joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403960
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x406a96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
push edi
push 0x40b308
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
push 0x40b308
lea ecx, [esp + 0x14]
mov dword [esp + 0x158], ebx
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [str.CF_M9.exe]
mov ecx, dword [0x40b188]
mov dx, word [0x40b18c]
push ebx
push 2
mov byte [esp + 0x15c], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov word [esp + 0x28], dx
mov dword [0x40b370], ebx
mov dword [0x40b36c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x24]
push eax
push edi
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x403a9d
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push ecx
push 0x40b0b4
push edx
call sub.MFC42.DLL_CString::Format
lea eax, [esp + 0x54]
lea ecx, [esp + 0x1c]
push eax
push 0x40b108
push ecx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x20
test eax, eax
jne 0x403a47
inc dword [0x40b370]
lea esi, [esp + 0x48]
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403a73
cmp cl, bl
je 0x403a6f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403a73
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403a4f
xor eax, eax
jmp 0x403a78
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403a8a
mov eax, dword [esp + 0x2c]
push eax
push ebx
push 1
call ebp
cmp eax, ebx
je 0x403a9d
lea ecx, [esp + 0x24]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
jne 0x403a02
mov eax, dword [0x40b370]
cmp eax, 6
ja case.default.0x403aa7
jmp dword [eax*4 + 0x403b3c]
mov dword [0x40b36c], ebx
jmp case.default.0x403aa7
mov dword [0x40b36c], 1
jmp case.default.0x403aa7
mov dword [0x40b36c], 3
jmp case.default.0x403aa7
mov dword [0x40b36c], 6
jmp case.default.0x403aa7
mov dword [0x40b36c], 0xa
jmp case.default.0x403aa7
mov dword [0x40b36c], 0xf
jmp case.default.0x403aa7
mov dword [0x40b36c], 0x15
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call fcn.00406144
lea ecx, [esp + 0x14]
mov dword [esp + 0x154], 0xffffffff
call fcn.00406144
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 4
Function at 0x403b60
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x406ab6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
push edi
push 0x40b308
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
push 0x40b308
lea ecx, [esp + 0x14]
mov dword [esp + 0x158], ebx
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [str.CF_A10S.exe]
mov ecx, dword [0x40b194]
mov edx, dword [0x40b198]
push ebx
push 2
mov byte [esp + 0x15c], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [0x40b378], ebx
mov dword [0x40b374], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x24]
push eax
push edi
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x403c9b
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push ecx
push 0x40b0b4
push edx
call sub.MFC42.DLL_CString::Format
lea eax, [esp + 0x54]
lea ecx, [esp + 0x1c]
push eax
push 0x40b108
push ecx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x20
test eax, eax
jne 0x403c45
inc dword [0x40b378]
lea esi, [esp + 0x48]
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403c71
cmp cl, bl
je 0x403c6d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403c71
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403c4d
xor eax, eax
jmp 0x403c76
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403c88
mov eax, dword [esp + 0x2c]
push eax
push ebx
push 1
call ebp
cmp eax, ebx
je 0x403c9b
lea ecx, [esp + 0x24]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
jne 0x403c00
mov eax, dword [0x40b378]
cmp eax, 6
ja case.default.0x403ca5
jmp dword [eax*4 + 0x403d3c]
mov dword [0x40b374], ebx
jmp case.default.0x403ca5
mov dword [0x40b374], 1
jmp case.default.0x403ca5
mov dword [0x40b374], 3
jmp case.default.0x403ca5
mov dword [0x40b374], 6
jmp case.default.0x403ca5
mov dword [0x40b374], 0xa
jmp case.default.0x403ca5
mov dword [0x40b374], 0xf
jmp case.default.0x403ca5
mov dword [0x40b374], 0x15
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call fcn.00406144
lea ecx, [esp + 0x14]
mov dword [esp + 0x154], 0xffffffff
call fcn.00406144
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 4
Function at 0x403d60
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x406ad6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
push edi
push 0x40b308
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
push 0x40b308
lea ecx, [esp + 0x14]
mov dword [esp + 0x158], ebx
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [str.CF_T12.exe]
mov ecx, dword [0x40b1a0]
mov dx, word [0x40b1a4]
mov dword [esp + 0x18], eax
mov al, byte [0x40b1a6]
push ebx
push 2
mov byte [esp + 0x15c], 1
mov dword [esp + 0x24], ecx
mov word [esp + 0x28], dx
mov byte [esp + 0x2a], al
mov dword [0x40b380], ebx
mov dword [0x40b37c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x24]
mov edi, eax
push ecx
push edi
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x403ea6
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push edx
push 0x40b0b4
push eax
call sub.MFC42.DLL_CString::Format
lea ecx, [esp + 0x54]
lea edx, [esp + 0x1c]
push ecx
push 0x40b108
push edx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x20
test eax, eax
jne 0x403e50
inc dword [0x40b380]
lea esi, [esp + 0x48]
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403e7c
cmp cl, bl
je 0x403e78
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403e7c
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403e58
xor eax, eax
jmp 0x403e81
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403e93
mov eax, dword [esp + 0x2c]
push eax
push ebx
push 1
call ebp
cmp eax, ebx
je 0x403ea6
lea ecx, [esp + 0x24]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
jne 0x403e0b
mov eax, dword [0x40b380]
cmp eax, 6
ja case.default.0x403eb0
jmp dword [eax*4 + 0x403f44]
mov dword [0x40b37c], ebx
jmp case.default.0x403eb0
mov dword [0x40b37c], 1
jmp case.default.0x403eb0
mov dword [0x40b37c], 3
jmp case.default.0x403eb0
mov dword [0x40b37c], 6
jmp case.default.0x403eb0
mov dword [0x40b37c], 0xa
jmp case.default.0x403eb0
mov dword [0x40b37c], 0xf
jmp case.default.0x403eb0
mov dword [0x40b37c], 0x15
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call fcn.00406144
lea ecx, [esp + 0x14]
mov dword [esp + 0x154], 0xffffffff
call fcn.00406144
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 4
Function at 0x403f60
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x406af6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push ebp
push esi
push edi
push 0x40b308
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
push 0x40b308
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], ebx
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [0x40b17c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40b178]
mov dl, byte [0x40b180]
stosw word es:[edi], ax
mov eax, dword [str.CF_A6A8.exe]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
mov ecx, 0x1f
lea esi, [esp + 0x18]
lea edi, [esp + 0x98]
mov dword [esp + 0x18], eax
mov byte [esp + 0x24], dl
rep movsd dword es:[edi], dword [esi]
push ebx
push 2
mov byte [esp + 0x250], 1
mov dword [0x40b364], ebx
movsw word es:[edi], word [esi]
mov dword [0x40b368], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x118]
push eax
push edi
mov dword [esp + 0x120], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x4040e3
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
push 0x40b0b4
push edx
call sub.MFC42.DLL_CString::Format
lea eax, [esp + 0x148]
lea ecx, [esp + 0x1c]
push eax
push 0x40b108
push ecx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x28]
lea edx, [esp + 0xb0]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x20
test eax, eax
jne 0x404081
inc dword [0x40b368]
lea esi, [esp + 0x13c]
lea eax, [esp + 0x98]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4040b3
cmp cl, bl
je 0x4040af
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4040b3
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40408f
xor eax, eax
jmp 0x4040b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4040cd
mov eax, dword [esp + 0x120]
push eax
push ebx
push 1
call ebp
cmp eax, ebx
je 0x4040e3
lea ecx, [esp + 0x118]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
jne 0x404033
mov eax, dword [0x40b368]
cmp eax, 6
ja case.default.0x4040ed
jmp dword [eax*4 + 0x404184]
mov dword [0x40b364], ebx
jmp case.default.0x4040ed
mov dword [0x40b364], 1
jmp case.default.0x4040ed
mov dword [0x40b364], 3
jmp case.default.0x4040ed
mov dword [0x40b364], 6
jmp case.default.0x4040ed
mov dword [0x40b364], 0xa
jmp case.default.0x4040ed
mov dword [0x40b364], 0xf
jmp case.default.0x4040ed
mov dword [0x40b364], 0x15
lea ecx, [esp + 0x10]
mov byte [esp + 0x248], bl
call fcn.00406144
lea ecx, [esp + 0x14]
mov dword [esp + 0x248], 0xffffffff
call fcn.00406144
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret 4
Function at 0x405bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
mov ecx, dword [ebx + 4]
cmp ecx, edi
je 0x405c05
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebx + 8]
mov dword [ebx + 4], edi
cmp eax, edi
je 0x405c23
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx + 8], edi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, edi
je 0x405d14
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x405d14
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x405d14
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebp
mov dword [ebx + 8], eax
je 0x405d14
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebp
je 0x405d07
mov ecx, edi
mov edi, eax
mov edx, ecx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x20], ebp
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x405cfd
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.00405f20
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 4]
cmp eax, ebp
je 0x405cfd
mov ecx, dword [eax + 8]
mov dword [eax + 8], ebp
cmp ecx, ebp
jne 0x405ced
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
mov ecx, dword [ebx + 4]
cmp ecx, ebp
je 0x405cfa
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [ebx + 4], ebp
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx + 8], ebp
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7d301e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.007d309d
jae 0x7d302a
xor ecx, ecx
call fcn.007d309d
jae 0x7d3054
xor eax, eax
call fcn.007d309d
jae 0x7d3065
mov al, 0x10
call fcn.007d309d
adc al, al
jae 0x7d3046
jne 0x7d3092
stosb byte es:[edi], al
jmp 0x7d302b
call fcn.007d30a9
dec ecx
loop 0x7d3071
mov eax, ebp
call fcn.007d30a7
jmp 0x7d3093
lodsb al, byte [esi]
shr eax, 1
je 0x7d30b9
adc ecx, 2
mov ebp, eax
jmp 0x7d3093
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.007d30a7
cmp eax, 0x7d00
jae 0x7d3091
cmp eax, 0x500
jae 0x7d3092
cmp eax, 0x7f
ja 0x7d3093
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d302b
pop ebp
ret 8
Function at 0x5dd732
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x5dd805
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x3f
pop edi
cmp ebx, 3
jl 0x5dd7a2
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, edi
mov al, byte [eax + 0x30289668]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, edi
mov al, byte [eax + 0x30289668]
inc ecx
mov byte [ecx], al
mov eax, edx
shr eax, 6
and eax, edi
mov al, byte [eax + 0x30289668]
inc ecx
mov byte [ecx], al
inc ecx
and edx, edi
mov al, byte [edx + 0x30289668]
mov byte [ecx], al
jmp 0x5dd7f0
movzx edx, byte [esi]
shl edx, 0x10
cmp ebx, 2
jne 0x5dd7b4
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, edi
mov al, byte [eax + 0x30289668]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, edi
mov al, byte [eax + 0x30289668]
inc ecx
mov byte [ecx], al
inc ecx
cmp ebx, 1
jne 0x5dd7de
push 0x3d
pop edx
jmp 0x5dd7ea
shr edx, 6
and edx, edi
movzx edx, byte [edx + 0x30289668]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
add dword [ebp - 4], 4
sub ebx, 3
inc ecx
add esi, 3
test ebx, ebx
jg 0x5dd751
pop edi
pop esi
mov eax, dword [ebp - 4]
mov byte [ecx], 0
pop ebx
leave
ret 0xc

Function at 0x5e34e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
shr word [ebp + 8], 4
and eax, 0xf
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], 0x31
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], 0x34
mov byte [ebp - 0xb], 0x35
mov byte [ebp - 0xa], 0x36
mov byte [ebp - 9], 0x37
mov byte [ebp - 8], 0x38
mov byte [ebp - 7], 0x39
mov byte [ebp - 6], 0x41
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0x43
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x45
mov byte [ebp - 1], 0x46
mov al, byte [ebp + eax - 0x10]
mov byte [ecx + 3], al
mov eax, dword [ebp + 8]
shr word [ebp + 8], 4
and eax, 0xf
mov al, byte [ebp + eax - 0x10]
mov byte [ecx + 2], al
movzx eax, word [ebp + 8]
mov edx, eax
shr eax, 4
and edx, 0xf
mov dl, byte [ebp + edx - 0x10]
and eax, 0xf
mov al, byte [ebp + eax - 0x10]
mov byte [ecx + 1], dl
mov byte [ecx], al
leave
ret
Function at 0x5f19b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x5f1a41
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0073ebe0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5f1a01
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5f1a23
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x5f1aff
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x5f1a69
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5f1a74
xor eax, eax
jmp 0x5f1ac0
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x5f1a91
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.005f09ac
jmp 0x5f1aa1
cmp ecx, 2
jne 0x5f1aaa
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.005f0ea0
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0073ebe0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x5f1aeb
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x5f1aff
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x5f19bf
pop edi
pop ebx
leave
ret
Function at 0x5f65a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
push edi
push dword [esi]
lea ecx, [ebp - 0xc]
call 0x53b47c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0xa30]
push 0x3025030c
call fcn.005ffecb
and dword [ebp - 4], 0
push 0xa
push dword [ebp - 4]
call 0x599767
mov edi, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
pop ecx
pop ecx
mov ecx, dword [eax + 0x81c]
push edi
call fcn.00614586
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x81c]
push edi
call fcn.0061471b
push edi
mov ebx, eax
call fcn.0073e705
test ebx, ebx
pop ecx
je 0x5f66f8
mov ecx, dword [ebx + 0xa0]
lea eax, [ebp - 8]
push eax
push dword [esi]
mov dword [ebp - 8], 2
call fcn.00614dd3
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x10], 0
lea ecx, [ebp - 8]
je 0x5f665e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call 0x56bb38
mov ecx, eax
call 0x53ba39
test al, al
jne 0x5f66f2
jmp 0x5f66ca
call 0x56bbb7
mov edi, eax
push edi
call fcn.0073ef20
pop ecx
xor ecx, ecx
test eax, eax
jle 0x5f6688
mov dl, byte [ecx + edi]
movzx ebx, dl
mov bl, byte [ebx + 0x30242c28]
xor bl, dl
mov byte [ecx + edi], bl
inc ecx
cmp ecx, eax
jl 0x5f6672
and dword [ebp - 0x14], 0
cmp dword [0x30250300], 0
je 0x5f66bd
mov eax, 0x30250300
mov ebx, eax
push dword [eax]
push edi
call fcn.0053b007
test eax, eax
pop ecx
pop ecx
jne 0x5f66b6
add ebx, 4
cmp dword [ebx], 0
mov eax, ebx
jne 0x5f669c
jmp 0x5f66bd
mov dword [ebp - 0x14], 1
push edi
call fcn.0073e705
cmp dword [ebp - 0x14], 0
pop ecx
je 0x5f66dc
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x270f
jl 0x5f65db
jmp 0x5f66f8
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0xa30]
push 0x3025030c
call fcn.005ff41a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0xa
push dword [ebp - 0x10]
call 0x599767
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x603496
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [eax + 0xbf4]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 8]
push edi
mov ecx, esi
call dword [eax + 0x30]
test al, al
je 0x603646
cmp byte [ebp + 0xc], 0
je 0x603646
push 0x30250ca8
mov ecx, edi
call fcn.00539d60
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x40]
test al, al
jne 0x6034e8
mov ecx, edi
call 0x539b87
jmp 0x603646
push ebx
push edi
lea ecx, [ebp - 0x24]
call fcn.005399e2
lea ecx, [ebp - 0x34]
call fcn.00539af8
mov eax, dword [esi]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x24]
push ecx
mov ecx, esi
mov bl, 1
mov byte [ebp + 0x13], 0
call dword [eax + 0x24]
mov edi, eax
test edi, edi
je 0x603565
test bl, bl
je 0x603553
cmp dword [ebp - 0x38], 1
jne 0x603533
lea ecx, [ebp - 0x34]
call fcn.00539adb
push eax
call fcn.00528094
cmp eax, 8
pop ecx
je 0x603543
mov eax, dword [esi]
lea ecx, [ebp - 0x38]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x28]
mov bl, al
jmp 0x603515
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp + 0x13], 1
call 0x539d41
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x2c]
cmp byte [ebp + 0x13], 0
jne 0x603635
lea eax, [ebp - 8]
push 8
push eax
mov byte [ebp - 0x58], 0x41
mov byte [ebp - 0x57], 0x42
mov byte [ebp - 0x56], 0x43
mov byte [ebp - 0x55], 0x44
mov byte [ebp - 0x54], 0x45
mov byte [ebp - 0x53], 0x46
mov byte [ebp - 0x52], 0x47
mov byte [ebp - 0x51], 0x48
mov byte [ebp - 0x50], 0x4a
mov byte [ebp - 0x4f], 0x4b
mov byte [ebp - 0x4e], 0x4c
mov byte [ebp - 0x4d], 0x4d
mov byte [ebp - 0x4c], 0x4e
mov byte [ebp - 0x4b], 0x50
mov byte [ebp - 0x4a], 0x51
mov byte [ebp - 0x49], 0x52
mov byte [ebp - 0x48], 0x53
mov byte [ebp - 0x47], 0x54
mov byte [ebp - 0x46], 0x55
mov byte [ebp - 0x45], 0x56
mov byte [ebp - 0x44], 0x57
mov byte [ebp - 0x43], 0x58
mov byte [ebp - 0x42], 0x59
mov byte [ebp - 0x41], 0x5a
mov byte [ebp - 0x40], 0x32
mov byte [ebp - 0x3f], 0x33
mov byte [ebp - 0x3e], 0x34
mov byte [ebp - 0x3d], 0x35
mov byte [ebp - 0x3c], 0x36
mov byte [ebp - 0x3b], 0x37
mov byte [ebp - 0x3a], 0x38
mov byte [ebp - 0x39], 0x39
call fcn.005e4854
test al, al
pop ecx
pop ecx
je 0x60362d
xor eax, eax
xor ecx, ecx
mov cl, byte [ebp + eax - 8]
and ecx, 0x1f
mov cl, byte [ebp + ecx - 0x58]
mov byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 8
jl 0x6035f8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0xc], 0
call fcn.00539d60
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
test al, al
jne 0x603635
mov ecx, dword [ebp + 8]
call 0x539b87
lea ecx, [ebp - 0x34]
call fcn.0053995d
lea ecx, [ebp - 0x24]
call fcn.0053995d
pop ebx
pop edi
pop esi
leave
ret