joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6060a2
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x710544]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push esi
mov esi, dword [esp + 0x224]
mov ebx, ecx
push edi
push eax
xor edi, edi
mov dword [esp + 0x14], ebx
push edi
push edi
push edx
push edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi], eax
test eax, eax
jne 0x6060ec
inc edi
jmp 0x6060f9
push eax
push str.SHGetFolderPath_returned_error_:__d
call fcn.00609aff
pop ecx
pop ecx
lea eax, [esp + 0x14]
mov dword [ebp], edi
push eax
mov ecx, ebx
call fcn.0045290e
mov ecx, dword [esp + 0x21c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507778
add esp, 0x210
ret

Function at 0x606218
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 0xc], 0xc
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x24], 4
lea ebp, [ebx + 0x40]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
jne 0x60627c
mov esi, dword [ebx + 0x3c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x606242
sub esi, ecx
mov ecx, ebp
sar esi, 1
add esi, 6
mov edx, esi
call fcn.006083a4
push dword [ebx + 0x3c]
push esi
push dword [ebp]
call fcn.0051a02d
push str..tmp
push esi
push dword [ebp]
call fcn.005205fb
add esp, 0x18
jmp 0x6062da
push 0xff
push 1
call fcn.00518b71
pop ecx
pop ecx
mov ebx, eax
push 0xfe
push ebx
push str.TEMP
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x6062a4
sub ebx, ecx
sar ebx, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebx + 0x14]
mov ecx, ebp
mov esi, eax
call fcn.006083a4
push esi
push dword [esp + 0x14]
push str._sdc_d.tmp
push dword [ebp]
call fcn.00458d6e
add esp, 0x10
push edi
push 0x80
push 2
lea eax, [esp + 0x20]
push eax
push 1
push 0x40000000
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x60631e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.InternetGetRequestEx_:_Error_occured_while_creating_the_file______d
call fcn.00609c05
push edi
push str.printErrorMsgForID:_Errorcode:__d
call fcn.00609c05
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x606373
Capabilities:
Set http header

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
je 0x6063a6
push 0x20000000
push 0xffffffffffffffff
push dword [esp + 0x14]
push dword [ecx + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x6063a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.00607cdc
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x606fcb
Capabilities:
Check http status code
Read http header

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x10]
push edi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
push ebp
push ebp
push 0x16
push dword [ebx + 0x80]
mov edi, ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.006083a4
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push ebp
push 0x16
push dword [ebx + 0x80]
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x60703b
call ebp
mov edi, eax
push edi
push 0x6bb910
call fcn.00609c05
pop ecx
pop ecx
push edi
call fcn.00607cdc
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 4
push ecx
lea eax, [ebx + 8]
push eax
push 0
push 0x20000013
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x607078
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:_WinHttpQueryHeaders_failed_with_the_error_code_while_getting_http_status_code__d
call fcn.00609c05
pop ecx
pop ecx
push edi
call fcn.00607cdc
push dword [ebx + 8]
push str.DCGetResponseStatusCode_:_Status_code_:__d
call fcn.00609c05
cmp dword [ebx + 8], 0xc8
pop ecx
pop ecx
jne 0x607131
xor ecx, ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebx + 0x80]
mov dword [esp + 0x2c], ecx
call esi
mov edx, dword [esp + 0x14]
lea ecx, [ebx + 0x5c]
call fcn.006083a4
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x14]
push 0
push eax
push dword [ebx + 0x5c]
push 0
push 1
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x6070ef
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:__Error_in_WinHttpQueryHeaders______d
call fcn.00609c05
pop ecx
pop ecx
push edi
call fcn.00607cdc
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [ebx + 0x4c]
push eax
push 0
push 0x20000005
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x60712c
call ebp
mov edi, eax
push edi
push 0x6bbba0
call fcn.00609c05
pop ecx
pop ecx
push edi
call fcn.00607cdc
and dword [esp + 0x14], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x607142
Capabilities:
Prepare http request

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
je 0x60715d
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and dword [esi + 0x80], 0
mov ecx, esi
pop esi
jmp fcn.0060753d
Function at 0x607165
Capabilities:
Receive http response

Disassembly:
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov esi, eax
mov ebx, eax
cmp ebx, 5
jge 0x60729a
cmp dword [edi + 0x24], 2
je 0x607197
cmp dword [edi + 0x24], 4
je 0x607197
cmp dword [edi + 0x24], 1
je 0x607197
push eax
push dword [edi + 0x44]
push dword [edi + 0x44]
push dword [edi + 0x38]
jmp 0x60719b
push eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x60721f
push 0
push dword [edi + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x60729a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2f00
jne 0x6071f1
push dword [edi + 0x28]
push str.InternetSendRequestEx_:_Resending_the_data_to_the_server__s
call fcn.00609c05
pop ecx
pop ecx
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x607219
cmp esi, 0x2eef
je 0x607201
cmp esi, 0x2f78
jne 0x607259
push esi
push dword [edi + 0x28]
push str.InternetSendRequestEx_:_Going_to_close_the_request_handle_and_going_to_resending_the_data_to_the_server__S_as_the_error_code_received_is__d
call fcn.00609c05
xor eax, eax
add esp, 0xc
cmp dword [edi + 0x48], eax
je 0x607261
inc ebx
jmp 0x607170
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2eef
je 0x607237
cmp esi, 0x2ef1
jne 0x60726a
push dword [edi + 0x28]
push str.InternetSendRequestEx_:_Going_to_close_the_request_handle_and_going_to_resending_the_data_to_the_server__s
call fcn.00609c05
xor eax, eax
pop ecx
pop ecx
cmp dword [edi + 0x48], eax
jne 0x607287
mov dword [edi + 0x48], 1
jmp 0x60716e
push esi
push str.InternetSendRequestEx_:__Error___WinHttpReceiveResponse______d
jmp 0x60728d
mov dword [edi + 0x48], 1
jmp 0x60729a
mov ebx, 0x2f8f
cmp esi, ebx
jne 0x607287
push ebx
push dword [edi + 0x28]
push str.InternetSendRequestEx_:_ERROR_WINHTTP_SECURE_FAILURE_:_Secure_data_decode_warning_:__s___LastError____d
call fcn.00609c05
add esp, 0xc
push ebx
jmp 0x607295
push esi
push str.InternetSendRequestEx_:__Error_in_WinHttpSendRequest_____d
call fcn.00609c05
pop ecx
pop ecx
push esi
call fcn.00607cdc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x607426
Capabilities:
Set http header

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov ebp, ecx
push edi
xor ebx, ebx
mov edi, 0x20000000
push edi
cmp dword [ebp + 4], ebx
mov ecx, str.Connection:_Keep_Alive
push 0xffffffffffffffff
mov eax, str.Connection:_close
mov dword [esp + 0x18], ebx
cmovne eax, ecx
push eax
push dword [ebp + 0x80]
call esi
test eax, eax
jne 0x607471
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.DCInitializeHTTPHeaders_:__Error_in_WinHttpAddRequestHeaders______d
jmp 0x607521
cmp dword [ebp + 0x24], 5
jne 0x6074a3
push edi
push 0xffffffffffffffff
push str.Content_Type:_multipart_form_data
push dword [ebp + 0x80]
call esi
test eax, eax
jne 0x6074a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.DCInitializeHTTPHeaders_:__Error_in_WinHttpAddRequestHeaders______d__n
call fcn.00609aff
jmp 0x607526
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x60752e
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x6074b1
sub esi, ecx
lea ecx, [esp + 0x10]
sar esi, 1
add esi, 0x15
mov edx, esi
call fcn.006083a4
mov edi, dword [esp + 0x10]
push str.If_Modified_Since:
push esi
push edi
call fcn.0051a02d
add esp, 0xc
push dword [ebp + 0x10]
push esi
push edi
call fcn.005205fb
add esp, 0xc
push edi
push str.DCInitializeHTTPHeaders_:__s
call fcn.00609c05
pop ecx
pop ecx
push 0x20000000
push 0xffffffffffffffff
push edi
push dword [ebp + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x60752e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.DCInitializeHTTPHeaders_:__Error_in_IF_MODIFIED_SINCE_WinHttpAddRequestHeaders______d
call fcn.00609c05
pop ecx
pop ecx
push ebx
call fcn.00607cdc
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x60753d
Capabilities:
Prepare http request

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
xor edx, edx
mov esi, edx
mov ecx, 0x6b71b4
mov eax, dword [edi + 0x24]
cmp eax, 2
je 0x607586
cmp eax, 4
je 0x607586
cmp eax, 1
je 0x60757f
cmp eax, 6
je 0x60757f
cmp eax, 3
jne 0x60756e
mov ecx, 0x6b73bc
jmp 0x60758b
cmp eax, 7
jne 0x60757a
mov ecx, 0x6b8324
jmp 0x60758b
push 0xd
pop esi
jmp 0x60758b
mov ecx, 0x6b749c
jmp 0x60758b
mov ecx, 0x6b86e4
mov eax, dword [edi + 0x20]
cmp dword [edi + 0x30], edx
je 0x60759b
or eax, 0x800000
mov dword [edi + 0x20], eax
push eax
push edx
push edx
push edx
push dword [edi + 0x34]
push ecx
push dword [edi + 0x84]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x80], eax
test eax, eax
jne 0x6075d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.DCInitializeHTTPRequest_:__Error_in_WinHttpOpenRequest______d
call fcn.00609c05
pop ecx
pop ecx
push esi
call fcn.00607cdc
jmp 0x6075ff
mov ecx, edi
call fcn.0060738d
test eax, eax
jne 0x6075f7
mov ecx, edi
call fcn.00607426
test eax, eax
jne 0x6075f7
mov ecx, edi
call fcn.006072a7
test eax, eax
je 0x6075ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x60760c
Capabilities:
Initialize winhttp library

Disassembly:
push 8
mov eax, 0x616fe1
call fcn.00508068
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x54], esi
je 0x607645
cmp dword [edi + 0x64], esi
je 0x607645
cmp dword [edi + 0x68], esi
je 0x607645
push dword [edi + 0x64]
push str.DCInitializeHTTPSession_:_Proxy_Server_Name_:__s
call fcn.00609c05
pop ecx
pop ecx
push esi
push dword [edi + 0x68]
push dword [edi + 0x64]
push 3
jmp 0x60764a
push esi
push esi
push esi
push 1
push dword [0x724a28]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [edi + 0x7c], eax
cmp eax, esi
je 0x607713
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x800
push eax
push 0x54
push dword [edi + 0x7c]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x607691
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitializeHTTPSession_::_WinHttpSetOption_WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2____Failed_with_error___d
call fcn.00609b90
pop ecx
jmp 0x60769b
push str.InitializeHTTPSession_::_WinHttpSetOption_WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2____Succeeded
call fcn.00609b90
pop ecx
push dword [edi + 0x28]
lea ecx, [ebp - 0x10]
call fcn.0045290e
push esi
push 0x6baed0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004527c8
test eax, eax
je 0x6076cf
push dword [edi + 0x2c]
push dword [edi + 0x28]
push str.Server_Name__s___Server_Port__d
call fcn.00609c05
add esp, 0xc
movzx eax, word [edi + 0x2c]
push esi
push eax
push dword [edi + 0x28]
push dword [edi + 0x7c]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0x84], eax
test eax, eax
jne 0x607706
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.DCInitializeHTTPSession_:__Error_in_WinHttpConnect______d
call fcn.00609c05
pop ecx
pop ecx
push esi
call fcn.00607cdc
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00452239
jmp 0x60772e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.DCInitializeHTTPSession_:__Error_in_WinHttpOpen______d
call fcn.00609c05
pop ecx
pop ecx
push esi
call fcn.00607cdc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
call fcn.00508031
ret
Function at 0x608326
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push ecx
mov dword [esp + 0x28], edi
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
test ebp, ebp
je 0x60837e
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 1
call fcn.00518b71
pop ecx
pop ecx
push edi
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
jne 0x608386
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
lea ecx, [esp + 0x14]
call fcn.004528ca
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x6094e7
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x10
mov eax, 0x6172fb
call fcn.00508068
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1c
pop edx
lea ecx, [ebp - 0x10]
call fcn.006060a2
pop ecx
pop ecx
push 0x1a
xor ebx, ebx
lea ecx, [ebp - 0x10]
push str.VirtualStoreProgramData_
mov dword [ebp - 4], ebx
call fcn.004531cd
lea eax, [ebp - 0x14]
push eax
call fcn.005fcfe4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004531cd
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00452239
push 5
push str.log_
lea ecx, [ebp - 0x10]
call fcn.004531cd
mov eax, dword [0x724a38]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004531cd
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x6095fc
mov eax, dword [0x724a34]
add eax, 0xfffffff0
push eax
call fcn.00452eea
add eax, 0x10
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [0x724a38]
push dword [eax - 0xc]
push eax
call fcn.004531cd
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00452eea
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x18], esi
mov eax, dword [0x724a38]
add eax, 0xfffffff0
push eax
call fcn.00452eea
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.00604dad
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
inc ebx
add ecx, 0xfffffff0
call fcn.00452239
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00452239
mov eax, ebx
call fcn.00508031
ret
Function at 0x60a453
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [edx]
push ebx
mov ebx, ecx
test ax, ax
je 0x60a50b
push esi
push edi
mov edi, edx
mov ecx, edx
mov esi, eax
cmp si, 0x2f
je 0x60a489
cmp si, 0x5c
jne 0x60a48b
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x60a47d
cmp edi, edx
je 0x60a4d6
mov esi, edi
lea eax, [ebp - 0x20c]
sub esi, edx
and esi, 0xfffffffe
push esi
push edx
push eax
call fcn.0050be00
add esp, 0xc
cmp esi, 0x208
jae 0x60a518
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.0060a453
add edi, 2
push ebx
mov esi, 0x104
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0051a02d
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005205fb
add esp, 0x18
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00507778
leave
ret
call fcn.00507b37
int3

Function at 0x60a96b
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jne 0x60aa04
cmp dword [esi + 4], 0xffffffff
jne 0x60aa04
push ebp
push edi
lea edi, [esi + 0x240]
mov ebp, 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x60a99e
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x23e]
cmp eax, 0x5c
je 0x60a9ce
cmp eax, 0x2f
je 0x60a9ce
push 0x6c7d54
push ebp
push edi
call fcn.005205fb
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0060b739
pop ecx
pop ecx
pop edi
pop ebp
test eax, eax
jne 0x60a9eb
mov eax, dword [esp + 8]
jmp 0x60aa09
mov ecx, eax
call fcn.0060b2bb
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x60aa09
mov eax, 0x1000000
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x60acfb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x60ae48
xor ebp, ebp
cmp dword [edi + 0x18], ebp
je 0x60ae48
cmp dword [edi + 0x7c], ebp
je 0x60ad23
call fcn.0060aaa4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
call fcn.0060ae53
pop ecx
pop ecx
test eax, eax
je 0x60ad45
push 0xffffffffffffff99
jmp 0x60ae4a
push 0x84
call fcn.0051a7b4
mov esi, eax
pop ecx
test esi, esi
jne 0x60ad5d
push 0xffffffffffffff98
jmp 0x60ae4a
push 0x4000
call fcn.0051a7b4
mov dword [esi], eax
mov dword [esi + 0x4c], ebp
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x48], ecx
test eax, eax
jne 0x60ad88
push esi
call fcn.00518583
pop ecx
jmp 0x60ad56
mov dword [esi + 0x40], ebp
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ebp
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], ebp
test ecx, ecx
je 0x60adcb
lea ecx, [esi + 4]
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
call fcn.0060bb02
test eax, eax
jne 0x60adcb
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x60adee
mov al, byte [edi + 0x39]
jmp 0x60adf1
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
xor eax, eax
cmp byte [esi + 0x6c], al
push 0xc
pop ecx
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x60ae31
mov dl, byte [ebx]
test dl, dl
je 0x60ae31
lea ecx, [esi + 0x70]
call fcn.0060bd7c
add ebx, 1
jne 0x60ae1e
mov eax, dword [esp + 0x18]
add eax, 0x1e
add eax, dword [edi + 0x78]
and dword [esi + 8], ebp
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x7c], esi
jmp 0x60ae4b
push 0xffffffffffffff9a
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x60b604
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov ebp, ecx
mov ecx, ebx
imul ecx, dword [esp + 0x10]
cmp byte [edi], 0
je 0x60b63b
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push ebp
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x60b635
mov byte [edi + 8], 1
mov eax, dword [esp + 0x10]
jmp 0x60b663
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push ebp
call fcn.0050be00
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
pop edi
xor edx, edx
pop ebp
div ebx
pop ebx
ret
Function at 0x60bd7c
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x6c8460]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x60bdc3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x60bdca
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x60be87
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
sub edi, 1
jne 0x60bde0
pop edi
test esi, esi
je 0x60bea3
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c8460]
inc edx
sub esi, 1
jne 0x60be8b
not ecx
mov eax, ecx
pop esi
ret
Function at 0x1191370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x119138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x11ba074
push ecx
mov edi, eax
call fcn.011a5198
mov esi, eax
add esp, 8
test esi, esi
jne 0x11913cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.011a502e
push esi
call fcn.011a4fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret