joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547c60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x5797b0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], 0x579780
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
call fcn.0041eab0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00422420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00423070
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00423390
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x423002
mov edx, dword [ebp - 0x10]
add edx, 0x34
mov dword [ebp - 0x14], edx
jmp 0x423009
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
call fcn.004041f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.00421b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x439390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0xc], 1
mov edx, dword [ebp - 0x28]
mov byte [edx + 8], 0
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x30], 0x17
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x24], 0x320
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x28], 0x258
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x2c], 0x3c
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x10], 0x17
lea ecx, [ebp - 0x20]
call fcn.00438800
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
movzx ecx, byte [0x5be020]
test ecx, ecx
je 0x439451
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00439150
movzx edx, al
test edx, edx
jne 0x43945b
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 4], 2
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x34], 0x20
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004394b0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43bac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0x31545844
mov dword [ebp - 0xc], 0x33545844
mov dword [ebp - 4], 0x35545844
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 4
je 0x43bb39
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x31545844
je 0x43bb0c
cmp dword [ebp - 0x44], 0x33545844
je 0x43bb17
cmp dword [ebp - 0x44], 0x35545844
je 0x43bb22
jmp 0x43bb2d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x31545844
jmp 0x43bb34
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x33545844
jmp 0x43bb34
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x35545844
jmp 0x43bb34
xor al, al
jmp 0x43bbf5
jmp 0x43bbf3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
and edx, 1
mov byte [ebp - 0xd], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0043cc20
mov ecx, eax
call fcn.0043cc50
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0043cc20
mov ecx, eax
call fcn.0043cc50
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
lea ecx, [ebp - 0x38]
call fcn.0043cc20
mov ecx, eax
call fcn.0043cc50
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0043cc20
mov ecx, eax
call fcn.0043cc50
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 4
jne 0x43bbcc
cmp dword [ebp - 0x20], 4
jne 0x43bbcc
cmp dword [ebp - 0x18], 4
jne 0x43bbcc
cmp dword [ebp - 0x1c], 4
jne 0x43bbcc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x1a
jmp 0x43bbf3
cmp dword [ebp - 0x14], 8
jne 0x43bbef
cmp dword [ebp - 0x20], 8
jne 0x43bbef
cmp dword [ebp - 0x18], 8
jne 0x43bbef
cmp dword [ebp - 0x1c], 8
jne 0x43bbef
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x15
jmp 0x43bbf3
xor al, al
jmp 0x43bbf5
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x451200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c5f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00408fa0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00408fa0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x2c]
mov byte [edx + 0x2c], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x30], ecx
mov edx, dword [ebp + 8]
add edx, 0x34
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004041c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x488390
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5531f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004885a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x57ce40
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00489a50
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00489ab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd]
call fcn.004899b0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.00489890
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd]
call fcn.004899c0
lea ecx, [ebp - 0xe]
call fcn.00489e10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.00489c60
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe]
call fcn.00489e20
lea ecx, [ebp - 0xf]
call fcn.00477d50
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.00477bd0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xf]
call fcn.00477d60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x49e0f0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555c89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xd]
call fcn.004a42c0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x30
call fcn.004a4210
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd]
call fcn.004a42d0
mov ecx, dword [ebp - 0x18]
add ecx, 0x3c
call fcn.004a42e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
call fcn.004a4400
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
add ecx, 0x64
call fcn.00409030
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe]
call fcn.00402640
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x70
call fcn.004024f0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe]
call fcn.00402650
lea ecx, [ebp - 0xf]
call fcn.004a4670
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x8c
call fcn.004a45c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xf]
call fcn.004a4680
lea ecx, [ebp - 0x10]
call fcn.0040d5b0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x98
call fcn.0040d500
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x10]
call fcn.0040d5c0
lea ecx, [ebp - 0x11]
call fcn.004a42c0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xa4
call fcn.004a4210
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x11]
call fcn.004a42d0
lea ecx, [ebp - 0x12]
call fcn.004a4760
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x48]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0xb0
call fcn.004a46b0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x12]
call fcn.004a4770
lea ecx, [ebp - 0x13]
call fcn.00421400
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xbc
call fcn.004211b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x13]
call fcn.00421410
mov ecx, dword [ebp - 0x18]
add ecx, 0xd0
call fcn.00409030
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x14]
call fcn.0040d5b0
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xdc
call fcn.0040d500
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x14]
call fcn.0040d5c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x49e300
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555d39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0xdc
call fcn.0040d550
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0xd0
call fcn.004021f0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0xbc
call fcn.00421200
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0xb0
call fcn.004a4700
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a4260
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x98
call fcn.0040d550
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.004a4610
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.00402540
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.004021f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.0049e400
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004a7150
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004a4260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a81e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557919
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004a83e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 8]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004a82f0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004a8390
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x34]
mov byte [eax + 0x34], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x3c]
mov byte [eax + 0x3c], dl
mov eax, dword [ebp + 8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.004a8430
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x4c
mov edx, dword [ebp - 0x10]
add edx, 0x4c
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fbb70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 8]
mov byte [eax + 8], dl
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004c71c0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004c71c0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x30], ecx
mov edx, dword [ebp + 8]
add edx, 0x34
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.0040fbd0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x48]
mov byte [ecx + 0x48], al
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x4c], eax
mov ecx, dword [ebp + 8]
add ecx, 0x50
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.004fbdf0
mov byte [ebp - 4], 3
mov esi, dword [ebp + 8]
add esi, 0x5c
mov edi, dword [ebp - 0x10]
add edi, 0x5c
mov ecx, 0xc8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
add edx, 0x37c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x37c
call fcn.004fbcd0
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
add eax, 0x39c
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x39c
call fcn.00408fa0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3a8]
mov dword [ecx + 0x3a8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x506d58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x506d86
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x506d8d
cmp ebx, dword [eax + 4]
jae 0x506d8d
xor eax, eax
jmp 0x506f7d
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x506d9e
xor eax, eax
inc eax
jmp 0x506f7c
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x506db4
cmp ecx, edx
jae 0x506ef9
cmp dword [eax + 4], 0
je 0x506dbd
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x506da5
cmp dword [ebp + 8], 0
je 0x506ddf
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x506ef9
cmp eax, esi
jae 0x506ef9
mov eax, dword [0x5ce7a0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x506e04
cmp dword [esi*4 + 0x5ce7a8], edi
je 0x506efd
inc esi
cmp esi, eax
jl 0x506df2
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x5781ec]
test eax, eax
je 0x506f79
cmp dword [ebp - 8], 0x1000000
jne 0x506f79
test byte [ebp - 0xc], 0xcc
je 0x506e82
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x506f79
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x506f79
cmp word [eax + 0x18], 0x10b
jne 0x506f79
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x506f79
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x506e82
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x506e82
test byte [ecx + 0x27], 0x80
jne 0x506ef9
push 1
push 0x5ce7e8
call dword [fcn.00578088]
test eax, eax
jne 0x506d96
mov ecx, dword [0x5ce7a0]
test ecx, ecx
mov edx, ecx
jle 0x506eb6
lea eax, [ecx*4 + 0x5ce7a4]
cmp dword [eax], edi
je 0x506eb6
dec edx
sub eax, 4
test edx, edx
jg 0x506eaa
test edx, edx
jne 0x506ee7
push 0xf
pop ebx
cmp ecx, ebx
jg 0x506ec3
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x506edb
lea eax, [edx*4 + 0x5ce7a8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x506ec9
cmp ecx, 0x10
jge 0x506ee7
inc ecx
mov dword [0x5ce7a0], ecx
push 0
push 0x5ce7e8
call dword [fcn.00578088]
jmp 0x506d96
xor eax, eax
jmp 0x506f7c
test esi, esi
jle 0x506d96
mov ebx, dword [fcn.00578088]
push 1
push 0x5ce7e8
call ebx
test eax, eax
jne 0x506d96
cmp dword [esi*4 + 0x5ce7a8], edi
je 0x506f53
mov eax, dword [0x5ce7a0]
lea esi, [eax - 1]
test esi, esi
jl 0x506f41
cmp dword [esi*4 + 0x5ce7a8], edi
je 0x506f3d
dec esi
jns 0x506f31
test esi, esi
jge 0x506f51
cmp eax, 0x10
jge 0x506f4c
inc eax
mov dword [0x5ce7a0], eax
lea esi, [eax - 1]
jmp 0x506f53
je 0x506f6b
xor ecx, ecx
test esi, esi
jl 0x506f6b
lea eax, [ecx*4 + 0x5ce7a8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x506f59
push 0
push 0x5ce7e8
call ebx
jmp 0x506d96
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x517297
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x5173b8
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x51739c
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x5172ee
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x5172cc
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x5176fc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x517843
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x51781e
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x517765
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x51773c
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret