joyce8/EMBER2024-capa huggingface dataset:
Function at 0x543b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x58
call fcn.00402e40
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret

Function at 0x543f6c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x2c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov eax, 0x801464
mov ecx, 0x48
call fcn.00402a38
mov edx, dword [ebp - 4]
add edx, 0x48
mov eax, 0x8014ac
mov ecx, 0x1000
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shl eax, 8
mov edx, dword [ebp - 0xc]
movzx edx, byte [ebp + edx - 0x2c]
or eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jl 0x543fdf
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x543fbe
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor dword [eax + edx*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x12
jne 0x543fb4
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov cl, 1
call fcn.0054409c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4 + 4], ecx
add dword [ebp - 8], 2
cmp dword [ebp - 8], 0x11
jle 0x54400c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov cl, 1
call fcn.0054409c
mov eax, dword [ebp - 0xc]
shl eax, 7
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + edx*4 + 0x48], ecx
mov eax, dword [ebp - 0xc]
shl eax, 7
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4 + 0x4c], ecx
add dword [ebp - 8], 2
cmp dword [ebp - 8], 0xff
jle 0x544046
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jne 0x544041
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x544ba4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
mov ecx, 0x58
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0x67452301
mov dword [ebp - 0x50], 0xefcdab89
mov dword [ebp - 0x4c], 0x98badcfe
mov dword [ebp - 0x48], 0x10325476
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x5c]
mov ecx, 0x58
call fcn.00402a38
mov esp, ebp
pop ebp
ret

Function at 0x5452b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [0x8024ec]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
mov ecx, dword [0x8024ec]
and ecx, 0xf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
shl eax, cl
mov dx, word [ebp - 0xc]
or dx, word [ebp - 8]
movzx edx, dx
shl edx, 0x10
mov cx, word [ebp - 0xa]
or cx, word [ebp - 6]
movzx ecx, cx
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [0x8024ec], eax
inc dword [0x8024ec]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x5452b9
mov esp, ebp
pop ebp
ret
Function at 0x549554
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5496d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x1000
jle 0x5495b3
lea edx, [ebp - 0x1024]
mov eax, dword [0x840898]
call fcn.00405e74
mov ecx, dword [ebp - 0x1024]
mov dl, 1
mov eax, dword [0x408390]
call fcn.0040d0bc
call fcn.004038cc
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dl, byte [ebp + 8]
mov byte [ebp + eax - 0x1020], dl
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x7f
jle 0x549646
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, 0xff
cdq
idiv ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5495f5
mov dword [ebp - 0x10], 1
mov al, byte [ebp - 0x10]
or al, 0x80
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x1020], al
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x54963d
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and al, 0xff
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x1020], al
mov eax, dword [ebp - 0xc]
shr dword [eax], 8
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x54961b
mov eax, dword [ebp - 0x10]
inc eax
add dword [ebp - 0x18], eax
jmp 0x549658
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x1020], al
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x1000
jle 0x549695
lea edx, [ebp - 0x1024]
mov eax, dword [0x840898]
call fcn.00405e74
mov ecx, dword [ebp - 0x1024]
mov dl, 1
mov eax, dword [0x408390]
call fcn.0040d0bc
call fcn.004038cc
mov eax, dword [ebp - 0x18]
lea edx, [ebp + eax - 0x1020]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
call fcn.00402a38
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1020]
call fcn.00402a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5496dd
lea eax, [ebp - 0x1024]
call fcn.00403e74
ret
Function at 0x5515c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x104], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x105], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xd], 0
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax + 4], cl
mov al, byte [ebp - 0xd]
add al, 0xd
and al, 0xff
xor edx, edx
mov dl, byte [ebp - 0xd]
mov byte [ebp + edx - 0x10e], al
mov eax, dword [ebp - 8]
call fcn.004040f0
test eax, eax
jle 0x551653
mov eax, dword [ebp - 8]
call fcn.004040f0
push eax
xor eax, eax
mov al, byte [ebp - 0xd]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 8]
mov bl, byte [eax + edx]
mov eax, dword [ebp - 8]
call fcn.004040f0
add bl, al
xor eax, eax
mov al, byte [ebp - 0xd]
xor byte [ebp + eax - 0x10e], bl
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
jne 0x5515f5
mov byte [ebp - 0xd], 0
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax + 4]
add eax, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ebp - 0xd]
movzx edx, byte [ebp + edx - 0x10e]
add eax, edx
and eax, 0x800000ff
jns 0x55168d
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 4]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 4]
xor edx, edx
mov dl, byte [ebp - 0xd]
mov ecx, dword [ebp - 4]
mov byte [ecx + edx + 4], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xe]
mov byte [edx + eax + 4], cl
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
jne 0x551660
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x551cb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x5c]
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xffffff
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 0x15]
movzx eax, byte [ebp + eax - 0x5c]
xor eax, dword [ebp - 8]
and eax, 0xff
mov eax, dword [eax*4 + 0x80a0a0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
inc byte [ebp - 0x15]
cmp byte [ebp - 0x15], 0x47
jne 0x551cd1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x552ca8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, 4
call fcn.004027d4
mov dword [ebp - 0xc], eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.004027ec
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x5530c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
xor eax, eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x164]
mov edx, dword [0x408370]
call fcn.00404770
xor eax, eax
push ebp
push 0x5532c0
dec dword [ecx - 0x16f7b]
dec dword [ecx - 0x1737b]
dec dword [ebp - 0x1637b]
dec dword [ebx + 0x40837015]
add al, ch
adc byte [esi], 0xeb
push dword [ebx]
rcl byte [ebp + 0x68], 0xc0
xor dl, byte [ebp]
push dword fs:[eax]
mov dword fs:[eax], esp
push edx
push edi
push ebp
xor edx, edx
call fcn.00553206
bound esp, qword [edx + edx*2 + 0x64]
xchg ebx, eax
out dx, al
rol al, cl
test al, 0x44
mov ch, byte [edx - 0x50fd06b1]
dec edi
adc eax, 0xf6008290
jae 0x5530d0
xchg esp, eax
stosd dword es:[edi], eax
mov dh, 0x52
jg 0x55318e
xor ch, byte [ebx]
inc edx
insd dword es:[edi], dx
and ebp, dword cs:[ecx + 0x7b]

Function at 0x553304
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x164]
mov edx, dword [0x408370]
call fcn.00404770
xor eax, eax
push ebp
push 0x5534e7
push dword fs:[eax]
dec dword [ecx - 0x16b7b]
dec dword [ecx - 0x16f7b]
dec dword [ebp - 0x1637b]
dec dword [ebx + 0x40837015]
add al, ch
adc al, 0xeb
push dword [ebx]
rcl byte [ebp + 0x68], 0xe7
xor al, 0x55
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
push edx
push edi
push ebp
xor edx, edx
call fcn.0055342d
bound esp, qword [edx + edx*2 + 0x64]
xchg ebx, eax
out dx, al
rol al, cl
test al, 0x44
mov ch, byte [edx - 0x50fd06b1]
dec edi
adc eax, 0xf6008290
jae 0x553314
xchg esp, eax
stosd dword es:[edi], eax
mov dh, 0x52
jg 0x5533d2
xor ch, byte [ebx]
inc edx
insd dword es:[edi], dx
and ebp, dword cs:[ecx + 0x7b]
Function at 0x572d7f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov esi, dword [ebp + 0x30]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
xor ebx, ebx
fld dword [0x572e57]
fmul qword [ebp - 8]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.00505964
add esp, 8
fmul qword [ebp + 0x18]
fadd qword [ebp + 8]
fstp qword [ebp - 0x18]
fld dword [0x572e5b]
fmul qword [ebp - 8]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.00505964
add esp, 8
fmul qword [ebp + 0x20]
fsubr qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld dword [0x572e5f]
fmul qword [ebp - 8]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.00505964
add esp, 8
fmul qword [ebp + 0x28]
fadd qword [ebp - 0x20]
fdiv qword [ebp + 0x10]
fsub qword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00505a74
add esp, 8
fcomp qword [0x572e63]
fnstsw ax
sahf
ja 0x572e29
xor edx, edx
mov dword [esi], edx
fld qword [ebp - 8]
jmp 0x572e51
inc ebx
cmp ebx, 0xf
jl 0x572d98
push 0x80f122
push 0x80f0f2
call fcn.00571de8
add esp, 8
mov dword [esi], 3
fld qword [0x572e6b]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57e134
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x57e1ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004040f0
test eax, eax
jle 0x57e185
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
xor byte [ebp - 9], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x57e170
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 2
call fcn.004094d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e1b4
lea eax, [ebp - 4]
call fcn.00403e74
ret
Function at 0x57fa60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x57fad9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004040f0
test eax, eax
jle 0x57fab1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
xor byte [ebp - 9], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x57fa9c
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 2
call fcn.004094d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57fae0
lea eax, [ebp - 4]
call fcn.00403e74
ret

Function at 0x57fae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x57fb4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.004040f0
test eax, eax
jle 0x57fb32
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
xor byte [ebp - 6], al
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x57fb1d
mov al, byte [ebp - 6]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57fb55
lea eax, [ebp - 4]
call fcn.00403e74
ret
Function at 0x59d3e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x59d44d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 4]
call fcn.0059d458
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x22]
call fcn.0040a21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d454
lea eax, [ebp - 4]
call fcn.00403e74
ret

Function at 0x59dfac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004042a4
xor eax, eax
push ebp
push 0x59e100
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0xa]
mov edx, dword [ebp - 4]
mov word [edx + 0xc], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.0059d0d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x20], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1e]
mov edx, dword [ebp - 4]
mov word [edx + 0x22], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x20]
mov edx, dword [ebp - 4]
mov word [edx + 0x24], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x22]
mov edx, dword [ebp - 4]
mov word [edx + 0x26], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov word [edx + 0x28], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x26]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409be0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0059e668
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409abc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0059e6f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e107
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403e98
ret
Function at 0x59e10c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004042a4
xor eax, eax
push ebp
push 0x59e260
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax + 6], 0
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 0xc], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa]
call fcn.0059d0d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1a]
mov edx, dword [ebp - 4]
mov word [edx + 0x20], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x22], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x24], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x26], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x28], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
cmp dword [ebp - 0xc], 0
je 0x59e222
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409be0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0059e668
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409abc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0059e6f0
jmp 0x59e236
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059e668
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059e6f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e267
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403e98
ret
Function at 0x59ea60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00413e58
cmp eax, 0x16
jl 0x59ebf4
mov eax, dword [ebp - 8]
call fcn.00413e58
mov edx, 0xfff8
call fcn.0059ceb0
mov word [ebp - 0x12], ax
movzx edx, word [ebp - 0x12]
neg edx
mov cx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, word [ebp - 0x12]
call fcn.004027d4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x59ebed
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ecx, word [ebp - 0x12]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x12]
cmp eax, dword [ebp - 0x20]
je 0x59eae9
call fcn.0040396c
jmp 0x59ebf4
movzx eax, word [ebp - 0x12]
sub eax, 0x16
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x59eb35
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
jl 0x59eb11
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
cmp byte [eax + edx], 0x50
jne 0x59eafc
cmp dword [ebp - 0x1c], 0
jl 0x59eb41
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0x6054b50
je 0x59eb35
dec dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 0
jl 0x59eb41
cmp dword [ebp - 0x18], 0
je 0x59eaff
cmp dword [ebp - 0x18], 0
jne 0x59eb51
call fcn.0040396c
jmp 0x59ebf4
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 4]
mov edx, dword [ebp - 0x24]
mov word [edx + 4], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 6]
mov edx, dword [ebp - 0x24]
mov word [edx + 6], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 8]
mov edx, dword [ebp - 0x24]
mov word [edx + 8], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xa]
mov edx, dword [ebp - 0x24]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0x14]
mov edx, dword [ebp - 0x24]
mov word [edx + 0x14], ax
mov eax, dword [ebp - 8]
call fcn.00413e58
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x18]
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ebf4
movzx edx, word [ebp - 0x12]
mov eax, dword [ebp - 0x10]
call fcn.004027ec
ret
mov al, byte [ebp - 9]
pop ebx
mov esp, ebp
pop ebp
ret