joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd8c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je fcn.0044b86d
or dword [esi], 0x657250

Function at 0x4b5739
Capabilities:
Encode data using xor

Disassembly:
adc ah, byte [esi - 0x720e363c]
pop ds
fmul qword [ecx - 0x55207b3b]
push esp
fcom qword [di + 0x40f5]
xor eax, dword [eax + 0x5973fd42]
insd dword es:[edi], dx
aad 0x32
popal
invalid
invalid
popal
hlt

Function at 0x4cf224
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebp - 0x790c098f], eax
cld
cmpsd dword [esi], dword es:[edi]
cli
mov ch, 0xf
or eax, 0x47e13a16
push 0xb21cac15
pop esp
push ebx
sub esi, esi
rol byte [eax], cl
xor ah, byte [ebp + 0x55]
push 0x6ba4a4f4
mov edi, 0xc0772e91
jb 0x4cf234
aam 0xab
xor dword [edx + edx], 0x6b
xor byte [ecx], al
push edx
int3

Function at 0x4d03db
Capabilities:
Encode data using xor

Disassembly:
jnp 0x4d0408
push es
mov bl, 0x1a
xchg ecx, eax
invalid
test al, bl
jle 0x4d0440
xchg ebx, eax
xchg ecx, eax
xchg ebx, eax
ficom dword [ecx - 0x10]
popfd
sbb al, 0x9b
jp 0x4d0395
test byte [esi], bl
aam 0x8c
mov ebp, 0x4fa8e3e3
jmp 0x4d0413
pop ebp
pop ecx
xor al, 0xc5
iretd
xor ebx, edx
sbb ebx, 0x39
aaa
xchg esi, eax
adc dword [edi + 0x50], ecx
jbe 0x4d0418
mov byte [0xd8a114c0], al
div byte [ecx - 0x72]
xchg dword [eax - 0x24], edx
mov al, 0x22
pop eax
dec ebx
xchg edi, eax
add al, 0xa3
pop ds
hlt
pop edi
call 0xf78f2029
push ds
push dword [edx]
je 0x4d04c2
pushal
mov al, byte [0x37630b42]
aam 0xa5
into
rcl dword [ebx + esi*2 + 0x30], 0x71
xchg byte [edi - 0x48f10429], ah
ret
bswap ebx
inc esp
loop 0x4d0536
inc ebp
jge 0x4d04c7
sahf
add byte [ebx - 0x2d], cl
out 0x35, eax
or cl, 0x8f
cmpsd dword [esi], dword es:[edi]
aaa
jecxz 0x4d04fd
cmp byte [eax - 0x75], bl
cmp al, 0xa5
lahf
shl dword [ebx + edx], cl
stosd dword es:[edi], eax
inc edx
aam 0xf5
pushfd
retf
xor eax, 0xba4531d6
stosd dword es:[edi], eax
invalid
jl 0x4d04f3
mov edi, 0x6e0a9cc
pop ecx
xor eax, 0xce2d4456
xor eax, 0x676b5321
invalid
add dword [edi + edx*8 + 0x1d], 0xffffff9c
xchg dword [esi + ebx*2], esi
cmp dword [esi], eax
mov eax, dword [0x570827cf]
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
inc esp
and bh, byte [edx - 0x4e3d3b33]
retf
Function at 0x54f2cd
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
jns 0x54f2d8
inc ebx
adc esi, ecx
push es
xor dh, byte [edi]
invalid
scasb al, byte es:[edi]
adc dword [edi], ebp
adc byte [ebx], bl
mov edi, ss
cli
add eax, 0xff3c3a26
std
ror ebx, cl
xor al, 0x8c
adc byte [ebx - 0x3efd4324], cl
invalid
xchg ah, ch
push edi
pop es
inc ebx
xchg esi, eax
xor al, 0x76
xchg ebp, eax
shr byte [esp + edx*2], cl
push esp
mov cl, 0x89
jbe 0x54f29e
xor ebp, ebp
cmp dl, byte [0x850610b3]
jl 0x54f32b
ror esp, 1
scasb al, byte es:[edi]
xchg ecx, esi
cwde
aad 0x33
inc ebp
pop esp
movsd dword es:[edi], dword [esi]
xchg esp, eax
pop edi
add eax, 0x791fa424
fisttp word [edi - 0x637ae28f]
jle 0x54f288
dec esp
out dx, al
rcr byte [edx - 0x23], 1
xor al, 0xf0
sbb bh, byte [edx]
sahf
movsd dword es:[edi], dword [esi]
fucomi st(4)
outsb dx, byte [esi]
pop edx
bound edx, qword [esi]
enter 0x7bf4, 0
pop eax
cmp dword [ecx - 0x1e56fde8], edx
cwde
mov eax, dword [0x6c60078f]
in eax, dx
sub ecx, eax
xchg ebp, eax
mov dword [esp + esi*8 - 0x6ad7d66d], ebp
sub dword [eax], ebp
xchg ebp, eax
sbb bl, 7
sar dword [esi - 0x63f316da], cl
push ss
enter 0xffffffffffffecbc, 0x3a
add al, 0x86
jo 0x54f302
sub dh, ch
sbb eax, dword [ecx + 0x39]
mov byte [ebx], ch
popfd
stosb byte es:[edi], al
sbb ecx, edi
insb byte es:[edi], dx
das
stosb byte es:[edi], al
cdq
mov ch, ch
push es
xor byte [edi - 0xd654af7], bl
int1
retf
Function at 0x620edd
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xfd02fb9a
cmp byte [edi - 0x62], ah
mov dl, 0xf5
insd dword es:[edi], dx
sub edi, dword [esi]
mov ebx, dword [ebp - 0xd]
cld
mov dword [0xb9ebb75d], eax
xchg byte [ebp - 0x24e7716c], al
sub dword [ebx], edi
mov ch, 0x31
dec ecx
adc byte [eax - 0x3c073779], cl
not eax
dec byte [ecx - 0x57]
xor byte [eax - 0x24926483], bh
in al, dx
cwde
shr dword [edx - 0x67], cl
pop edi
neg byte [ebp + 0x5b7f309d]
js 0x620f7b
lodsb al, byte [esi]
sbb byte [ecx - 0x6e], ah
and eax, 0x243bde3e
push ebx
mov dword [0x919879b0], eax
inc edi
ret 0xe317
xor cl, byte [esi + 0x3d93dea]
mov edx, 0x83300786
fdivr qword [ebx]
xchg esp, eax
imul edi, dword [edi + ebp*8 - 0x53], 0x53
mov gs, edx
cmp eax, 0x86ba03d9
pop es
xor byte [ebx + 0x6b943bdc], al
jl 0x620f7a
lodsd eax, dword [esi]
push ebx
jo 0x620fbf
stosd dword es:[edi], eax
cli
wait
mov fs, ecx
and byte [ebp + ebx*4 - 0x79], bh
and dl, dl
lcall 0x9380, 0x1c73e31a
cmp al, 0x2c
dec ebx
inc ecx
xor bl, byte [edi - 0x4a073c45]
sbb byte [edi + 0x65], al
jecxz 0x62100f
out 0x37, eax
xchg ecx, eax
int3
test bl, bh
push cs
aas
dec eax
jge 0x621036
jns 0x62100a
mov eax, 0x9c7abb00
int 0x82
xor ebp, dword [edi + 0x28]
mov ah, 0x78
leave
sbb edx, dword [esi + 0x52cf9499]
jnp 0x621035
sbb al, 0x82
push esp
jb 0x620fc8
cdq
js 0x620faf
add eax, 0x44402ac6
insb byte es:[edi], dx
jp 0x621059
rcr dword [ebx - 0x5619571b], cl
inc edi
or esp, dword [eax]
js 0x620fd5
ret 0x5294
fdivr dword [edx]
sbb eax, 0xd68d9b31
sub eax, 0xda468502
pop edi
stc
sahf
lodsd eax, dword [esi]
dec ebp
sub eax, 0x64a9e95d
ljmp 0xcf13
invalid
mov word [eax + 0x118772a3], ss
or eax, 0x3c41de98
nop
mov dword [0xd118772], eax
cwde
fiadd word [ecx + 0x3c]
in al, dx
insd dword es:[edi], dx
jbe 0x620fdf
lcall 0x7748, 0x686f3a0b
cmp byte [ebx - 0x3a857d9b], bl
and byte [esi], 0xd3
mov ecx, 0x34f0895f
stc
sub al, 0x49
loop 0x6210b2
and cl, dl
mov al, 0x15
int1
and edx, dword [ebx - 0x4d]
sub al, 5
retf
pushal
sub bl, bl
cmpsb byte [esi], byte es:[edi]
shl edx, cl
invalid

Function at 0x63d4a3
Capabilities:
Encode data using xor

Disassembly:
cmp ebp, edi
mov dh, bh
lodsb al, byte [esi]
sbb eax, 0x756bf18f
inc edi
pushfd
push ebp
and bh, byte [edx - 5]
cli
inc ebx
test dword [ecx - 0x760948ba], ecx
cli
push esp
fiadd dword [eax]
jnp 0x63d49a
aaa
mov bh, 0x93
pop eax
push esi
ror byte [ebx + 0x55e1687f], 1
mov edi, dword [edi + 0x68]
loope 0x63d4a8
and dword [edx - 0x574b4f1], eax
jns 0x63d485
insb byte es:[edi], dx
sbb byte [ecx + 0x6de8651a], ch
mul byte [ebx - 0x731414d9]
and al, 0xdd
inc esp
std
dec eax
push cs
push ecx
ror dword [edx - 0x1423b5a2], 1
shl byte [esi + 0xd], 0x28
mov ah, 0xcd
push ebx
xchg ebp, eax
mov word [0xcf1e4ad3], es
js 0x63d44e
sub byte [ebp + ecx*8 + 0x58c9553], dh
ror dword [edx + 0x1e], cl
iretd
add ebx, ebx
mov edx, 0xec755265
invalid
jb 0x63d44d
daa
mov bh, 0x1a
fst dword [esi]
jno 0x63d478
in eax, dx
ja 0x63d42a
xor al, 0xcc
cmp byte [0x809ca453], bl
xchg esp, eax
cmp ecx, esp
or eax, 0xe646fd56
inc ecx
and eax, 0x99d07da5
push es
jnp 0x63d4d7
invalid
int3
Function at 0x63df08
Capabilities:
Encode data using xor

Disassembly:
cmp esp, edx
sub dl, byte [esi - 0x7b]
sub dl, byte [esi - 0x35]
adc cl, byte ds:[esi - 0x11]
inc eax
inc eax
or byte [edi + eax - 0x4d], bh
cwde
mov word [eax - 0x6e], ds
mov al, byte [0x4d8a38d]
clc
xor ch, cl
push ecx
jl 0x63df0b
push esi
test dword [edx], ebp
push esi
retf
or bl, dl
lodsd eax, dword [esi]
pop ebx
jmp 0x41a417cb

Function at 0x6455e4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebx + 0x33]
jns fcn.006455e4
sahf
or byte [0xa790d569], bh
cmpsb byte [esi], byte es:[edi]
pushfd
popfd
lodsb al, byte [esi]
cmp bl, dl
cmpsb byte [esi], byte es:[edi]
cld
sub ch, byte [edi + 0x351acf3a]
mov al, byte [0x4fc4eb10]
scasd eax, dword es:[edi]
cmp cl, bh
sbb dh, byte [0xc4eb10a0]
dec edi
cmp dh, dh
inc edi
lea esi, [eax - 0x46]
pop ebp
pushfd
imul ecx, dword [ecx + 0x23d82b78], 0xffffffd7
dec ecx
push esi
push ds
sar dword [esi + eax*2 + 0x7f], 1
sbb al, 0x1a
popfd
bound ebx, qword [0x2fba7a8f]
jg 0x645638
sbb bl, byte [ebp + 0x7a8f1d62]
mov edx, 0xbaf2d22f
jbe 0x64569b
sal dl, cl
mov edx, 0xb8c47276
stosb byte es:[edi], al
mov bh, 0x60
scasd eax, dword es:[edi]
les edi, [eax - 0x509f4856]
push cs
cmp eax, 0x4fedf0e5
or bh, bl
xor dword [esi + 0x5f55b3f3], 0x3ec31dd3
aaa
push ebx
mov dh, 0xf3
mov bl, 0x55
pop edi
rcr dword [0x53373ec3], cl
loop 0x645624
jge 0x64566d
cmp byte [ebp - 0x6393f577], cl
pop edi
lea ebp, [0x3da8c79d]
mov esi, 0x5e19d9ae
mov dh, 0xef
stc
and al, 0x4b
jp 0x64561a
or byte [ebx - 0x75], cl
fucom st(7)
push ds
stc
mov ah, 0xdb
jbe 0xd1d190ac
insd dword es:[edi], dx
shl dword [ecx + 0x7b], 1
inc eax
popal
jnp 0x6456b2
outsd dx, dword [esi]
aaa
ja 0x6455fb
sub ebp, dword [ecx]
add ebx, dword [ebp - 0x77c9d8dd]
inc eax
pop edi
fistp dword [ebp - 0x2215a797]
invalid
fucomp st(7)
invalid
fbld tbyte [eax - 0x2d451328]
push ebp
adc eax, 0xac843767
insd dword es:[edi], dx
sti
and al, 0x9e
mov word [ebx + 0x6069c919], es
adc eax, 0x1ad1a39e
cmp cl, bh
pop dword [ebx - 0x42]
je 0x645694
dec edx
cmp ecx, eax
fdivp st(1)
dec ebp
adc bh, byte [bp - 0x60fe]
shl dword [edi], cl
out dx, eax
dec ebp
cmp al, 0xe5
adc bl, byte [edx + edi]
xor al, 0xf4
pop es
cmpsd dword [esi], dword es:[edi]
popfd
and dword [ebp + 0xe4d7dac], ebp
jp 0x6456bd
test al, 0x6e
insb byte es:[edi], dx
or byte [ebx], ah
jb 0x6456ce
add bl, al
js 0x64567e
jne 0x645753
pop ebp
retf 0xa22c
push es
pop esi
or dword [ebp - 0x76de6a82], ebx
invalid
sbb esp, dword ds:[eax - 0x2b]
imul edi, dword [eax - 1], 0xf76aa75c
sar esp, cl
jg 0x64570e
enter 0x3eb1, 0xffffffffffffff98
sbb al, 0x4d
out 0x6d, eax
cwde
loope 0x645799
fdiv dword [eax - 0x53]
lodsb al, byte [esi]
invalid
jns 0x64572b
or eax, 0x4d082153
outsb dx, byte [esi]
xchg edi, eax
scasd eax, dword es:[edi]
lea ecx, [ebx - 0x23]
mov eax, dword [0x5a2f867a]
inc edi
mov esp, 0x80081afd
invalid
xor edi, dword [esi]
ffree st(4)
fstp qword [eax]
bound ebp, qword [edx - 0x59de0b86]
cdq
push 0x7c1ee4f3
push esp
xor dword [esi - 0x41bb6162], eax
test eax, 0x5dcd524c
mov esp, 0x3ed2b2b5
xchg ebx, eax
push es
sub bh, byte [edi - 0x5e6f3061]
mov al, 0x2d
mov ah, 0xd6
iretd
Function at 0x4a6e5b
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004a6ff2
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4a6f59
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4a6efc
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4a6f3f
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4a6f13
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4a6f2e
test al, 0x40
je 0x4a6f25
mov ecx, dword [edi + 0x20]
jmp 0x4a6f2c
test al, 0x80
je 0x4a6f3f
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4a6f3f
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4a6ecb
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4a7e17
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x4a7e5c
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x4a7e62
add eax, 4
pop esi
dec esi
push esi
jne 0x4a7e44
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x4c5f24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
test ecx, ecx
je 0x4c5f81
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4c5f50
cmp word [ecx], ax
je 0x4c5f55
jmp 0x4c5f44
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x4c5f44
jmp 0x4c5f55
mov eax, edx
lea ecx, [ecx + edx*2]
cdq
sub eax, edx
sar eax, 1
sub ecx, 2
test eax, eax
jle 0x4c5f81
lea ecx, [ecx]
mov dx, word [esi]
xor word [ecx], dx
movzx edx, word [ecx]
xor word [esi], dx
movzx edx, word [esi]
xor word [ecx], dx
dec eax
sub ecx, 2
add esi, 2
test eax, eax
jg 0x4c5f64
pop esi
pop ebp
ret 8
Function at 0x58d6c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xfca978]
xor edx, edx
cmp eax, edx
jne 0x58d6e6
xor eax, eax
mov byte [eax + 0xfca878], al
inc eax
cmp eax, 0x100
jl 0x58d6ce
mov dword [0xfca978], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xfca878
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x58d777
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x58d74a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x58d718
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x58d7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x58d843
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x58d82a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x591da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x591fc1
cmp eax, 8
jg 0x591fc1
cmp dword [esp + 0x8c], 2
jl 0x591fc1
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x591fc1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x591fc1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x591e27
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x591faa
mov ebp, dword [0x60a66c]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x591e59
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x591f91
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x591e79
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x60a65c]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x591eb8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x60a660]
lea ecx, [esp + 0x28]
push ecx
call dword [0x60a6a0]
test eax, eax
jne 0x591f78
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.005913b0
cmp eax, 1
jne 0x591fa2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00591c60
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x591e6d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x591faa
jmp 0x591e44
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.00590fb0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x594960
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x594af8
cmp ebp, ebx
jle 0x594af8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x5949be
dec eax
or eax, 0xfffffff8
inc eax
je 0x5949c5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x5949d4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x5949db
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.005f42ed
add esp, 4
cmp eax, ebx
je 0x5949fc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.005f42ed
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x594aee
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x594ad5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x594ac1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x594ab6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x594ac4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x594ac4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x594a60
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x594a51
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x59c3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x606a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0059cf20
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x60a728]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x60a6a0]
test eax, eax
je 0x59c449
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0059c030
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x60a66c]
push edi
lea ecx, [esp + 0x4c]
call fcn.005fb306
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.005aa980
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x60a174]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x60a6cc]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x60a660]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.005fb378
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14