joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [0x548de8]
push dword [0x515008]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x513155
mov eax, 0xffffffff
jmp 0x513297
mov eax, dword [0x548de8]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0
jne 0x513181
mov eax, 1
mov dword [ebp - 0x14], 1
jmp 0x5131e6
mov eax, dword [ebp - 0x10]
and eax, 0xe0
cmp eax, 0xc0
jne 0x51319e
mov eax, 2
mov dword [ebp - 0x14], 2
jmp 0x5131e6
mov eax, dword [ebp - 0x10]
and eax, 0xf0
cmp eax, 0xe0
jne 0x5131bb
mov eax, 3
mov dword [ebp - 0x14], 3
jmp 0x5131e6
mov eax, dword [ebp - 0x10]
and eax, 0xf8
cmp eax, 0xf0
jne 0x5131d8
mov eax, 4
mov dword [ebp - 0x14], 4
jmp 0x5131e6
call fcn.005131dd
Function at 0x5136c1
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
push 0
call dword [sym.imp.MSVCRT.DLL_fflush]
add esp, 4
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e40]
mov ecx, edx
cdq
idiv ecx
pop edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e40]
mov ecx, edx
cdq
idiv ecx
mov eax, edx
bt eax, 0x1f
jae 0x51370a
bt ecx, 0x1f
jae 0x513708
neg ecx
add eax, ecx
pop edx
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.005139a0
cmp eax, 0
je 0x513730
mov eax, dword [0x548e40]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp eax, 1
jne 0x513730
jmp 0x513734
xor eax, eax
jmp 0x513737
xor eax, eax
inc eax
cmp eax, 0
je 0x513751
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x513769
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cmp eax, edx
jne 0x513769
jmp 0x51376d
xor eax, eax
jmp 0x513770
xor eax, eax
inc eax
cmp eax, 0
je 0x51379c
mov eax, 0
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 1
push 0x54aea8
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_WriteConsoleW]
mov eax, dword [0x548e58]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
mov eax, dword [0x548e58]
shr eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
add eax, edx
shl eax, 0x10
mov edx, dword [ebp - 0xc]
or eax, edx
push eax
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x548e40]
mov ecx, edx
cdq
idiv ecx
pop edx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [0x548e44]
mov edx, dword [ebp - 0x18]
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0
jle 0x513834
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jge 0x513824
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
shl eax, 0x10
mov edx, dword [ebp - 0x1c]
or eax, edx
mov dword [0x548e58], eax
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x548e40]
mov ecx, edx
cdq
idiv ecx
pop edx
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [0x548dec], eax
leave
ret 0xc
Function at 0x513d1d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
jge 0x513d58
mov eax, 2
mov dword [ebp - 0xc], 2
push dword [ebp + 8]
call fcn.004425f7
push eax
push dword [ebp + 0xc]
call fcn.004425f7
pop edx
xchg edx, eax
add eax, edx
push eax
push dword [ebp - 0xc]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
shl eax, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x548e3c]
cmp eax, edx
jle 0x513dfa
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [0x548e3c], eax
push dword [0x548df4]
call dword [sym.imp.MSVCRT.DLL_free]
add esp, 4
push dword [0x548e3c]
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x548df4], eax
mov eax, 0
mov edx, dword [0x548df4]
cmp eax, edx
jne 0x513dfa
push 0
push dword [ebp - 0x14]
push 2
push 0
push str.Cannot_allocate_memory:_init_buffer:
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [0x548df4]
mov dword [0x548df8], eax
leave
ret 8

Function at 0x514cba
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00442639
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x514d04
push 0
push str.SetConsoleTitle_failed_
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
call fcn.005138bc
call fcn.0051397f
push 5
push dword [0x54793c]
call fcn.0044c49f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x514d4a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x514d4a
xor eax, eax
jmp 0x514d4d
xor eax, eax
inc eax
cmp eax, 0
je 0x514d72
mov eax, 0x50
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, 0x32
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
leave
ret 4
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x40c0c80d
add byte [ecx], ch
add ecx, 0x40
push 0x1040d274
push ecx
sahf
adc eax, sym.imp.MSVCRT.dll_strspn
mov eax, dword [0x4102ac]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push str.Total_of__d_requests_completed_n
xchg byte [edx + 0x2e], dh
rol dword [eax], 0x83
les ecx, [eax]
push 0x74
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mul dword [0xb8ec81]
add byte [eax], al
mov eax, dword [0x410278]
test eax, eax
mov eax, dword [0x414062]
je 0x4017bb
push 0x584167b1
mov esp, 0x4047e8
add byte [esi - 0x75], ah
or eax, 0x410274
jmp 0x4017cf
mov ecx, dword [eax + ebp*8 + 0x18]
inc ecx
add byte [edx + 0x50], dl
call fcn.00405850
cmp esp, edx
iretd
mov dword [0x411808], eax
mov eax, dword [0x170288]
push ebx
push esi
mov esi, dword [0xd9405e64]
mov word [0x410bb4], cx
test eax, eax
or al, 0x75
in al, 0x8b
adc eax, 0x90411800
push edx
push 0xa7d498
call esi
mov eax, dword [0x2ef078]
cmp dword [esi + 0x47078508], 0x6e
mov eax, dword [0x410274]
push eax
push 0x413c40
push str._through__s:_d_
push dword [eax]
add esp, 0xc
in al, 0x14
rol byte [eax], 1
and eax, 0xd480b8c0
inc eax
pop edi
jne 0x40182f
mov eax, 0xf0d47c
push eax
push 0x40d43e
pop ebp
salc
mov ecx, dword [0x40c092]
add ecx, 0x20
push ecx
call dword [0x7dc154]
and dword [esp + ecx - 0x2f6e1475], 0x40
add byte [ebx + 0x40c15835], cl
add byte [eax + 0x60], ch
or byte [eax], al
add byte [edx - 1], dl
salc
mov dword [0x4197b0], eax
mov eax, dword [0x40d04e]
push 0xfffffffffffffff1
push eax
cmpsd dword [esi], dword es:[edi]
push esi
mov edx, dword [edi + 0x4c]
inc eax
inc ecx
pushfd
mov edx, dword [0x8cbd005]
sbb dword [edi], 0x10
mov dword [0x415ec8], eax
push 0
push ecx
push edx
push 0x4117f8
call 0xa3506010
test eax, eax
je 0x4018a1
add al, ch
add dword [edi + 0x10], 0x74c085a3
push cs
push eax
retf 0xd450
mov eax, dword [0xa3020c]
test edi, edx
jne 0x401889
mov eax, dword [0x410bac]
mov ecx, dword [edi - 0x64]
or eax, dword [ecx]
mov esp, dword [ebx + 0x25]
inc eax
inc ecx
add byte [edx], ch
push 0x40d19b
push eax
mov eax, dword [0x41234c]
push ecx
push 0x40d48f
push edx
push eax
invalid
Function at 0x4023d8
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00402588
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4024d6
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x402479
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4024bc
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x402490
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4024ab
test al, 0x40
je 0x4024a2
mov ecx, dword [edi + 0x20]
jmp 0x4024a9
test al, 0x80
je 0x4024bc
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4024bc
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x402448
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x436653
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x436706
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x436d71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x436d94
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x436d94
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x436d9e
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x436de0
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x436e42
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x436e3d
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x436e28
test dl, dl
je 0x436e24
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x436e28
add ecx, 2
add eax, 2
test dl, dl
jne 0x436e08
xor eax, eax
jmp 0x436e2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x436e4e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x436df5
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x436eeb
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x436f0d
mov eax, 0xfffffffd
jmp 0x436fdf
cmp dword [0x8a5cc8], 0
je 0x436fb8
cmp dword [0x8a5ccc], 5
jl 0x436f3b
cmp dword [0x8a5ccc], 7
jg 0x436f3b
mov eax, 1
jmp 0x436f40
mov eax, 0
test eax, eax
jne 0x436f59
cmp dword [0x8a5ccc], 0xfffffffb
je 0x436f59
xor eax, eax
jmp 0x436f5e
mov eax, 1
test eax, eax
je 0x436f8a
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x436f73
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x8a5cc8], 0
jne 0x436fd5
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x436fdf
mov esp, ebp
pop ebp
ret 4
Function at 0x54f22e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x54f2e2
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0054f1be
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x54f2bb
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54f2ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x54f309
test ebp, ebp
je 0x54f309
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x54f311
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x54f351
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x54f3ad
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x54f3a8
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x54f393
test dl, dl
je 0x54f38f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x54f393
add ecx, 2
add eax, 2
test dl, dl
jne 0x54f373
xor eax, eax
jmp 0x54f398
sbb eax, eax
or eax, 1
test eax, eax
je 0x54f3b7
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x54f360
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x54f3ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0054f22e
test eax, eax
jne 0x54f3e6
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0054f2ee
mov esi, eax
test esi, esi
jne 0x54f41c
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x54f436
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x54f52e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0054f22e
mov esi, eax
test esi, esi
jne 0x54f54c
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0054f2ee
mov dword [esp + 0x18], eax
test eax, eax
je 0x54f544
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0054f2ee
mov dword [esp + 0x34], eax
test eax, eax
je 0x54f544
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0054f2ee
mov dword [esp + 0x28], eax
test eax, eax
je 0x54f544
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0054f2ee
mov dword [esp + 0x30], eax
test eax, eax
je 0x54f544
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x54f713
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x54f713
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x54f676
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x54f6f7
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x54f699
movzx esi, ax
jmp 0x54f69e
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x54f6bd
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x54f6cc
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x54f720
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x54f68e
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x54f653
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x54f749
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x54f749
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x54f72e
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x54f75e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0054f22e
mov esi, eax
test esi, esi
je 0x54f81a
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0054f2ee
mov ebp, eax
test ebp, ebp
je 0x54f819
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0054f2ee
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x54f819
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x54f819
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x54f818
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x54f7fe
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x55f140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, 0x767375
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004367c6
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x55f174
push ebx
call fcn.005cce51
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor edx, edx
not ecx
cmp dword [ebp + 0x10], edx
jbe 0x55f1a3
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [ebx + eax*4]
inc edx
cmp edx, dword [ebp + 0x10]
jl 0x55f18d
pop esi
not ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
jmp 0x55f1b0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5b34e6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret

Function at 0x5b4c88
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x5b4d3c
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005b4c18
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x5b4d15
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret