joyce8/EMBER2024-capa huggingface dataset:
Function at 0x597dc0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xorps xmm0, xmm0
lea edi, [ebp - 0x2c]
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
lea eax, [ebp - 0x30]
mov dword [eax], 0x10
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movsd qword [esi], xmm0
mov dword [esi + 8], 0
test eax, eax
je 0x597e12
push esi
push dword [ebp - 0x30]
push edi
call fcn.00492ed0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebp
ret

Function at 0x59ba80
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x59baf9
mov edi, ecx
lea esi, [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov bl, 1
test eax, eax
jne 0x59bace
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 1
call fcn.004f2410
add esp, 4
test al, al
jne 0x59bafd
cmp ebx, 0x430
sete bl
cmp dword [esi], 0
je 0x59bae0
call fcn.004f2b80
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x59bae0
call fcn.005bd350
lea ecx, [ebp - 0xb0]
push eax
push 1
push 0x25f
push 0x6ca1ee
call fcn.005bd520
lea eax, [ebp - 0xa8]
push 0x15
push 0x6ca446
push eax
call fcn.004d1fe0
add esp, 0xc
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xbc]
mov ecx, edi
mov edi, eax
push eax
call fcn.0059b7b0
mov eax, edi
cmp byte [edi + 0xb], 0
jns 0x59bb54
mov eax, dword [ebp - 0xbc]
push eax
push dword [ebp - 0xc0]
call fcn.005bc3a0
add esp, 8
cmp byte [ebp - 0xb1], 0
jns 0x59bb7a
push dword [ebp - 0xbc]
call fcn.00540380
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.005bd580
jmp 0x59bac5
Function at 0x59c340
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x742040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx edx, byte [eax + 0x33]
test edx, edx
js 0x59c36d
lea ecx, [eax + 0x28]
jmp 0x59c373
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x28]
test edx, edx
cmove ecx, edx
mov edi, dword [eax + 0x1c]
xor edx, edx
cmp edi, dword [eax + 0x20]
cmove edi, edx
movsx esi, byte [eax + 0x1b]
test esi, esi
js 0x59c390
lea ebx, [eax + 0x10]
jmp 0x59c396
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0x10]
test esi, esi
cmove ebx, esi
push ecx
push edx
push edx
push edi
push edx
push edx
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
mov eax, dword [ebp - 0xc0]
push dword [eax + 0x98]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x59c3d1
push 1
call fcn.004f2410
add esp, 4
test al, al
jne 0x59c3ef
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005bd350
lea ecx, [ebp - 0xb0]
push eax
push 1
push 0x1a1
push 0x6ca1ee
call fcn.005bd520
lea eax, [ebp - 0xa8]
push 0x20
push 0x6ca3c0
push eax
call fcn.004d1fe0
add esp, 0xc
mov ebx, eax
lea esi, [ebp - 0xbc]
mov ecx, dword [ebp - 0xc0]
push esi
call fcn.0059b7b0
cmp byte [esi + 0xb], 0
jns 0x59c442
mov esi, dword [ebp - 0xbc]
push esi
push ebx
call fcn.005bc3a0
add esp, 8
cmp byte [ebp - 0xb1], 0
jns 0x59c463
push dword [ebp - 0xbc]
call fcn.00540380
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.005bd580
jmp 0x59c3d1
Function at 0x59c820
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x742040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [eax + 0x1c]
xor ecx, ecx
cmp ebx, dword [eax + 0x20]
cmove ebx, ecx
cmp byte [eax + 0x1b], 0
js 0x59c85d
lea ecx, [eax + 0x10]
jmp 0x59c860
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0xcc], ecx
cmp byte [eax + 0x33], 0
js 0x59c871
lea ecx, [eax + 0x28]
jmp 0x59c874
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xd8], ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0xd0], eax
lea edi, [ebp - 0xb4]
mov ecx, dword [ebp - 0xc4]
push edi
call fcn.0059b7b0
cmp byte [edi + 0xb], 0
jns 0x59c8b3
mov edi, dword [ebp - 0xb4]
xor esi, esi
push esi
push esi
push ebx
push esi
push esi
push dword [ebp - 0xcc]
push dword [ebp - 0xd4]
push dword [ebp - 0xd0]
push dword [ebp - 0xd8]
push 0x10003
push dword [ebp - 0xc8]
push edi
mov eax, dword [ebp - 0xc4]
push dword [eax + 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x14]
mov dword [ecx], esi
push eax
call fcn.00591070
cmp byte [ebp - 0xa9], 0
jns 0x59c912
push dword [ebp - 0xb4]
call fcn.00540380
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x59c959
push 1
call fcn.004f2410
add esp, 4
test al, al
jne 0x59c97b
cmp dword [ebp - 0x14], 0
je 0x59c93b
call fcn.004f2b80
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebp - 0xc4]
add esi, 0x98
mov dword [ebp - 0x14], 0
call fcn.004f2b80
mov ecx, esi
push ebx
call fcn.00591070
jmp 0x59c927
call fcn.005bd350
lea ecx, [ebp - 0xb4]
push eax
push 1
push 0x250
push 0x6ca1ee
call fcn.005bd520
lea eax, [ebp - 0xac]
push 0x19
push 0x6ca42c
push eax
call fcn.004d1fe0
add esp, 0xc
mov edi, eax
lea esi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc4]
push esi
call fcn.0059b7b0
cmp byte [esi + 0xb], 0
jns 0x59c9ce
mov esi, dword [ebp - 0xc0]
push esi
push edi
call fcn.005bc3a0
add esp, 8
cmp byte [ebp - 0xb5], 0
jns 0x59c9ef
push dword [ebp - 0xc0]
call fcn.00540380
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.005bd580
jmp 0x59c927
Function at 0x59dce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
mov esi, ecx
cmp ebx, dword [ecx + 4]
je 0x59dd4f
xor edi, edi
jmp 0x59dd30
mov edx, ebx
cmove edx, edi
push eax
push ecx
push dword [ebx + 0x18]
push 0
push edx
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x59ddea
add ebx, 0x1c
cmp ebx, dword [esi + 4]
mov edi, 0
je 0x59dd4f
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
sub eax, ecx
cmove ecx, edi
cmp byte [ebx + 0xb], 0
jns 0x59dd03
cmp dword [ebx + 4], 0
je 0x59dd4b
mov edx, dword [ebx]
jmp 0x59dd08
xor edx, edx
jmp 0x59dd08
xor eax, eax
dec eax
lea ecx, [ebp - 0xb8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.00486b40
mov edi, dword [esi + 0xc]
add esi, 0x10
mov bl, 1
mov dword [ebp - 0xc0], esi
cmp edi, esi
jne 0x59dd94
jmp 0x59dec5
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x59dd7c
mov edi, eax
cmp eax, dword [ebp - 0xc0]
mov bl, 1
je 0x59dec5
lea ecx, [edi + 0x10]
cmp byte [edi + 0x1b], 0
mov eax, ecx
jns 0x59dda1
mov eax, dword [ecx]
mov dword [ebp - 0xbc], ecx
lea esi, [ebp - 0xb8]
mov ecx, esi
push 0x20006
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00486c10
test eax, eax
jne 0x59de56
lea ecx, [edi + 0x1c]
push esi
call fcn.0059dce0
test al, al
je 0x59dee9
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x59dd7c
mov eax, dword [edi + 8]
cmp dword [eax], edi
mov edi, eax
jne 0x59dddf
jmp 0x59dd84
mov edi, eax
push 2
call fcn.004f2410
add esp, 4
test al, al
je 0x59de52
lea esi, [ebp - 0xac]
mov ecx, esi
push 2
push 0xf5
push 0x6ca53b
call fcn.00494bc0
lea eax, [ebp - 0xa4]
push 0x16
push 0x6ca640
push eax
call fcn.004d1fe0
add esp, 0xc
push ebx
push eax
call fcn.00492f60
add esp, 8
push 0xb
push 0x6ca657
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, eax
push edi
call fcn.004120f0
mov ecx, esi
call fcn.004950a0
xor ebx, ebx
jmp 0x59ded0
mov ebx, eax
push 2
call fcn.004f2410
add esp, 4
test al, al
je 0x59dec3
lea edi, [ebp - 0xac]
mov ecx, edi
push 2
push 0x103
push 0x6ca53b
call fcn.00494bc0
lea eax, [ebp - 0xa4]
push 0x18
push 0x6ca663
push eax
call fcn.004d1fe0
add esp, 0xc
push dword [ebp - 0xbc]
push eax
call fcn.00492f60
add esp, 8
push 0xb
push 0x6ca657
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, eax
push ebx
call fcn.004120f0
mov ecx, edi
call fcn.004950a0
xor ebx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00486d30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 2
call fcn.004f2410
add esp, 4
test al, al
je 0x59dec3
lea edi, [ebp - 0xac]
mov ecx, edi
push 2
push 0x108
push 0x6ca53b
call fcn.00494bc0
lea eax, [ebp - 0xa4]
push 0x17
push 0x6ca67c
push eax
call fcn.004d1fe0
add esp, 0xc
push dword [ebp - 0xbc]
push eax
call fcn.00492f60
add esp, 8
push 0xb
push 0x6ca657
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, eax
push 0
jmp 0x59deb7
Function at 0x5b94d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 1
je 0x5b94f2
mov eax, dword [esi]
jmp 0x5b94f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x5b953e
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x5b9528
cmp byte [esi + 4], 1
je 0x5b9516
mov eax, dword [esi]
jmp 0x5b951c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 1
je 0x5b954e
mov eax, dword [esi]
jmp 0x5b9554
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5b9568
xor ebx, ebx
jmp 0x5b9528
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 1
je 0x5b9579
mov eax, dword [esi]
jmp 0x5b957f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
jmp 0x5b9528

Function at 0x5b96a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.00544260
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
jne 0x5b96d9
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x5b96e2
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
Function at 0x5b9760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xb
mov eax, dword [0x6cf494]
mov al, byte [eax + 0xb]
test al, al
jne 0x5b998f
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.00497bf0
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x5b984d
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.004f2fc0
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.005bf050
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x6c8778
cmp byte [esp + 0xa3], 0
js 0x5b9863
lea ecx, [esp + 0x98]
jmp 0x5b986a
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.004e3c10
jmp 0x5b97e7
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x5b9886
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5b990b
cmp byte [ebp + 0xc], 0
je 0x5b9904
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9e
push 0x6d19ac
push 0x6d19de
push esi
call fcn.004f2b50
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.004e8e00
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.004e8e70
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.00488ab0
cmp byte [esp + 0x97], 0
jns 0x5b992c
push dword [esp + 0x8c]
call fcn.00540380
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x5b9945
push dword [esp + 0x98]
call fcn.00540380
add esp, 4
mov dword [esp + 0x20], 0xb
mov eax, dword [0x6cf494]
mov al, byte [eax + 0xb]
test al, al
jne 0x5b9971
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.005412b6
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.004df8b0
add esp, 0x10
jmp 0x5b9959
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], 0x6d19de
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004df8b0
add esp, 0x10
jmp 0x5b979b
Function at 0x5ba8a0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x8d
push 0x6d1c40
push 0x6d1e03
push edi
call fcn.004f2b50
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.004e8e00
mov ecx, esi
call fcn.004f5380
test al, al
jne 0x5ba924
mov esi, dword [esp]
mov ecx, esi
call fcn.004f5380
test al, al
jne 0x5ba924
cmp byte [edi + 0xb], 0
jns 0x5ba951
cmp dword [edi + 4], 0x103
jbe 0x5ba951
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.004a8dd0
jmp 0x5ba926
cmp byte [esi + 0xb], 0
jns 0x5ba960
cmp dword [esi + 4], 0x103
ja 0x5ba924
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0x9a
push 0x6d1c40
push 0x6d1e03
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x748b18
push ebx
call fcn.004a8cc0
cmp byte [esi + 0xb], 0
jns 0x5ba99f
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x5ba9ab
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x5ba944
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x5ba946
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x5ba946

Function at 0x5bb180
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004f5380
test al, al
jne 0x5bb19e
mov ecx, esi
call fcn.004f5380
test al, al
je 0x5bb1a3
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.005ba9f0
Function at 0x5bce50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x748bac], 0
je 0x5bce88
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x748bb0]
test esi, esi
je 0x5bcf22
test byte [0x7441b4], 1
je 0x5bce71
cmp byte [esi + 0xb], 0
jns 0x5bcea7
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x6d25f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x748bac], eax
inc eax
cmp eax, 1
ja 0x5bce71
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.00544260
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x5bcfbb
xor ebx, ebx
jmp 0x5bce71
push 0xc
call fcn.00540349
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00544260
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.004de950
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x5bcf77
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x5bcf94
mov ecx, esi
push 9
push 0x6d26e4
call fcn.004e3cf0
mov dword [0x748bb0], esi
jmp 0x5bce96
add eax, eax
test eax, eax
je 0x5bcf7b
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x5bcf96
cmp edx, 0xfffffffe
je 0x5bcf7b
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.004decf0
jmp 0x5bcf7b
mov ecx, dword [0x748bb0]
push esi
call fcn.00484ea0
mov ecx, dword [0x748bb0]
call fcn.005b3710
cmp word [eax], 0x5c
je 0x5bcfea
mov ecx, dword [0x748bb0]
push 1
push 0x6c1930
call fcn.004e3cf0
mov ecx, dword [0x748bb0]
push 9
push 0x6d26e4
call fcn.004e3cf0
mov eax, dword [0x748bb0]
cmp byte [eax + 0xb], 0
jns 0x5bd009
mov eax, dword [eax]
movaps xmm0, xmmword [0x6d25f0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x748bac], eax
inc eax
cmp eax, 1
ja 0x5bce71
mov dword [0x748bac], 0
jmp 0x5bcf1b
Function at 0x5c1920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x5c1946
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x5c193e
cmp esi, edi
jge 0x5c1956
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x5c194e
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x5c1975
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x5c1968
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5c5870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x5c5986
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor esi, esi
xor eax, eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov ecx, edx
shl ecx, 0x10
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0x24], ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, ecx
xor eax, edx
mov esi, eax
shl esi, 0x18
mov ecx, esi
dec esi
not ecx
and esi, ecx
mov ecx, eax
shr ecx, 8
sar esi, 0x1f
mov dword [ebp - 0x20], esi
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, ecx
shl eax, 0x1c
mov esi, eax
not esi
dec eax
and eax, esi
sar eax, 0x1f
mov edi, ecx
shr edi, 4
mov esi, eax
xor edi, ecx
and edi, eax
xor edi, ecx
mov ecx, edi
shl ecx, 0x1e
mov eax, ecx
dec ecx
not eax
and ecx, eax
mov eax, edi
shr eax, 2
sar ecx, 0x1f
mov ebx, ecx
xor eax, edi
and eax, ecx
lea ecx, [edx - 1]
not edx
and ecx, edx
xor eax, edi
shl eax, 0x1f
mov edx, eax
not edx
dec eax
and eax, edx
mov edx, dword [ebp - 0x24]
and edx, 0x10
shr eax, 0x1f
or eax, edx
mov edx, dword [ebp - 0x20]
and edx, 8
or eax, edx
and esi, 4
or eax, esi
mov esi, dword [ebp - 0x28]
sar ecx, 0x1f
and ebx, 2
or eax, ebx
mov edx, ecx
not edx
mov edi, dword [ebp - 0x1c]
or ecx, edi
or edx, edi
add eax, esi
not ecx
and ecx, eax
mov eax, dword [ebp - 0x2c]
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x10]
add esi, 0x20
mov edi, edx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jne 0x5c5897
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5c597e