joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5918b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aa151
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CWeaponTrace.0
lea esi, [edi + 8]
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.005c8dfe
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea esi, [edi + 0x1c]
mov dword [ebp - 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.005c8dfe
add esp, 8
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
lea ecx, [edi + 0x4c]
mov byte [ebp - 4], 2
call fcn.0052ba60
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.005928d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x59acf0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aa83c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CArea.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
lea esi, [edi + 0x64]
mov byte [ebp - 4], 7
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
lea esi, [edi + 0x8c]
mov byte [ebp - 4], 0xa
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x98]
mov byte [ebp - 4], 0xb
push 0x14
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x84], 0xff00ff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5aef30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ab144
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
sub esi, dword [ebp + 0xc]
lea eax, [edi + 1]
lea ebx, [esi + 1]
test eax, eax
je 0x5af00b
test ebx, ebx
je 0x5af00b
push 0x40
call fcn.005c8dfe
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x5aefa0
mov ecx, eax
call fcn.005b56a0
mov ecx, eax
jmp 0x5aefa2
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
lea eax, [edi + 1]
cmp ebx, eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
cmovle esi, edi
inc esi
mov dword [ecx + 0x24], esi
movzx eax, word [eax + 0x8c]
imul eax, dword [ebp + 0xc]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
add eax, edx
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5b75e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ab50d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x748cb4], edi
lea esi, [edi + 0x6c]
mov dword [edi], vtable.CSoundManager.0
push 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x43480000
mov dword [edi + 0x1c], 0x447a0000
mov dword [edi + 0x20], 0x3f800000
mov dword [edi + 0x24], 0x3f800000
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c7c40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x5c7c67
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x5c7c6a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.005c7c1c
pop esi
leave
ret 8

Function at 0x5c9f02
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5c9f41
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5c9f41
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5c9f41
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5c9f41
cmp dword [ecx + 0x74], 0xe
jbe 0x5c9f41
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5cba10
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
push esi
push 0x6d8c38
push 0x64
call fcn.005c9c43
mov esi, eax
add esp, 8
test esi, esi
je 0x5cbbae
push 0x63
lea ecx, [esi + 1]
push 0
push ecx
call fcn.006430f0
lea eax, [esi + 4]
mov byte [esi], 1
push 2
push eax
call fcn.005c86eb
lea eax, [esi + 0x34]
push eax
call fcn.005c88b3
xorps xmm0, xmm0
mov dword [0x7af420], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [esp + 0x24], 0
mov esi, dword [esp + 0x1c]
je 0x5cba8e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5cba83
cmp byte [eax], 0
je 0x5cba83
push eax
push esi
call fcn.005cc240
jmp 0x5cba8b
push 0
push esi
call fcn.005cc1b0
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x789d30
mov dword [0x7af21c], eax
call fcn.005c8707
add esp, 4
test eax, eax
jne 0x5cbbbd
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5cbac6
movups xmm0, xmmword [eax]
movups xmmword [0x7aadd4], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x5cbad0
xorps xmm0, xmm0
movups xmmword [0x7aadd4], xmm0
movq qword [0x7aade4], xmm0
xorps xmm0, xmm0
push 0x789d30
movups xmmword [0x7aadec], xmm0
movq qword [0x7aadfc], xmm0
call fcn.005c8718
add esp, 4
cmp dword [0x7aadd0], 0
jne 0x5cbbb8
push ebx
push edi
push esi
call fcn.005cf450
mov dword [0x7aadd0], eax
mov byte [esp + 0x10], 1
mov dword [eax + 8], 0x5ca1a0
mov eax, dword [0x7aadd0]
mov dword [eax + 0xc], 0x5ca190
lea eax, [esp + 0x10]
mov esi, dword [0x7af420]
push eax
call fcn.005ca1c0
push esi
mov bl, al
call fcn.005ca1b0
xchg byte [eax], bl
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.005ca6c0
add esp, 0x14
mov edi, dword [eax]
mov dword [eax], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5cbb74
push 4
push eax
call fcn.005c8a85
add esp, 8
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push 0x5ca1d0
push 0
push 0
call fcn.00658cf5
add esp, 0x18
mov ecx, eax
mov dword [esp + 0x18], ecx
pop edi
pop ebx
test ecx, ecx
je 0x5cbbc8
cmp dword [esi + 0x60], 0
jne 0x5cbbc3
mov eax, dword [esp + 0x14]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
add esp, 0x14
ret
mov dword [0x7af420], 0
pop esi
add esp, 0x14
ret
push eax
call fcn.005c7ad5
call fcn.0065919e
push 6
mov dword [esp + 0x18], 0
call fcn.005c7b02
int3

Function at 0x5cc130
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov dword [esp + 8], 0
test eax, eax
je 0x5cc171
cmp word [eax], 0
je 0x5cc171
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5cc1a3
mov ecx, dword [esp + 8]
push edi
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0
push dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0xc]
mov edi, eax
test ecx, ecx
je 0x5cc1a0
cmp ecx, esi
je 0x5cc1a0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
ret
Function at 0x5cc240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa94
mov eax, dword [0x73a280]
xor eax, esp
mov dword [esp + 0xa90], eax
mov eax, dword [esp + 0xa98]
lea ecx, [esp + 0x48]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [esp + 0xaa4]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5cc2ba
push str.Error_opening_Steam_key_n
jmp 0x5cc371
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x208
push eax
lea eax, [esp + 0x94]
push eax
push 0
push 0
push str.SteamExe
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x5cc36c
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jb 0x5cc36c
shr ecx, 1
mov eax, esi
je 0x5cc31c
lea edx, [esi + 0x5c]
cmp word [esp + eax*2 + 0x90], 0x2f
jne 0x5cc317
mov word [esp + eax*2 + 0x90], dx
inc eax
cmp eax, ecx
jb 0x5cc304
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x94]
push eax
push str.__s__steam:__rungameid__s
lea eax, [esp + 0x2a4]
push 0x800
push eax
call fcn.005cc0c0
lea eax, [esp + 0x2ac]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.005cbe70
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [esp + 0xa90]
xor ecx, esp
call fcn.005c8a4d
add esp, 0xa94
ret
push str.Error_reading_SteamExe_key_n
push 2
call fcn.0065d1e8
add esp, 4
push eax
call fcn.0048db70
mov ecx, dword [esp + 0xaa0]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.005c8a4d
add esp, 0xa94
ret
Function at 0x5cc400
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x34
mov eax, dword [0x73a280]
xor eax, esp
mov dword [esp + 0x30], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x6dcc48]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
push 0
push 0
mov dword [esp + 0x40], eax
mov esi, ecx
mov ax, word [0x6dcc4c]
push 3
movups xmmword [esp + 0x1c], xmm0
push 0
movups xmm0, xmmword [0x6dcc30]
mov word [esp + 0x4c], ax
mov eax, 0x30
push 0
mov word [esp + 0x4e], ax
lea eax, [esp + 0x24]
movups xmmword [esp + 0x34], xmm0
push 0xc0000000
movq xmm0, qword [0x6dcc40]
push eax
movq qword [esp + 0x4c], xmm0
call ebp
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x5cc4d8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x5cc4a3
mov ax, word [esp + 0x3a]
cmp ax, 0x39
jae 0x5cc4f0
inc ax
mov word [esp + 0x3a], ax
jmp 0x5cc4ba
cmp eax, 0xe7
jne 0x5cc4f0
push 0x2710
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x5cc4f0
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x28]
push eax
call ebp
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x5cc488
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c8a4d
add esp, 0x34
ret
mov ecx, dword [esp + 0x40]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c8a4d
add esp, 0x34
ret

Function at 0x5cc590
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x5cc59f
mov al, 1
pop esi
ret 8
test ecx, ecx
je 0x5cc5d6
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
je 0x5cc5d6
mov eax, dword [esp + 8]
test eax, eax
je 0x5cc5d6
push 0
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x5cc5d6
cmp dword [esp + 0xc], esi
je 0x5cc599
xor al, al
pop esi
ret 8
Function at 0x5d2400
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
xor cl, cl
push ebx
push ebp
push esi
push edi
test dl, 3
jne 0x5d2523
mov eax, dword [esp + 0x1c]
test al, 3
jne 0x5d2523
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov ecx, esi
xor edx, edx
shr ecx, 2
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x5d24f6
mov edi, eax
cmp ecx, 8
jb 0x5d24c9
mov ebx, ecx
add eax, 0x10
mov ecx, dword [esp + 0x18]
and ebx, 0xfffffff8
mov ebp, ecx
xorps xmm3, xmm3
xorps xmm2, xmm2
sub ebp, edi
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x5d2460
mov eax, dword [esp + 0x10]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, eax
jb 0x5d24d1
mov eax, dword [esp + 0x1c]
shl edx, 2
sub esi, edx
jne 0x5d24fc
pop edi
pop esi
test ebx, ebx
pop ebp
sete al
pop ebx
pop ecx
ret
mov ebp, dword [esp + 0x18]
mov eax, ecx
sub ebp, edi
lea ecx, [edi + edx*4]
mov edi, eax
sub edi, edx
mov edx, eax
nop word [eax + eax]
mov eax, dword [ecx + ebp]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
sub edi, 1
jne 0x5d24e0
mov ecx, dword [esp + 0x18]
jmp 0x5d24b3
mov ecx, dword [esp + 0x18]
jmp 0x5d24b7
add ecx, edx
add eax, edx
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, ebx
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or cl, bl
jmp 0x5d2527
mov esi, dword [esp + 0x20]
xor edi, edi
test esi, esi
je 0x5d25d4
mov ebp, dword [esp + 0x1c]
mov ebx, edx
sub ebx, ebp
cmp esi, 0x20
jb 0x5d25bf
mov eax, esi
xorps xmm3, xmm3
and eax, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + edx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebx - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, dword [esp + 0x18]
jb 0x5d2554
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or cl, al
cmp edi, esi
jae 0x5d25d4
lea edx, [edi + ebp]
sub esi, edi
mov al, byte [ebx + edx]
lea edx, [edx + 1]
xor al, byte [edx - 1]
or cl, al
sub esi, 1
jne 0x5d25c4
pop edi
pop esi
test cl, cl
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x5d3370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a49a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.005c8a80
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x5d33d4
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x5d33e5
push 0x48
push esi
call fcn.005c8a85
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5ec440
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0xc]
bswap edi
bswap eax
cmp ecx, dword [edx + 0x34]
je 0x5ec4c6
mov ebp, edx
push esi
nop dword [eax + eax]
mov esi, dword [ebp + 0x2c]
mov edx, eax
shr edx, 5
mov ecx, eax
shl ecx, 4
xor edx, ecx
mov ecx, ebx
and ecx, 3
add edx, eax
mov ecx, dword [esi + ecx*4]
add ecx, ebx
sub ebx, 0x61c88647
xor edx, ecx
mov dword [esp + 0x10], ebx
add edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, ebx
shr ecx, 0xb
add edx, edi
and ecx, 3
mov ecx, dword [esi + ecx*4]
add ecx, ebx
xor edx, ecx
mov ecx, dword [esp + 0x10]
add eax, edx
cmp ecx, dword [ebp + 0x34]
jne 0x5ec470
mov ebp, dword [esp + 0x24]
pop esi
mov ecx, dword [esp + 0x1c]
bswap edi
bswap eax
test ecx, ecx
je 0x5ec4ea
xor edi, dword [ecx]
mov dword [ebp], edi
add ecx, 4
je 0x5ec4ed
xor eax, dword [ecx]
pop edi
mov dword [ebp + 4], eax
pop ebp
pop ebx
add esp, 8
ret 0xc
mov dword [ebp], edi
pop edi
mov dword [ebp + 4], eax
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x5f7f50
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5f7fff
push esi
call fcn.0060a0b0
add esp, 4
test al, al
jne 0x5f7fff
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x5f7f77
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00615a10
add esp, 0xc
test eax, eax
je 0x5f7fab
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00615a10
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x5f7fad
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x5f7fde
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.00606e20
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x5f7fc0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x6050a0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x6e73bc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x6050ba
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x6e73d8
push esi
call fcn.00667830
add esp, 8
test eax, eax
je 0x605102
test ebp, ebp
je 0x6050f3
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x605128
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x605128
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x6051df
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x605145
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x73c75c]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x6051d5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6051d5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x605177
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x605190
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x6051a0
test ebp, ebp
je 0x6051cc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x73c760]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x73c760]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x60a260
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x60a29e
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x108], 0
jne 0x60a28f
push 0
call fcn.0060a260
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x108], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x108], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x60a2b3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x616160
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.005f82c0
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.00663c47
push dword [esp + 0x40]
mov edi, eax
call fcn.00663c47
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x6161f5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.005f82c0
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.005f8370
add esp, 0x20
test edx, edx
ja 0x616219
jb 0x6161e7
cmp eax, 0x3e8
ja 0x616219
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x6161b0
test edi, edi
je 0x616202
push edi
call fcn.00657fee
add esp, 4
test esi, esi
je 0x61620f
push esi
call fcn.00657fee
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x616226
push edi
call fcn.00657fee
add esp, 4
test esi, esi
je 0x616233
push esi
call fcn.00657fee
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret