joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call method.std::time_get_char__std::istreambuf_iterator_char__std::char_traits_char_____._M_extract_num_std::istreambuf_iterator_char__std::char_traits_char_____std::istreambuf_iterator_char__std::char_traits_char_____int__int__int__unsigned_int__std::ios_ba
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x465000
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x465038
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x464fd8
test al, al
jne 0x465010
mov ebx, esi
cmp bl, al
jne 0x464fe8
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x464fb3
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x464fd8
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x464fd8
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x464fca
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x464fca
Function at 0x465360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES3_S3_RiPPKcjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4654b0
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x4654e8
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x465490
test al, al
jne 0x4654c0
cmp dl, al
jne 0x46549e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x46546f
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x465490
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x465490
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x465482
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x465482
Function at 0x4680d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x468240
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x468268
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x468222
test al, al
jne 0x468250
cmp bl, cl
jne 0x468230
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x4681fd
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x468290
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x468222
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x4682a8
movzx eax, word [eax]
cmp ax, 0xffff
mov ebx, 0
mov ebp, 0
cmove ebx, esi
cmovne ebp, ecx
jmp 0x46820f
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x46825b
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x468273
Function at 0x485000
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x485023
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x485041
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x485018
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0xd8e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d8e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd8e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e06a
add dl, dl
jne 0xd8e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e0dc
xor eax, eax
add dl, dl
jne 0xd8e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e17d
add dl, dl
jne 0xd8e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd8e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd8e075
mov eax, 1
add dl, dl
jne 0xd8e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e0e1
sub eax, ebx
mov ebx, 1
jne 0xd8e128
mov ecx, 1
add dl, dl
jne 0xd8e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e136
cmp eax, 0x7d00
jae 0xd8e16d
cmp eax, 0x500
jb 0xd8e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
cmp eax, 0x7f
ja 0xd8e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd8e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd8e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x55b3ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65d990]
jne 0x55b3f4
repz ret
jmp fcn.0055e0dc

Function at 0x55fbbf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0055b4ec
and dword [ebp - 4], 0
cmp dword [0x65f6ec], 0
mov ebx, eax
jne 0x55fc70
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55fd21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x55fd21
push eax
call fcn.0055b47a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x65f6ec], eax
call esi
push eax
call fcn.0055b47a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x65f6f0], eax
call esi
push eax
call fcn.0055b47a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x65f6f4], eax
call esi
push eax
call fcn.0055b47a
pop ecx
mov dword [0x65f6fc], eax
test eax, eax
je 0x55fc70
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0055b47a
pop ecx
mov dword [0x65f6f8], eax
mov eax, dword [0x65f6f8]
cmp eax, ebx
je 0x55fcc8
cmp dword [0x65f6fc], ebx
je 0x55fcc8
push eax
call fcn.0055b4f5
push dword [0x65f6fc]
mov esi, eax
call fcn.0055b4f5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x55fcc8
test edi, edi
je 0x55fcc8
call esi
test eax, eax
je 0x55fcbf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55fcbf
test byte [ebp - 0xc], 1
jne 0x55fcc8
or dword [ebp + 0x10], 0x200000
jmp 0x55fd01
mov eax, dword [0x65f6f0]
cmp eax, ebx
je 0x55fd01
push eax
call fcn.0055b4f5
pop ecx
test eax, eax
je 0x55fd01
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x55fd01
mov eax, dword [0x65f6f4]
cmp eax, ebx
je 0x55fd01
push eax
call fcn.0055b4f5
pop ecx
test eax, eax
je 0x55fd01
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x65f6ec]
call fcn.0055b4f5
pop ecx
test eax, eax
je 0x55fd21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55fd23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x560a73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x65d410]
add ecx, 0xffffea48
mov dword [0x65d414], ecx
mov dword [ebp - 0x10], eax
call fcn.00561ede
xor ecx, ecx
mov edx, eax
mov dword [0x65d410], 0x249c
mov esi, dword [eax + 0x3c]
mov dword [0x65d414], 0x19ce
mov dword [0x65d410], 0xfffff674
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x65d410], 0xffffecdd
mov ebx, dword [eax + esi + 0x24]
mov dword [0x65d414], 0x23a3
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x560bfa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
jmp 0x560b19
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
je 0x560b90
mov al, byte [ebp - 0x49]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x48]
add edx, 1
mov byte [ebp - 0x4b], cl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x4a]
mov ch, byte [ebp - 0x4b]
and dl, ch
and dl, cl
test dl, 1
mov dword [ebp - 0x44], eax
jne 0x560b33
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x560bcd
jmp 0x560b99
xor eax, eax
mov dword [0x65d414], 0xffffe6b4
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], eax
jb 0x560b19
jmp 0x560bfa
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x65d414], 0x17f3
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x65d410], 0x16e6
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x560c05
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword [0x65d410]
add eax, 0xfffff45e
mov dword [0x65d414], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x65d410], 0xeb8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x65d414], 0x240e
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x560c81
mov dword [0x65d410], 0xffffec1d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x560d1f
jmp 0x560d5b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x560cae
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x560c81
mov eax, dword [ebp - 0x20]
mov dword [0x65d410], 0x2db
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x560d5b
mov dword [0x65d410], 0xffffdf97
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x560d5b
mov dword [0x65d410], 0xc2b
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff5
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x61
jne 0x560d5b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x560c54
jmp 0x560d5b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x560d5b
mov dword [0x65d410], 0xa99
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x560d5b
mov dword [0x65d410], 0x834
mov eax, 1
mov dword [ebp - 0x28], eax
jmp 0x560d6a
xor eax, eax
mov dword [0x65d414], 0x237b
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret
Function at 0x560f22
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x65d410], 0x42d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x561125
jmp 0x560ff1
mov eax, dword [ebp - 0x1c]
mov ecx, 0x1749
mov edx, dword [ebp - 0x20]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov word [ebp - 0x2a], si
mov word [ebp - 0x2c], bx
jb 0x560fa6
mov ax, word [ebp - 0x2a]
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov esi, dword [ebp - 0x28]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x34], esi
jne 0x5610fa
jmp 0x5610db
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
jmp 0x561125
mov dword [0x65d414], 0xf8f
mov dword [0x65d410], 0x139d
mov ecx, dword fs:[0x18]
mov dword [0x65d410], 0x1ee6
mov dword [0x65d414], 0x1798
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [0x65d410], 0x20bd
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], dl
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
jmp 0x56104f
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
cmp eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
je 0x561125
mov eax, dword [ebp - 0x38]
mov cx, word [eax + 0x24]
mov dword [0x65d414], 0x62f
mov edx, dword [eax + 0x28]
mov dword [0x65d410], 0x1544
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x41]
and bh, bl
test bh, 1
mov word [ebp - 0x4a], cx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x50], esi
jne 0x560fdb
xor eax, eax
mov dword [0x65d410], 0x151b
mov cx, word [ebp - 0x4a]
shr cx, 1
movzx edx, cx
cmp cx, 0
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], esi
je 0x56104f
jmp 0x560f6a
mov eax, 0x1a2c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov edx, dword [ebp - 0x54]
cmp ecx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], eax
jb 0x560f6a
mov eax, dword [ebp - 0x34]
mov dword [0x65d414], 0xd66
mov dword [0x65d410], eax
mov cl, byte [ebp - 0x2d]
test cl, 1
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], edx
jne 0x561125
jmp 0x56104f
mov eax, dword [ebp - 0x18]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x561264
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x65d41c], 0
mov byte [0x65d420], 0
mov edi, dword [0x65d410]
add edi, 0xffffe890
mov dword [0x65d414], edi
mov dword [0x65d418], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [0x65d410], 0x842
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x65d414], 0xfb4
mov eax, dword [0x65d418]
add eax, 1
mov dword [0x65d418], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x5612b1
mov dword [0x65d410], 0x41d
mov eax, 0x41d
xor ecx, ecx
mov dword [0x65d418], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x65d424], 0
mov esi, dword [0x65d41c]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x65d424], ebx
add ecx, 0x260d
mov dword [0x65d414], ecx
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x65d41c], edx
mov dword [0x65d410], 0xffffe2de
mov ebx, dword [ebp - 0x28]
mov cl, byte [edi + ebx]
mov byte [0x65d420], cl
mov dword [0x65d414], 0x1ec0
mov cl, byte [edi + edx]
mov byte [edi + ebx], cl
mov dword [0x65d410], 0x210a
mov cl, byte [0x65d420]
mov edx, dword [0x65d41c]
mov byte [edi + edx], cl
mov edx, dword [0x65d418]
add edx, 1
mov dword [0x65d418], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jge 0x5613d7
mov eax, dword [0x65d410]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x56130c
mov dword [0x65d410], 0xf79
mov dword [0x65d414], 0xcbe
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56154e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x65d414], 0xcb1
mov dword [0x65d410], 0x2d58
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x56157b
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x60fd24]
mov dh, byte [eax + 0x60fcf5]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
jne 0x56157b
lea eax, [ebp - 0x20]
mov dword [0x65d410], 0x2381
mov dword [0x65d414], 0xf0d
mov dword [ebp - 0x30], eax
call fcn.005616fe
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.005617df
xor ecx, ecx
mov dword [0x65d410], 0xe97
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x5616c4
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x65d414]
mov edx, ecx
add edx, 0x6ec
mov dword [0x65d410], edx
add ecx, 0xffffe1e6
mov dword [0x65d414], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x65d410]
add ecx, 0xea9
mov dword [0x65d410], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.00561130
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x10], ecx
mov dword [0x65d414], 0x1a18
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x58], ecx
mov dword [0x65d410], 0x1388
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x5616c4
mov eax, dword [ebp - 0x3c]
add eax, 0x263e
mov dword [0x65d410], 0x1dc3
mov dword [0x65d414], 0x12c2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret