joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ea4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x619318
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x717a80]
test eax, eax
jne 0x5ea4f2
xor esi, esi
jmp 0x5ea4fb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x5ea53d
cmp dword [esi + 0x14], 0
jne 0x5ea57f
cmp dword [esi + 0x10], 0
jne 0x5ea585
push 0x5ea1e0
push 0x717a84
call fcn.005ea2d0
mov eax, dword [0x717a80]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x5ea56b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5ea56b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x5ea5c5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x5ea5b3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x5ea585
cmp dword [esi + 0x14], 0
je 0x5ea517
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x5ea5ea
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x5ea61b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x5ea61b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5ea61b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x5ea5cf
jmp 0x5ea511
Function at 0x5ea6d0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x619368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x5ea640
push 0
push 0
call fcn.005bae55
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5ea73c
lea ecx, [esp + 0x10]
call fcn.005b2a33
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0042d20b
mov eax, dword [edi + 8]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x5ea764
cmp eax, 0xffffffff
je 0x5ea764
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x5eee70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x5eef21
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x5eeea6
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5eeeb3
add ecx, 4
add edi, 4
dec ebp
jne 0x5eeeb1
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.005edce0
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x5eeef5
add ebp, 4
dec edx
jne 0x5eeef0
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x5eeea2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x5eef30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x5ef015
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
sub esi, ecx
mov edi, ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], eax
jmp 0x5eef86
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x20]
add esi, edi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [esi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5eef93
add ecx, 4
add esi, 4
dec ebp
jne 0x5eef91
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.005edce0
add esp, 0xc
xor esi, esi
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x10]
xor eax, ecx
mov ecx, dword [esp + esi + 0x20]
mov dword [esp + esi + 0x40], eax
mov ebp, eax
mov dword [esp + esi + 0x10], ecx
xor eax, eax
mov ecx, 0x18
mov edx, ebp
sub ecx, eax
add eax, 8
shr edx, cl
inc edi
cmp eax, 0x20
mov byte [edi - 1], dl
jl 0x5eefe3
add esi, 4
cmp esi, 0x10
jl 0x5eefc9
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x58], eax
jne 0x5eef82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x5f18f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619500
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.00532750
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00525b00
mov eax, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00532980
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00532790
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5f19b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x619500
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.00532750
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00525b00
fld qword [esi + 0x10]
sub esp, 8
lea ecx, [esp + 0x20]
fstp qword [esp]
call fcn.00532ab0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00532790
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5f1aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619500
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.00532750
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00525b00
movzx eax, byte [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00532a10
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00532790
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x5f1b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619500
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.00532750
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00525b00
movzx eax, word [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00532b50
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00532790
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5f1c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619500
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.00532750
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00525b00
add esi, 0xc
push esi
lea ecx, [esp + 0x1c]
call fcn.00532f30
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00532790
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5f2010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6195a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6e163c]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [0x63bb88]
mov esi, dword [esp + 0x50]
push eax
push 0
mov edi, ecx
push 0x643400
lea ecx, [esp + 0x18]
call fcn.0050dd90
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], vtable.wxConvAuto.0
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call fcn.00532c00
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
call fcn.00525b00
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5f20bb
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5f20bb
call fcn.0050ccc0
lea ecx, [esp + 0x24]
call fcn.00533130
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0x24]
fstp qword [edi + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.005327b0
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005b8641
add esp, 0x40
ret 4
Function at 0x5f2500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6195f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6e163c]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [0x63bb88]
mov esi, dword [esp + 0x50]
push eax
push 0
mov edi, ecx
push 0x643400
lea ecx, [esp + 0x18]
call fcn.0050dd90
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], vtable.wxConvAuto.0
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call fcn.00532c00
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
call fcn.00525b00
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5f25ab
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5f25ab
call fcn.0050ccc0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
call fcn.00532c90
lea ecx, [edi + 0xc]
push eax
mov byte [esp + 0x4c], 5
call fcn.0050d6d0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5f25e7
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5f25e7
call fcn.0050ccc0
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0xffffffff
call fcn.005327b0
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005b8641
add esp, 0x40
ret 4

Function at 0x5f2aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619638
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x63bb88]
push eax
push 0
push 0x642fdc
lea ecx, [esp + 0x14]
call fcn.0050dd90
mov edx, dword [esp + 0x38]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0
call fcn.0052c800
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x30], 2
cmp eax, 0xffffffff
je 0x5f2b19
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5f2b19
call fcn.0050ccc0
lea ecx, [esp + 0xc]
call fcn.0052c5f0
test al, al
je 0x5f2b7a
add esi, 0xc
lea esp, [esp]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.0052c6d0
push 1
push eax
mov ecx, esi
mov byte [esp + 0x38], 3
call fcn.0050e0f0
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x30], 2
cmp eax, 0xffffffff
je 0x5f2b6d
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5f2b6d
call fcn.0050ccc0
lea ecx, [esp + 0xc]
call fcn.0052c5f0
test al, al
jne 0x5f2b30
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00517890
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x5f78c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x5f7a6a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x5f7918
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x5f792b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x5f793f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x5f7986.3
jmp 0x5f7950
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x5f795c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x5f7961
mov esi, 1
inc eax
cmp eax, edi
jl 0x5f7950
cmp si, cx
je case.0x5f7986.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x5f7986.3
movzx eax, byte [eax + 0x5f7a84]
jmp dword [eax*4 + 0x5f7a70]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x5f7986.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x5f79a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x5f7986.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x5f79e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5f7986.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x5f7a06
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5f7986.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x5f7a30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5fe370
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x6e163c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 3
jne 0x5fe3fa
movzx eax, word [esi + 0x118]
test ax, ax
jne 0x5fe3a6
test byte [esi + 0x230], 1
jne 0x5fe3ce
movzx cx, byte [edi]
cmp cx, ax
jbe 0x5fe3ce
push str.Invalid_background_palette_index
push esi
call fcn.005fc160
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
mov dl, byte [edi]
push 1
lea eax, [esp + 0xc]
push eax
push str.bKGD
push esi
mov byte [esp + 0x18], dl
call fcn.005fd550
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
test al, 2
je 0x5fe48e
movzx ecx, word [edi + 2]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.005fc560
movzx eax, word [edi + 4]
push eax
lea ecx, [esp + 0x16]
push ecx
call fcn.005fc560
movzx edx, word [edi + 6]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.005fc560
add esp, 0x18
cmp byte [esi + 0x127], 8
jne 0x5fe468
mov cl, byte [esp + 0xc]
or cl, byte [esp + 0xa]
or cl, byte [esp + 8]
je 0x5fe468
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push esi
call fcn.005fc160
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
push 6
lea edx, [esp + 0xc]
push edx
push str.bKGD
push esi
call fcn.005fd550
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
mov cl, byte [esi + 0x127]
movzx eax, word [edi + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x5fe4c2
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.005fc160
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.005fc560
push 2
lea ecx, [esp + 0x14]
push ecx
push str.bKGD
push esi
call fcn.005fd550
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.005b8641
add esp, 0xc
ret
Function at 0x6058f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x60596e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005b5280
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x605941
sub eax, ebx
jmp 0x605943
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x605932
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x605962
sub eax, ebx
jmp 0x605964
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x605953
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x6059c9
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.006055f0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x6059b5
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x6059c9
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x6058f6
pop esi
pop ebp
pop ebx
ret
Function at 0x10017e7
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1001c68
call fcn.01001994
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10033b0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100159e
cmp eax, esi
jne 0x1001591
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10015a1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001578
xor esi, esi
inc esi
mov eax, dword [0x10033ac]
cmp eax, esi
jne 0x10015b4
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10015e3
mov eax, dword [0x10033ac]
test eax, eax
jne 0x10015dd
mov dword [0x10033ac], esi
push 0x10010e4
push 0x10010d8
call fcn.010014dd
pop ecx
pop ecx
test eax, eax
je 0x10015e3
jmp 0x100170b
mov dword [0x1003074], esi
mov eax, dword [0x10033ac]
cmp eax, esi
jne 0x1001607
push 0x10010d4
push 0x10010cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10033ac], 2
test ebx, ebx
jne 0x1001613
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10033b4], 0
je 0x1001637
push 0x10033b4
call fcn.01001909
pop ecx
test eax, eax
je 0x1001637
push 0
push 2
push 0
call dword [0x10033b4]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1001693
test al, al
je 0x1001651
cmp dword [ebp - 0x1c], 0
jne 0x1001693
mov al, byte [esi]
test al, al
je 0x1001661
cmp al, 0x20
ja 0x1001661
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001651
test byte [ebp - 0x3c], 1
je 0x100166d
movzx eax, word [ebp - 0x38]
jmp 0x1001670
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1003070], eax
cmp dword [0x1003064], 0
jne 0x10016e7
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10016a2
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10016b5
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100163e
cmp dword [0x1003074], 0
jne 0x10016f6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003070]
jmp 0x1001717
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010019d9
ret
call fcn.01001ae1
jmp 0x100153e