 0x544]
push edi
push ecx
add esi, 0x10
call fcn.00561170
lea edx, [esp + 0x30]
push edx
push str._02X
push esi
call fcn.00562e32
add esp, 0x28
test eax, eax
jle 0x55b13e
jmp 0x55b110
cmp edi, 0x200
jge 0x55b13e
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
add esi, 2
push str._02X
mov byte [esp + edi + 0x538], al
push esi
inc edi
call fcn.00562e32
add esp, 0xc
test eax, eax
jg 0x55b110
push ebp
push 0x100
lea edx, [esp + 0x538]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.0055a120
mov ebp, dword [esp + 0x74c]
mov cl, byte [esp + 0x750]
add esp, 0xc
xor edi, edi
mov byte [esp + 0x13], cl
test ebp, ebp
jle 0x55b22f
push ebx
push 0x10
lea edx, [esp + 0x13c]
push 1
push edx
call fcn.00561bf5
add esp, 0x10
cmp eax, 0x10
jne 0x55b263
lea eax, [esp + 0x134]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x24]
push 0
push edx
call fcn.0055a330
mov ecx, dword [esp + 0x74c]
xor eax, eax
add esp, 0x10
xor dl, dl
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
lea esi, [ecx + edi + 1]
jmp 0x55b1d0
mov cl, byte [esp + eax + 0x134]
add byte [esp + 0x13], cl
mov byte [esi + eax - 1], cl
mov cl, byte [esp + eax + 0x135]
add byte [esp + 0x15], cl
mov byte [esi + eax], cl
mov cl, byte [esp + eax + 0x136]
add byte [esp + 0x14], cl
mov byte [esi + eax + 1], cl
mov cl, byte [esp + eax + 0x137]
mov byte [esi + eax + 2], cl
add eax, 4
add dl, cl
cmp eax, 0x10
jl 0x55b1d0
add dl, byte [esp + 0x14]
mov ebx, dword [esp + 0x738]
add dl, byte [esp + 0x15]
add edi, 0x10
add byte [esp + 0x13], dl
cmp edi, ebp
jl 0x55b175
push ebx
push 1
lea edx, [esp + 0x1e]
push 1
push edx
call fcn.00561bf5
mov al, byte [esp + 0x27]
add esp, 0x10
cmp al, byte [esp + 0x16]
jne 0x55b271
cmp al, byte [esp + 0x13]
jne 0x55b271
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x724
ret 0x10
push 0
push 0x59b340
push 0x59b348
jmp 0x55b27d
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x724
ret 0x10

Function at 0x566215
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6a4570]
jne 0x56621f
repz ret
jmp fcn.0057292a
Function at 0x57211c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6a4570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0056be75
and dword [ebp - 0x14], 0
cmp dword [0x6e4de0], 0
mov dword [ebp - 0x18], eax
jne 0x5721cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x572277
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x572277
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5a016c
push ebx
mov dword [0x6e4de0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6e4de4], eax
call edi
push eax
call esi
push 0x5a013c
push ebx
mov dword [0x6e4de8], eax
call edi
push eax
call esi
mov dword [0x6e4df0], eax
test eax, eax
je 0x5721cf
push 0x5a0124
push ebx
call edi
push eax
call esi
mov dword [0x6e4dec], eax
mov eax, dword [0x6e4dec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x572228
cmp dword [0x6e4df0], ecx
je 0x572228
push eax
call esi
push dword [0x6e4df0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x572228
test ebx, ebx
je 0x572228
call edi
test eax, eax
je 0x57221f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x57221f
test byte [ebp - 8], 1
jne 0x572228
or dword [ebp + 0x10], 0x200000
jmp 0x57225b
mov eax, dword [0x6e4de4]
cmp eax, dword [ebp - 0x18]
je 0x57225b
push eax
call esi
test eax, eax
je 0x57225b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x57225b
mov eax, dword [0x6e4de8]
cmp eax, dword [ebp - 0x18]
je 0x57225b
push eax
call esi
test eax, eax
je 0x57225b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6e4de0]
call esi
test eax, eax
je 0x572277
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x572279
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00566215
leave
ret
Function at 0x423bd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x423be2
pop dword [ebp - 0x50]
mov eax, 0xb52018a2
sub eax, 0xb4dddcc0
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x131dc090
add dword [ebp - 0x60], 0x3b3484bb
mov dword [ebp - 0x5c], 0x68906c83
sub dword [ebp - 0x5c], 0x365d203e
mov dword [ebp - 0x58], 0xc4a6b1df
add dword [ebp - 0x58], 0x87a5924f
mov dword [ebp - 0x54], 0xee8b52
sub dword [ebp - 0x54], 0xee8b52
lea eax, [ebp - 0x60]
push eax
mov eax, 0x8769e70
add eax, 0xf7cbb1e4
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x16e09db4
sub dword [ebp - 0x60], 0xa26e345e
mov dword [ebp - 0x5c], 0x47177464
sub dword [ebp - 0x5c], 0x5ab12ef
mov dword [ebp - 0x58], 0x47c3fdae
add dword [ebp - 0x58], 0x1bab6ebe
mov dword [ebp - 0x54], 0x8951ee30
add dword [ebp - 0x54], 0x76ae11d0
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x7d269d70
add eax, 0x831bb2e8
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x39cc3
push 0
call eax
mov ecx, 0x49cdfd58
sub ecx, 0x49cdc522
xor esi, esi
add esi, eax
mov edi, 0x137a3b37
add edi, 0xecc99ec9
add edi, dword [ebp - 0x50]
mov edx, 0x416ad316
mov ebx, dword [edi]
xor dword [ebp - 0x48], 0x2f468008
add ebx, edx
xor dword [ebp - 0x38], 0x20588e0f
mov dword [esi], ebx
xor dword [ebp - 0x20], 0xe2566a96
add esi, 0x49d2dbce
add esi, 0xb62d2436
add edi, 0x70eb20cb
add edi, 0x8f14df39
loop 0x423d00
add eax, 0xc3f9931e
sub eax, 0xc3f8bf73
xor ebx, ebx
add ebx, eax
add eax, 0x701c5d1b
add eax, 0x8fe3a2ea
mov ecx, 0xbe452fdf
add ecx, 0x41fad021
add ecx, dword [ebp - 0x50]
call ebx
leave
ret