joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, str.Continue_
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e460]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e408]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40e45c]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e49c]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e484]
jmp loc.00415000

Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4
Function at 0x574916
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x57492c
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x574938
or edi, 2
push 1
call esi
test ax, ax
jns 0x574944
or edi, 1
push 0x10
call esi
test ax, ax
jns 0x574950
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x57495c
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x574a86
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005a7500
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005a6e47
leave
ret
Function at 0x574b1a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
mov esi, 0x1000
mov ecx, eax
and ecx, 3
mov cl, byte [ecx + 0x5eb7f0]
xor byte [eax + 0x5eb7f0], cl
inc eax
cmp eax, esi
jb 0x574b35
push 0xe
pop eax
mov dword [ebp - 0x14], 0x1a6e1c75
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], al
mov dword [ebp - 0xe], 0x2f403262
mov dword [ebp - 0xa], 0x295d3e5b
mov byte [ebp - 6], 0x29
mov cl, byte [ebp + eax - 0x15]
xor byte [ebp + eax - 0x14], cl
dec eax
test eax, eax
jg 0x574b6e
xor byte [ebp - 0x14], 0x23
lea eax, [ebp - 0x14]
push eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
push 0x40
push esi
mov ebx, 0x5eb7f4
push ebx
call eax
push 4
pop eax
mov ecx, eax
and ecx, 3
mov cl, byte [ecx + 0x5ec7f0]
xor byte [eax + 0x5ec7f0], cl
inc eax
cmp eax, 0x800
jb 0x574bab
mov esi, 0x1fbd0
push esi
mov dword [ebp - 0x20], 0x5ec7f4
call fcn.005a6cca
push esi
push section..text
push eax
mov dword [ebp - 0x1c], eax
call fcn.005a8620
add esp, 0x10
push 4
pop ecx
mov edi, dword [ebp - 0x1c]
mov edx, ecx
and edx, 3
mov dl, byte [edx + edi]
lea eax, [ecx + edi]
xor byte [eax], dl
inc ecx
cmp ecx, esi
jl 0x574beb
add dword [ebp - 0x1c], 4
mov esi, 0x13d620
push esi
call fcn.005a6cca
push esi
push 0x420bd7
push eax
mov dword [ebp - 0x18], eax
call fcn.005a8620
add esp, 0x10
push 4
pop ecx
mov edi, dword [ebp - 0x18]
mov edx, ecx
and edx, 3
mov dl, byte [edx + edi]
lea eax, [ecx + edi]
xor byte [eax], dl
inc ecx
cmp ecx, esi
jl 0x574c24
add dword [ebp - 0x18], 4
lea eax, [ebp - 0x20]
push eax
call ebx
pop edi
pop esi
pop ebx
test eax, eax
jne 0x574c51
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor ecx, ebp
mov dword [sym.GameDemo_u.exe_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance], eax
call fcn.005a6e47
leave
ret
Function at 0x579074
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
je 0x5790af
mov ecx, dword [esi + 0x84]
cmp eax, ecx
je 0x5790af
cmp ebx, dword [esi + 0xe8]
je 0x5790af
cmp byte [esi + 0xe0], 0
jne 0x5790af
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0xe8]
cmp ebx, eax
je 0x57918a
push edi
test eax, eax
je 0x579110
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xe8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x11c]
push 1
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0xe8]
mov ecx, esi
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
mov dword [esi + 0xe8], edi
test ebx, ebx
je 0x579189
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, esi
jne 0x579189
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xdc]
test al, al
je 0x579189
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xe8]
test al, al
je 0x579189
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0xe8], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xe8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x11c]
push 1
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0xe8]
mov ecx, esi
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x58af38
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x58afc6
cmp dword [esi + 0x10], ebx
je 0x58afc6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005a9110
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x58afc6
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1e4
call fcn.00573dbd
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 1
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call sym.GameDemo_u.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::IsLayered_void_
test al, al
je 0x58afc6
mov ecx, dword [esi + 0x10]
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CControlUI::Invalidate_void_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6e47
leave
ret 0x10

Function at 0x58b39a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
movsd dword es:[edi], dword [esi]
call sym.GameDemo_u.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [ebx + 0x6d8]
test ecx, ecx
je 0x58b41e
lea eax, [ebp - 0x14]
push eax
call fcn.0058ad81
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6d8]
test eax, eax
je 0x58b3fa
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x58b41e
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6e47
leave
ret 0x14
Function at 0x58b42f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.GameDemo_u.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::Move_struct_tagSIZE__bool_
mov ecx, dword [esi + 0x6d8]
test ecx, ecx
je 0x58b4ab
lea eax, [ebp - 0x14]
push eax
call fcn.0058ad81
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6d8]
test eax, eax
je 0x58b487
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x58b4ab
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005a6e47
leave
ret 0xc

Function at 0x58fdec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x694], ebx
je 0x58fe56
cmp dword [ebp + 8], 0x100
jne 0x58fe45
cmp word [ebp + 0xc], 0xd
jne 0x58fe45
cmp byte [esi + 0x69a], bl
je 0x58fe2a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x58fe45
cmp byte [esi + 0x69b], bl
jne 0x58fe45
mov ecx, dword [esi + 0x5c]
cmp ecx, ebx
je 0x58fe41
push 1
push ebx
push ebx
push ebx
push str.return
push esi
call sym.GameDemo_u.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
xor eax, eax
jmp 0x58fe59
mov eax, dword [esi + 0x694]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x591e5c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
movsd dword es:[edi], dword [esi]
call sym.GameDemo_u.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [ebx + 0x6f0]
test ecx, ecx
je 0x591ee0
lea eax, [ebp - 0x14]
push eax
call fcn.00591c54
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6f0]
test eax, eax
je 0x591ebc
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x591ee0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6e47
leave
ret 0x14

Function at 0x591ef1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.GameDemo_u.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::Move_struct_tagSIZE__bool_
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x591f6d
lea eax, [ebp - 0x14]
push eax
call fcn.00591c54
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6f0]
test eax, eax
je 0x591f49
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x591f6d
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.GameDemo_u.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005a6e47
leave
ret 0xc
Function at 0x5994f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x599505
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x5995c0
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5c41a0]
add edx, 8
sub edi, 8
dec esi
jne 0x599523
pop ebx
test edi, edi
je 0x5995d9
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x5c41a0]
inc edx
dec edi
jne 0x5995c4
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x599a86
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x599aba
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x599ab5
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x599ae2
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x599acb
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.005a8620
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x59a904
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x59a9ac
movzx ecx, word [esi]
test cx, cx
je 0x59a9ac
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x59a93f
cmp cx, 0x5c
jne 0x59a941
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x59a933
cmp eax, esi
je 0x59a980
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.005a9027
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0059a904
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005a9006
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005a8fd5
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6e47
leave
ret
Function at 0x59bed9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x59bf54
cmp dword [esi + 4], 0xffffffff
jne 0x59bf54
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x5c479c
push edi
call fcn.005a8fd5
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x59bf26
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x59bf26
mov eax, 0x2000000
jmp 0x59bf59
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00599893
add esp, 0x10
test eax, eax
jne 0x59bf44
mov eax, dword [ebp + 0x10]
jmp 0x59bf59
push eax
call fcn.0059bac8
mov dword [esi], eax
mov eax, dword [0x5ef684]
pop ecx
jmp 0x59bf59
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x5a0c0b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x5a0c30
cmp eax, esi
jge 0x5a0c28
mov eax, edi
call fcn.005a068e
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor ecx, ecx
test esi, esi
jle 0x5a0c5d
mov eax, dword [edi + 0xc]
push ebx
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, esi
inc ecx
mov dword [edi + 0xc], eax
test ebx, ebx
jg 0x5a0c3d
mov dword [edi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x5a0c79
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x5a0c6a
xor dl, dl
jmp 0x5a0c6f
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x5a0c60
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x5a0cab
mov eax, str.zlib_corrupt
call fcn.0059c3f5
jmp 0x5a0ce7
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x5a0cbb
mov eax, str.read_past_buffer
jmp 0x5a0ca4
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x5a0cd1
push esi
call fcn.005a076b
pop ecx
test eax, eax
je 0x5a0ce7
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.005a8620
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x5a6e47
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ed758]
jne 0x5a6e51
repz ret
jmp fcn.005ab98d
Function at 0x5b2bd7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ed758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005ac7ca
and dword [ebp - 0x14], 0
cmp dword [0x5f0488], 0
mov dword [ebp - 0x18], eax
jne 0x5b2c8a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5b2d32
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ca20c
push ebx
call edi
test eax, eax
je 0x5b2d32
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5ca1fc
push ebx
mov dword [0x5f0488], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5f048c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5f0490], eax
call edi
push eax
call esi
mov dword [0x5f0498], eax
test eax, eax
je 0x5b2c8a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5f0494], eax
mov eax, dword [0x5f0494]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5b2ce3
cmp dword [0x5f0498], ecx
je 0x5b2ce3
push eax
call esi
push dword [0x5f0498]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5b2ce3
test ebx, ebx
je 0x5b2ce3
call edi
test eax, eax
je 0x5b2cda
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5b2cda
test byte [ebp - 8], 1
jne 0x5b2ce3
or dword [ebp + 0x10], 0x200000
jmp 0x5b2d16
mov eax, dword [0x5f048c]
cmp eax, dword [ebp - 0x18]
je 0x5b2d16
push eax
call esi
test eax, eax
je 0x5b2d16
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5b2d16
mov eax, dword [0x5f0490]
cmp eax, dword [ebp - 0x18]
je 0x5b2d16
push eax
call esi
test eax, eax
je 0x5b2d16
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5f0488]
call esi
test eax, eax
je 0x5b2d32
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5b2d34
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6e47
leave
ret