joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aab0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49dfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0045b630
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x4a0650]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x4a0460]
test eax, eax
je 0x45ab59
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0045a740
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x4a0494]
push edi
lea ecx, [esp + 0x4c]
call fcn.00497518
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.00469d90
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x4a00e0]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x4a042c]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x4a04a0]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], reloc.KERNEL32.dll_LockFile
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.0049758a
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
Function at 0x45b090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49dfe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00458c90
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x45b0e9
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.00456100
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.004560f0
mov edx, dword [esp + 0x74]
mov ecx, esi
add eax, edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.0045a740
mov ebp, dword [eax]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x24], ecx
call dword [0x4a042c]
push 0
lea ecx, [esp + 0x4c]
call fcn.00497518
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.00469d90
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.004586f0
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x4a00e4]
mov ecx, ebx
call fcn.00456070
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x45b1b4
push edi
mov ecx, esi
call fcn.00458800
push eax
push ebp
mov ecx, esi
call fcn.004589c0
cmp eax, dword [esp + 0x40]
jg 0x45b1b0
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x45b18e
mov eax, ebx
jmp 0x45b1ba
cmp edi, ebx
jl 0x45b1b8
mov eax, ebx
jmp 0x45b1ba
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x45b1cb
mov dword [esp + 0x30], eax
jmp 0x45b1d6
cmp edi, ebx
jl 0x45b1d1
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.00456030
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x45b21d
push edi
mov ecx, esi
call fcn.00458720
push eax
push ebx
mov ecx, esi
call fcn.00458af0
cmp eax, dword [esp + 0x44]
jg 0x45b215
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x45b1ef
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x45b227
cmp edi, ebp
jl 0x45b221
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x45b227
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x45b230
mov ecx, eax
jmp 0x45b239
cmp edi, ebp
jl 0x45b236
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.00458710
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], reloc.KERNEL32.dll_LockFile
call fcn.0049758a
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x461180
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49e498
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x4611b9
inc eax
mov dword [esi + 0x10], eax
jmp 0x4612cc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x4611cd
mov eax, 0xffffffc7
jmp 0x4612ce
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x4611de
cmp dword [esi + 8], eax
jne 0x4611cd
cmp dword [esi + 8], eax
jne 0x4611f7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4611f7
mov eax, 0xffffffc7
jmp 0x4612ce
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x46120b
push eax
mov ecx, ebx
call fcn.004609b0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0042fdc0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x46123c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0042fde0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00460120
test eax, eax
mov dword [esp + 0x38], eax
je 0x46126f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.KERNEL32.dll_LockFile
mov dword [esp + 0x10], 0x4f81a8
call fcn.0042ffc0
mov eax, dword [esp + 0x38]
jmp 0x4612ce
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00460fe0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x4612b3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00461000
mov esi, eax
test esi, esi
jne 0x4612e3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00460fe0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x461285
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.KERNEL32.dll_LockFile
mov dword [esp + 0x10], 0x4f81a8
call fcn.0042ffc0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.KERNEL32.dll_LockFile
mov dword [esp + 0x10], 0x4f81a8
call fcn.0042ffc0
mov eax, esi
jmp 0x4612ce
Function at 0x46a3f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49eac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4a042c]
push 0
lea ecx, [esp + 0x20]
call fcn.00497518
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00469d90
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00497446
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00493d0a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00493d0a
push 1
push 0
push 0
mov ecx, esi
call fcn.00493cb2
push 1
push 0
push 1
mov ecx, esi
call fcn.00493cb2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.KERNEL32.dll_LockFile
call fcn.0049758a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x46a570
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49eae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00497518
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00469d90
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00497446
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4a042c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x46a634
cmp dword [esp + 0x40], 1
jne 0x46a632
cmp ecx, eax
jge 0x46a634
mov eax, ecx
cmp eax, 0xc8
jge 0x46a640
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0046a3f0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4a0430]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.KERNEL32.dll_LockFile
call fcn.0049758a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x46adb0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49eb53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00492128
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4a00ac]
push eax
mov ecx, edi
call fcn.004977c0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00498cdc
test eax, eax
je 0x46aecc
mov ecx, dword [esp + 0x3c]
call fcn.004977ed
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4a040c]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x46ae90
push edi
mov ecx, esi
call fcn.00494e55
mov ecx, esi
call fcn.0046b030
cmp dword [esp + 0x38], 1
jne 0x46aec5
or ecx, reloc.KERNEL32.dll_LockFile
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00494f90
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x46d8e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x46d913
push esi
call fcn.004709f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46d90c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x46d999
mov eax, dword [esi + reloc.KERNEL32.dll_LockFile]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x46d982
mov eax, dword [esi + 8]
test eax, eax
je 0x46d937
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.KERNEL32.dll_LockFile]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46d97e
cmp eax, 2
je 0x46d982
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46d92a
cmp eax, 3
je 0x46d95d
cmp eax, 1
jne 0x46d92a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46d92a
mov edx, dword [esi + reloc.KERNEL32.dll_LockFile]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46d92a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0046d9c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46d9a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0046d9c0
add esp, 4
pop esi
ret
Function at 0x55fa86
Capabilities:
Encode data using base64

Disassembly:
cmp dword [ebp + 0xc], 3
jne 0x55fa8b
je 0x55faae
loope 0x55fab4
ljmp 0x597:0x82ce7c8d
movzx eax, byte [ecx]
shl eax, 0x10
cmp dword [ebp + 0xc], 2
jmp 0x55fa63
jb 0x55fa36
movzx edx, byte [ecx + 1]
shl edx, 8
jmp 0x55faa6
push ebp
mov ebp, esp
jmp 0x55fa53
push ebx
jmp 0x55fad2
or eax, edx
jmp 0x55fa36
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x55fa8b
push esi
push edi
mov ecx, eax
jmp 0x55fadc
push 0x3f
mov esi, eax
jmp 0x55fbc4
and edi, edx
jmp 0x55fb1f
jb 0x55fb38
mov edi, eax
shr edi, 6
jmp 0x55faf7
cmp dword [ebp + 0xc], 3
jmp 0x55fb5b
mov edi, dword [ebp + 0xc]
jmp 0x55fb1f
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jmp 0x55fb12
jne 0x55fb79
and eax, edx
mov ebx, eax
jmp 0x55fba7
jmp 0x55fb8f
mov ebx, dword [ebp + 0xc]
jmp 0x55fba7
push 0x3e
pop eax
jmp 0x55fbf1
shr ecx, 0x12
pop edx
shr esi, 0xc
jmp 0x55fb51
jmp 0x592f37
cmp ecx, 0x1a
jae 0x55fbd1
lea edx, [ecx + 0x41]
jmp 0x55fbff
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
jmp 0x55fc0a
cmp esi, 0x1a
jae 0x592ee9
jb 0x592f12
push edi
int 0x5d
and al, 0xd7
arpl di, sp
pop ss
invalid
jmp 0x592ecb
cmp ecx, eax
jae 0x592ea9
lea edx, [ecx - 4]
jmp 0x55fbff
xor edx, edx
cmp ecx, eax
setne dl
jmp 0x592f06
jmp 0x592ebf
cmp esi, 0x34
jae 0x592f72
jb 0x592f5a
adc cl, byte [ebx + 0x3e8d7e1b]
mov byte ss:[0x11a25730], al
cld
popal
stc
retf
lea edx, [edx*4 + 0x2b]
jmp 0x55fbff
lea ecx, [esi + 0x41]
jmp 0x592f1b
jmp 0x592f9b
mov byte [edx + 2], 0x3d
jmp 0x5934a3
cmp ecx, 0x34
jae 0x592ee7
lea edx, [ecx + 0x47]
jmp 0x55fbff
xor ecx, ecx
jmp 0x592f78
lea ecx, [esi + 0x47]
jmp 0x592f1b
cmp esi, eax
jae 0x592f44
jb 0x592f96
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x592f1b
lea ecx, [esi - 4]
cld
jmp 0x592f1b
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jmp 0x592fab
jb 0x592f1d
jae 0x593205
jnp 0x592f98
dec edi
sub bl, cl
pushal
dec edi
rol dword [ebx + 0x26], cl
aad 0x66
fidiv dword [edi - reloc.KERNEL32.dll_LockFile]
cdq
push 0xbf2fb7d9
fisubr dword [ecx]
test byte [ecx + 0x26eb8c1e], 0x91
add bl, byte [esi + 0x12a66b0c]
iretd
mov byte [edx + 2], cl
jmp 0x5934a3
jmp 0x59322b
jmp 0x59320f
jmp 0x59350c
lea ecx, [ecx*4 + 0x2b]
jmp 0x5931c6
cmp edi, 0x1a
jae 0x5931de
lea ecx, [edi + 0x41]
jmp 0x5931c6
cmp edi, eax
jae 0x5931e2
lea ecx, [edi - 4]
jmp 0x5931c6
cmp edi, 0x34
jae 0x5931e0
lea ecx, [edi + 0x47]
jmp 0x5931c6
mov byte [edx + 3], 0x3d
jmp 0x593518
cmp ebx, 0x34
jmp 0x5934bb
cmp dword [ebp + 0xc], 3
jne 0x593449
cmp ebx, 0x1a
jmp 0x593484
jae 0x59345f
lea ecx, [ebx + 0x41]
jmp 0x5934db
cmp ebx, eax
jmp 0x5934c2
jmp 0x593475
xor ecx, ecx
jmp 0x5934f1
jae 0x59348b
lea ecx, [ebx + 0x47]
jmp 0x5934db
jae 0x5934a5
lea ecx, [ebx - 4]
jmp 0x5934db
jmp 0x593538
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x5934db
xor ecx, ecx
cmp edi, eax
setne cl
jmp 0x5931e7
pop edi
jmp 0x59351f
pop esi
pop ebx
pop ebp
jmp 0x59353d
mov byte [edx + 3], cl
jmp 0x593518
ret
Function at 0x560841
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x56085f
mov dword [eax + 4], 0
jmp 0x5608e2
mov dword [eax + 0xc], reloc.KERNEL32.dll_LockFile
jmp 0x560925
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x5608c9
mov dword [eax + 0x10], reloc.KERNEL32.dll_LockFile
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x561090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push sp
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x561075

Function at 0x5835db
Capabilities:
Encode data using xor

Disassembly:
mov bp, ax
pushfd
lea ebp, [eax + ecx]
xchg bp, di
call fcn.005834ed
jmp 0x583559
Function at 0x5973de
Capabilities:
Enumerate pe sections

Disassembly:
push dword [esp + 3]
lea esp, [esp + 8]
jmp 0x597445
mov esi, dword [esp + 0x20]
push edi
test edx, edx
jmp 0x59744c
jmp 0x5974ee
mov eax, dword [edx + 0x3c]
jmp 0x597549
sub esp, 0x14
push ebp
push esi
jmp 0x597419
jne 0x597426
xor eax, eax
xor edi, edi
jmp 0x597517
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x18], ebp
jmp 0x5974d2
movzx edx, word [ecx + 0x14]
lea edi, [ecx + edx + 0x18]
jmp 0x597517
xor eax, eax
mov ecx, dword [edx + 0x3c]
add ecx, edx
jmp 0x59748e
movzx eax, word [eax + 6]
push ebx
jmp 0x597572
mov dword [esp + 0x10], ecx
cmp esi, dword [edi + 0xc]
jmp 0x5974ff
mov eax, 0x5a4d
cmp word [edx], ax
je 0x59742b
jne 0x5974ab
jae 0x5974b4
cmp dword [eax + 0x54], esi
jmp 0x597542
mov ebp, dword [eax + 0x38]
jmp 0x597474
and eax, esi
pop esi
pop ebp
jmp 0x597529
add esp, 0x14
ret
pop edi
sbb eax, eax
not eax
jmp 0x59751f
add eax, edx
jmp 0x5974ad
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
jmp 0x597657
nop
mov ebx, dword [edi + 0xc]
mov esi, dword [edi]
jmp 0x5975e5
jmp 0x5976d3
xor eax, eax
jmp 0x5976b2
xor edx, edx
mov eax, esi
div ebp
jmp 0x5975c7
mov eax, edx
test edx, edx
jne 0x59762b
je 0x597610
mov ebp, dword [esp + 0x14]
jmp 0x5975ee
mov ecx, dword [edi + 8]
test ebx, ebx
je 0x59758c
jne 0x5975bb
xor edx, edx
mov eax, ecx
div ebp
jmp 0x5975fa
mov dword [esp + 0x10], edx
jmp 0x597614
mov eax, ebp
jmp 0x59762b
test edx, edx
jmp 0x598f54
sub ebp, eax
add esi, ebp
jmp 0x5975cf
mov edx, dword [edi + 4]
jmp 0x59763a
mov ebp, dword [esp + 0x28]
cmp ebp, edx
jb 0x5976ea
jae 0x597692
das
lodsb al, byte [esi]
and al, byte [ebp - 0x4c]
pop es
cmp byte [eax + 0x7b8492e], bh
int1
call 0x1019fbf8
mov es, word [esi - 1]
invalid
test eax, eax
jle 0x5975a5
add edi, 8
jmp 0x597584
mov eax, ebx
sub eax, edx
add eax, ebp
jmp 0x597673
cmp eax, ebx
jb 0x5976ea
sub ecx, dword [esp + 0x10]
jmp 0x5976c9
add esi, edx
cmp ebp, esi
jae 0x5976ea
jb 0x597667
jb 0x5976b2
jae 0x5976ea
sub ch, byte [esi + 0xb65b3c]
popal
in al, 0x7a
sbb eax, 0x48e58ec
lcall 0xe9c5, 0x2fb30cfd
push ss
add dword [eax], eax
add byte [edi - 0x3c], cl
pop edx
cmp eax, 0xaf217bcc
aas
pop edx
test eax, 0x5e35af72
out 0xb6, eax
mov ecx, 0x4c03cb03
and al, 0x14
jmp 0x5977cd
add ecx, ebx
add ecx, dword [esp + 0x14]
cmp eax, ecx
jmp 0x59769a
mov ecx, dword [esp + 0x18]
jmp 0x598549
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
jmp 0x59758c
pop ebp
add esp, 0x14
ret
pop ebx
pop edi
pop esi
jmp 0x59771c
mov dword [esp + 0x18], ecx
jl 0x597585
jge 0x5975a5
inc ecx
add edi, 0x28
cmp ecx, eax
jmp 0x59792c
jne 0x597631
mov dword [esp + 0x10], ebp
jmp 0x597631
Function at 0x40ef97
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40efa6
pop dword [ebp - 0x20]
mov eax, 0x40efa6
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xffd6a7c6
sub dword [ebp - 0x30], 0xb184627b
mov dword [ebp - 0x2c], 0xb114c0c3
add dword [ebp - 0x2c], 0x811e8b82
mov dword [ebp - 0x28], 0xee7d50c3
add dword [ebp - 0x28], 0x5dcef36b
mov dword [ebp - 0x24], 0xefdbda26
sub dword [ebp - 0x24], 0xefdbda26
lea eax, [ebp - 0x30]
push eax
mov eax, 0x529d8ca9
sub eax, 0x5259ebf9
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x395d8c1f
sub dword [ebp - 0x30], 0xc4eb22c9
mov dword [ebp - 0x2c], 0xf7c19a5b
sub dword [ebp - 0x2c], 0xb65538e6
mov dword [ebp - 0x28], 0xe399126e
sub dword [ebp - 0x28], 0x8029a602
mov dword [ebp - 0x24], 0xe556e5e9
add dword [ebp - 0x24], 0x1aa91a17
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbcc923e5
sub eax, 0xbc8583ad
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a654
push 0
call eax
mov ecx, 0x3851
xor ebx, ebx
add ebx, eax
mov edx, 0xcaa80efe
add edx, 0x359d6b02
add edx, dword [ebp - 0x20]
mov edi, 0x993e2ded
add edi, 0x3ccdbd54
xor dword [ebp - 0x1c], esi
mov esi, dword [edx]
add dword [ebp - 0x1c], eax
add esi, edi
xor dword [ebp - 8], edx
mov dword [ebx], esi
add dword [ebp - 0xc], edi
add ebx, 0x7fc5274c
add ebx, 0x803ad8b8
add edx, 4
loop 0x40f0bf
add eax, 0x6c06ec29
add eax, 0x93f9e7ee
mov ebx, eax
add eax, 0x12080770
add eax, 0xedf7f895
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4128d9
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4375ca
call fcn.00433ea9
mov edi, ecx
xor esi, esi
push 0x20a
lea eax, [ebp - 0x224]
push esi
push eax
mov dword [ebp - 0x258], esi
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
call fcn.0040ef97
test al, al
je 0x41299a
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x23c]
call fcn.0040ef97
push str.LogSession
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], esi
call fcn.0040ef97
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.0040c42d
push 0x43f9ae
lea ecx, [ebp - 0x270]
mov esi, eax
call fcn.0040ef97
push eax
mov byte [ebp - 4], 2
mov edx, dword [esi]
lea eax, [ebp - 0x23c]
push eax
mov ecx, esi
call dword [edx + 0x40]
lea ecx, [ebp - 0x270]
call fcn.004023b1
lea ecx, [ebp - 0x254]
call fcn.004023b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.004023b1
mov ecx, edi
call fcn.0041283a
jmp 0x4129c7
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x43fc28
test eax, eax
lea ecx, [ebp - 0x224]
cmovne ecx, edx
push ecx
mov ecx, edi
call fcn.0040ef97
mov eax, edi
call fcn.00433e58
ret