joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1c80
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [edi + 0x14]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [eax + ebx*4]
sub ebx, dword [edi + 0xc]
cmp dword [edi + 8], 0xfe
push esi
jl 0x4f1d18
lea ebx, [ebx]
mov esi, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [esi + 0x10]
mov eax, dword [edi + 0x18]
mov ecx, ebp
mov dword [esp + 0xc], ecx
mov esi, pe_nt_image_headers32
add ebp, 4
inc ebx
mov edx, dword [eax + edx*4]
mov eax, dword [ecx]
mov ecx, eax
mov dword [esp + 0x14], edx
and eax, 0xff00ff
shr edx, 0x18
sub esi, edx
shr ecx, 8
imul eax, esi
mov edx, ecx
and edx, 0xffff00ff
imul edx, esi
and ecx, 0xff00ff
imul ecx, esi
shr eax, 8
xor eax, edx
and eax, 0xff00ff
xor eax, ecx
add eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
test eax, eax
jg 0x4f1ca0
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ebp, dword [esp + 0xc]
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esp + 0x14], ebp
add ebp, 4
mov dword [esp + 0xc], ebp
inc ebx
lea eax, [eax + edx*4]
mov eax, dword [eax]
mov edx, dword [edi + 8]
mov ecx, eax
mov esi, eax
inc edx
shr eax, 8
and ecx, 0xff00ff
imul ecx, edx
and eax, 0xff00ff
imul eax, edx
shr esi, 8
and esi, 0xffff00ff
imul esi, edx
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor ecx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov edx, ecx
shr edx, 0x18
mov esi, pe_nt_image_headers32
sub esi, edx
mov edx, eax
and eax, 0xff00ff
shr edx, 8
imul eax, esi
mov ebp, edx
and ebp, 0xffff00ff
imul ebp, esi
and edx, 0xff00ff
shr eax, 8
imul edx, esi
xor eax, ebp
and eax, 0xff00ff
xor eax, edx
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
test eax, eax
jg 0x4f1d14
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x4f3740
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ecx + 0x14]
push edi
mov edi, eax
add esi, edi
sub edi, dword [ecx + 0xc]
cmp dword [ecx + 8], 0xfe
jge 0x4f37a7
jmp 0x4f3760
mov ebx, dword [ecx + 4]
mov eax, edi
cdq
idiv dword [ebx + 0x10]
mov eax, dword [ecx + 0x18]
mov ebx, esi
mov dword [esp + 0x14], ebx
movzx ebx, byte [ebx]
dec ebp
inc edi
inc esi
movzx eax, byte [eax + edx*4 + 3]
mov edx, dword [ecx + 8]
inc edx
imul eax, edx
shr eax, 8
mov edx, pe_nt_image_headers32
sub edx, eax
imul edx, ebx
sar edx, 8
add dl, al
mov eax, dword [esp + 0x14]
mov byte [eax], dl
test ebp, ebp
jg 0x4f3760
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ebx, dword [ecx + 4]
mov eax, edi
cdq
idiv dword [ebx + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x14]
movzx ebx, byte [ebx]
dec ebp
inc esi
inc edi
movzx eax, byte [eax + edx*4 + 3]
mov edx, pe_nt_image_headers32
sub edx, eax
imul edx, ebx
sar edx, 8
add dl, al
mov eax, dword [esp + 0x14]
mov byte [eax], dl
test ebp, ebp
jg 0x4f37a7
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4f3b80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ecx + 0x14]
push edi
mov edi, eax
add esi, edi
sub edi, dword [ecx + 0xc]
cmp dword [ecx + 8], 0xfe
jge 0x4f3be6
jmp 0x4f3ba0
mov ebx, dword [ecx + 4]
mov eax, edi
cdq
idiv dword [ebx + 0x10]
mov eax, dword [ecx + 0x18]
mov ebx, esi
mov dword [esp + 0x14], ebx
movzx ebx, byte [ebx]
dec ebp
inc edi
inc esi
movzx eax, byte [eax + edx]
mov edx, dword [ecx + 8]
inc edx
imul eax, edx
shr eax, 8
mov edx, pe_nt_image_headers32
sub edx, eax
imul edx, ebx
sar edx, 8
add dl, al
mov eax, dword [esp + 0x14]
mov byte [eax], dl
test ebp, ebp
jg 0x4f3ba0
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ebx, dword [ecx + 4]
mov eax, edi
cdq
idiv dword [ebx + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x14]
movzx ebx, byte [ebx]
dec ebp
inc esi
inc edi
movzx eax, byte [edx + eax]
mov edx, pe_nt_image_headers32
sub edx, eax
imul edx, ebx
sar edx, 8
add dl, al
mov eax, dword [esp + 0x14]
mov byte [eax], dl
test ebp, ebp
jg 0x4f3be6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4f3c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, eax
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [edi]
mov ecx, esi
shr ecx, 0x18
mov edx, pe_nt_image_headers32
sub edx, ecx
mov ecx, eax
and eax, 0xff00ff
shr ecx, 8
imul eax, edx
mov ebp, ecx
and ebp, 0xffff00ff
imul ebp, edx
and ecx, 0xff00ff
imul ecx, edx
shr eax, 8
xor eax, ebp
and eax, 0xff00ff
xor eax, ecx
add eax, esi
mov dword [edi], eax
dec ebx
add edi, 4
test ebx, ebx
jg 0x4f3c40
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x501190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5403f4
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x59f750
call fcn.00478ff0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x1c], edi
fild dword [esp + 0x1c]
mov dword [esp + 0x20], eax
sub esp, 8
fstp dword [esp + 0x24]
mov ecx, 0xffe8e8e8
fld dword [esp + 0x24]
lea eax, [esp + 0x2c]
fstp dword [esp + 0x1c]
fild dword [esp + 0x28]
fmul qword [0x572c90]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fadd qword [0x572c28]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
fldz
fst dword [esp]
call fcn.00453820
push eax
sub esp, 8
fst dword [esp + 4]
or ecx, 0xffffffff
lea eax, [esp + 0x3c]
fstp dword [esp]
call fcn.00453820
push eax
lea ecx, [esp + 0x7c]
push ecx
xor al, al
call fcn.00476b70
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x9c], 0
call fcn.004789d0
fld dword [esp + 0x10]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [esp + 0x24]
fstp dword [esp + 8]
fldz
fst dword [esp + 4]
fstp dword [esp]
push esi
call fcn.00478f40
fld dword [esp + 0x18]
fst dword [esp + 0x18]
sub esp, 8
fld dword [esp + 0x24]
or ecx, 0xffffffff
fstp dword [esp + 0x1c]
lea eax, [esp + 0x30]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fld dword [esp + 0x20]
fld st(0)
faddp st(2)
fxch st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
fldz
fst dword [esp]
call fcn.00453820
fxch st(1)
push eax
sub esp, 8
fstp dword [esp + 4]
mov ecx, 0xffe8e8e8
lea eax, [esp + 0x30]
fstp dword [esp]
call fcn.00453820
push eax
lea eax, [esp + 0x54]
push eax
xor al, al
call fcn.00476b70
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x9c], 1
call fcn.004789d0
fld dword [esp + 0x10]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [esp + 0x24]
fstp dword [esp + 8]
fld dword [esp + 0x28]
fstp dword [esp + 4]
fldz
fstp dword [esp]
push esi
call fcn.00478f40
mov ecx, 0xffc0c0c0
lea eax, [esp + 0x24]
call fcn.00453820
push eax
call fcn.00478940
mov ecx, dword [esp + 0x20]
push 1
push edi
dec ecx
push esi
xor eax, eax
mov dword [esp + 0x30], ecx
call fcn.00478ee0
mov eax, ebx
call fcn.004420f0
mov edi, eax
sub edi, 1
js 0x50138e
push edi
lea edx, [esp + 0x30]
push edx
push ebx
call fcn.004423a0
mov ecx, dword [esp + 0x24]
mov edx, dword [eax + 8]
mov eax, dword [eax]
push ecx
push 1
lea eax, [edx + eax - 1]
push esi
xor ecx, ecx
call fcn.00478ee0
sub edi, 1
jns 0x501365
lea ecx, [esp + 0x3c]
push ecx
call fcn.00476c70
lea edx, [esp + 0x64]
push edx
call fcn.00476c70
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5076b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x5076e1
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x5076c0
pop edi
pop esi
ret
Function at 0x50cb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b5e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0050c670
mov dword [esp + 0x18], 0
test edi, edi
je 0x50cb74
add edi, 0x28
jmp 0x50cb76
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x50cb8e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x50d530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b6d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0050cb30
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.2.0
test edi, edi
je 0x50d595
lea ebx, [edi + 0x28]
jmp 0x50d597
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x50d5a8
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x50d5b8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x50e900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53c308
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401c80
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x50e94a
add edi, 0x28
jmp 0x50e94c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x50e964
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x50ef20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b8a3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0050e900
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.2.0
test edi, edi
je 0x50ef85
lea ebx, [edi + 0x28]
jmp 0x50ef87
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x50ef98
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x50efa8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5153e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x53bc23
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00510d90
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00510d90
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00510d90
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x517450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53bd11
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.boost::re_detail::named_subexpressions_wchar_t_.0
call fcn.00510d90
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.boost::re_detail::regex_data_wchar_t__struct_boost::regex_traits_wchar_t__class_boost::w32_regex_traits_wchar_t___.0
mov edx, dword [eax]
mov dword [esi + 0x1c], edx
mov eax, dword [eax + 4]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x20], eax
cmp eax, ecx
je 0x5174b1
add eax, 4
mov edx, 1
lock xadd dword [eax], edx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x14c], ecx
mov dword [esi + 0x148], ecx
mov dword [esi + 0x144], ecx
lea ecx, [esi + 0x154]
mov byte [esp + 0x14], 2
call fcn.00510d90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x51c400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x566194
mov dword [esp], eax
mov dword [esp + 4], 0x5665d0
mov dword [esp + 8], 0x566574
mov dword [esp + 0xc], 0x5531b0
mov dword [esp + 0x10], 0x5531ac
mov dword [esp + 0x14], 0x566570
mov dword [esp + 0x18], 0x5663dc
mov dword [esp + 0x1c], 0x56657c
mov dword [esp + 0x20], 0x565bd4
mov dword [esp + 0x24], 0x5531a8
mov dword [esp + 0x28], 0x5531a4
mov dword [esp + 0x2c], 0x5531a0
mov dword [esp + 0x30], 0x5694e4
mov dword [esp + 0x34], 0x56707c
mov dword [esp + 0x38], 0x56650c
mov dword [esp + 0x3c], 0x56842c
mov dword [esp + 0x40], 0x55319c
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x552ec0
mov dword [esp + 0x4c], str.BAGFED
mov dword [esp + 0x50], 0x553198
mov dword [esp + 0x54], 0x566834
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x553194
mov dword [esp + 0x64], 0x553190
mov dword [esp + 0x68], 0x5666fc
mov dword [esp + 0x6c], 0x566594
mov dword [esp + 0x70], 0x552ec4
mov dword [esp + 0x74], 0x566ee0
mov dword [esp + 0x78], 0x552e9c
mov dword [esp + 0x7c], 0x568428
mov dword [esp + 0x80], 0x552e8c
mov dword [esp + 0x84], 0x552e88
mov dword [esp + 0x88], 0x56823c
mov dword [esp + 0x8c], 0x552ebc
mov dword [esp + 0x90], 0x566410
mov dword [esp + 0x94], 0x55318c
mov dword [esp + 0x98], 0x552eb8
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x5662dc
mov dword [esp + 0xc0], 0x552f4c
mov dword [esp + 0xc4], 0x552f30
mov dword [esp + 0xc8], 0x5663e0
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIH
mov dword [esp + 0xd0], 0x5662d4
mov dword [esp + 0xd4], 0x553188
mov dword [esp + 0xd8], 0x552e94
mov dword [esp + 0xdc], 0x552f50
mov dword [esp + 0xe0], 0x552f58
mov dword [esp + 0xe4], 0x568424
mov dword [esp + 0xe8], 0x552f64
mov dword [esp + 0xec], 0x552f48
cmp cl, 0x3c
jae 0x51c61d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x51d100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53c308
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401c80
mov dword [esp + 0x18], 0
test edi, edi
je 0x51d144
add edi, 0x28
jmp 0x51d146
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x51d15e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x51d1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53c343
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0051d100
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.2.0
test edi, edi
je 0x51d205
lea ebx, [edi + 0x28]
jmp 0x51d207
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x51d218
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x51d228
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x51d270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53b5e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x598c90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0050c670
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x51d2d5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x51e437
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x598c90]
jne 0x51e441
repz ret
jmp fcn.0052439d
Function at 0x531852
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005248d6
and dword [ebp - 4], 0
cmp dword [0x59f258], 0
mov ebx, eax
jne 0x531903
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5319b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5319b4
push eax
call fcn.00524864
mov dword [esp], 0x555788
push edi
mov dword [0x59f258], eax
call esi
push eax
call fcn.00524864
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x59f25c], eax
call esi
push eax
call fcn.00524864
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x59f260], eax
call esi
push eax
call fcn.00524864
pop ecx
mov dword [0x59f268], eax
test eax, eax
je 0x531903
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00524864
pop ecx
mov dword [0x59f264], eax
mov eax, dword [0x59f264]
cmp eax, ebx
je 0x53195b
cmp dword [0x59f268], ebx
je 0x53195b
push eax
call fcn.005248df
push dword [0x59f268]
mov esi, eax
call fcn.005248df
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53195b
test edi, edi
je 0x53195b
call esi
test eax, eax
je 0x531952
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x531952
test byte [ebp - 0xc], 1
jne 0x53195b
or dword [ebp + 0x10], 0x200000
jmp 0x531994
mov eax, dword [0x59f25c]
cmp eax, ebx
je 0x531994
push eax
call fcn.005248df
pop ecx
test eax, eax
je 0x531994
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x531994
mov eax, dword [0x59f260]
cmp eax, ebx
je 0x531994
push eax
call fcn.005248df
pop ecx
test eax, eax
je 0x531994
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x59f258]
call fcn.005248df
pop ecx
test eax, eax
je 0x5319b4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5319b6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret