joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c047
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.005a3179
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.005a3179
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.005a3179
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.005a9260
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x58c100
mov eax, 0
jmp 0x58c26c
cmp dword [ebp + 0xc], 0
jne 0x58c136
mov dword [ebp - 0x18], esp
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x58c133
push 0xa0
push 0x4023034
push 6
call fcn.005a3185
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x58c15e
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x58c158
push ebx
call fcn.005a317f
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x58c193
push 0x104
push 0x4023034
push 6
call fcn.005a3185
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x6c667a
call dword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x58c1c9
push 0x12e
push 0x4023034
push 6
call fcn.005a3185
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x58c267
push 0x225
push 0x4023034
push 6
call fcn.005a3185
add esp, 0xc
jmp 0x58c26c
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.005a317f
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.005a317f
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.005a317f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5a28cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x5a28f1
mov eax, 0x6c679d
push eax
push 1
mov ebx, 0x194
call fcn.005a4000
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5a2945
push 0x4e
push 0x4022e97
push 6
call fcn.005a3185
add esp, 0xc
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0056c9c3
mov eax, dword [ebp - 4]
jmp 0x5a295e
mov esp, ebp
pop ebp
ret 8

Function at 0x5a58e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x5a5949
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.005a3b60
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x5a5af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x5a5b82
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x5a5b74
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x5a5b6c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x5a5b35
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x5a6000
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x5a601e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x5a6013
pop esi
ret
Function at 0x5a6270
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.005aa700
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x5a63c0
test ecx, ecx
je 0x5a63c0
inc ecx
push ecx
call fcn.005ab9b7
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005ab990
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5a62e9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x5a63ad
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.005ab9b7
add esp, 4
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x5a6371
cmp eax, 0xea
jne 0x5a6399
push esi
call fcn.005ab979
mov ecx, dword [esp + 0x18]
push ecx
call fcn.005ab9b7
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x5a633c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x5a637f
cmp eax, 2
jne 0x5a6399
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.005a9fe0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.005ab979
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebp
call fcn.005ab979
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x5a63ee
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x5a63fa
mov edx, dword [esp + 0x40]
test edx, edx
je 0x5a63fa
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.005a9fe0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5a8380
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x11c
test eax, eax
jne 0x5a83a4
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x5a8402
jmp 0x5a83c6
mov edx, dword [esp + 0x124]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x5a8402
mov cl, byte [edx]
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x18], cl
lea edx, [esp + 8]
lea eax, [esp]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x2a], 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x5a8402
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, 0xa
call fcn.005abaa0
add esp, 0x11c
ret
or eax, 0xffffffff
add esp, 0x11c
ret

Function at 0x5a8500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x5a853d
lea ecx, [esp + 4]
push ecx
call fcn.005a99e0
lea edx, [esp + 8]
push eax
push edx
call fcn.005a9fe0
add esp, 0xc
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x5a8560
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.005aa700
mov esi, dword [esp + 0x138]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], edx
test ebp, ebp
je 0x5a864e
test ecx, ecx
je 0x5a864e
inc ecx
push ebx
push ecx
call fcn.005ab9b7
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.005ab990
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5a85e2
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x5a8636
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x5a8623
cmp eax, 0xea
jne 0x5a862b
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebx
call fcn.005ab979
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x114
ret
Function at 0x5a8660
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x5a86a1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x5a86a1.2
jmp dword [eax*4 + 0x5a872c]
mov word [esp + 0x48], di
jmp 0x5a86da
mov word [esp + 0x48], 2
jmp 0x5a86da
mov word [esp + 0x48], 3
jmp 0x5a86da
mov word [esp + 0x48], 4
jmp 0x5a86da
mov word [esp + 0x48], 7
jmp 0x5a86da
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x5a8724
cmp dword [esp + 0x70], edi
je 0x5a8710
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x5a8b20
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x5a8b9f
push edi
call fcn.005a99e0
add esp, 4
test eax, eax
jbe 0x5a8b9f
test esi, esi
je 0x5a8b5d
cmp esi, 0xffffffff
je 0x5a8b5d
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x5a8be1
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x5a8b8b
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x5a8b9f
jmp 0x5a8b9a
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x5a8b9f
mov ebp, 1
test esi, esi
je 0x5a8be1
cmp esi, 0xffffffff
je 0x5a8be1
test ebp, ebp
jne 0x5a8c18
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x5a8bee
call edi
test eax, eax
je 0x5a8be1
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x5a8c18
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x5a8bc9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x5a8be1
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x5a8c18
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x5a8bfb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call fcn.005a99e0
inc eax
push eax
call fcn.005a3b60
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret

Function at 0x5ba0e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x92f824]
xor edx, edx
cmp eax, edx
jne 0x5ba106
xor eax, eax
mov byte [eax + 0x92f724], al
inc eax
cmp eax, 0x100
jl 0x5ba0ee
mov dword [0x92f824], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x92f724
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5ba197
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5ba16a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5ba138
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x5ba210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5ba263
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5ba24a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c0c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6052ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005c1520
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x6a8844
call fcn.005f6095
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5c0c93
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005f6095
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5c0c8c
push 0
mov ecx, eax
call fcn.005b7d20
mov dword [esi + 0xc], eax
jmp 0x5c0c95
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5c0c95
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x5d20c0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x5d20d0
mov esi, 1
push esi
call fcn.005e3137
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5d2122
call fcn.005e3c3d
mov edi, eax
call fcn.005d4c10
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x5d2106
mov edx, dword [0x84ef60]
mov dword [0x84ef5c], edx
test al, 0x18
je 0x5d2117
push esi
push 0x24
push 5
call fcn.005d5460
add esp, 0xc
test edi, edi
je 0x5d213d
push 1
call fcn.005e4e0b
test byte [esp + 0x14], 0x20
je 0x5d213d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x5d3240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x5d3334
cmp byte [edx], 0
je 0x5d3327
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.005d31c0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.005d31c0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.005d3130
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x5d32f1
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.005d3170
fmul qword [0x6a90e0]
push ecx
fstp qword [esp]
call fcn.005e1a48
fadd qword [0x6a90d8]
add esp, 8
call fcn.005e1b18
mov byte [ebx], al
inc ebx
dec edi
jne 0x5d32c4
lea ecx, [esp + 0x20]
push ecx
call fcn.005d3170
fmul qword [0x6a90e0]
push ecx
fstp qword [esp]
call fcn.005e1a48
add esp, 8
call fcn.005e1b18
cmp esi, ebx
je 0x5d331d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x5d3316
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d3700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x5d3730
mov byte [edi + esi], 2
jmp 0x5d3767
test al, 4
je 0x5d373a
mov byte [edi + esi], 0xd
jmp 0x5d3767
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x5d3753
mov byte [edi + esi], 2
jmp 0x5d3767
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x5d3763
mov byte [edi + esi], 0x19
jmp 0x5d3767
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x5d3717
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x5d37db
cmp dl, 0xd
je 0x5d37db
xor edx, edx
jmp 0x5d37e0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x5d37cb
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x5d3800
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.005d20c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5d3821
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.005d4e50
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x5d3846
push esi
call fcn.005d2150
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.005edbfc
push ebx
push edi
mov ebp, eax
call fcn.005d4ec0
push 0x5d3880
push ebp
push esi
call fcn.005d61f0
push esi
call fcn.005d2150
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret