joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b1cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x819e79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push edi
test eax, eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
je 0x5b1d5b
mov dword [esi + 8], 0x869668
mov dword [esi + 0xcc], 0x86965c
mov eax, dword [esi + 0xcc]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0xcc], 0x866dbc
mov edx, dword [esi + 0xcc]
mov eax, dword [edx + 8]
mov dword [esi + eax + 0xcc], 0x866d90
mov ecx, dword [esi + 0xcc]
mov dword [esi + 0xc8], 0x866d78
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0xcc], 0x866d68
mov eax, dword [esi + 0xcc]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 0xcc], 0x866d3c
lea edi, [esi + 4]
push 0
mov ecx, edi
mov dword [esp + 0x24], edi
call fcn.0058e460
push 1
lea ecx, [edi + 0x30]
mov dword [esp + 0x1c], 0
call fcn.0058f3b0
mov edx, dword [edi + 4]
mov dword [edi], 0x869650
mov eax, dword [edx + 8]
mov dword [eax + edi + 4], 0x869640
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
mov dword [edx + edi + 4], 0x869614
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0xc]
mov dword [ecx + edi + 4], 0x8695fc
lea ecx, [esi + 0xac]
mov dword [esp + 0x18], 1
call fcn.005ecc50
mov edx, dword [esi + 8]
mov dword [esi], 0x8695ec
mov dword [edi], 0x8695e0
mov eax, dword [edx + 8]
mov dword [eax + esi + 8], 0x8695d0
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 8], 0x8695a4
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
mov dword [ecx + esi + 8], 0x86958c
mov edx, dword [esi + 8]
mov dword [esi], 0x86957c
mov dword [edi], 0x869570
mov eax, dword [edx + 8]
pop edi
mov dword [eax + esi + 8], 0x869560
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 8], 0x869534
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
mov eax, esi
mov dword [ecx + esi + 8], 0x86951c
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x5b22a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81a047
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0xc], ebp
lea esi, [ebp - 8]
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], esi
lea edi, [esi - 0x44]
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 4
call fcn.005a9910
lea ecx, [edi + 0x1c]
mov byte [esp + 0x20], 3
call fcn.00477f50
lea ecx, [edi + 4]
mov byte [esp + 0x20], 2
call fcn.00477f50
lea ecx, [esi - 0x48]
mov byte [esp + 0x20], 1
call fcn.0058f120
lea ecx, [esi - 0x48]
mov byte [esp + 0x20], 0
call fcn.0058eed0
lea ecx, [ebp - 0xa0]
mov dword [esp + 0x20], 0xffffffff
call fcn.005e579e
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5b68d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81a4f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 4]
lea eax, [esi + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.005ef90e
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x24], 0
call fcn.005ed0cb
mov edx, dword [esp + 0xc]
mov esi, eax
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.005f0ad8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x5b68e8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81a4f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 4]
lea eax, [esi + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.005ef90e
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x24], 0
call fcn.005ed0cb
mov edx, dword [esp + 0xc]
mov esi, eax
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.005f0ad8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x5b6b80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x81a59f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0xc]
push eax
call fcn.005b6c10
add esi, 0xc
mov dword [esp + 0x24], 1
push esi
mov esi, dword [esp + 0x30]
push eax
push esi
call fcn.005b6650
add esp, 0xc
mov dword [esp + 4], 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.005f0ad8
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x5b6c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81a5cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.005ecca2
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], 1
push ecx
mov ecx, eax
call fcn.005eeac5
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
call fcn.005ecca2
mov dword [esp + 4], 1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.005f0ad8
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x5b70f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x81a670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 0x38]
push ebx
mov bl, byte [esp + 0x3c]
push esi
push edi
xor edi, edi
test bl, bl
mov dword [esp + 0xc], edi
jne 0x5b7180
mov ebx, dword [esp + 0x40]
push ebp
push edi
mov ecx, ebx
mov byte [ebx], al
call fcn.00404c40
mov edi, 0x910ef0
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00404a50
test al, al
je 0x5b716b
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x910ef0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.004049b0
pop ebp
pop edi
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
call fcn.00404c40
test bl, bl
mov dword [esp + 0x38], edi
jbe 0x5b71f1
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
xor edx, edx
and eax, 0xff
lea ecx, [esp + 0x10]
div esi
push ecx
lea ecx, [esp + 0x24]
cmp dl, 0xa
mov ebx, eax
sbb al, al
and al, 0xd9
add al, 0x57
add al, dl
push eax
push ecx
call fcn.005bb9d0
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 1
call fcn.00402e90
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 0
call fcn.00404c40
test bl, bl
mov byte [esp + 0x44], bl
ja 0x5b719a
mov esi, dword [esp + 0x40]
mov dl, byte [esp + 0x10]
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, esi
mov byte [esi], dl
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.00402e90
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x5b7244
mov cl, byte [eax - 1]
dec eax
test cl, cl
je 0x5b723b
dec cl
pop edi
mov byte [eax], cl
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x5ba3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81ac31
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp eax, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
je 0x5ba41d
mov dword [esi + 4], 0x869ab8
mov dword [esi + 0xc], 0x869aac
push ebx
mov ecx, esi
call fcn.005a9a60
push ebx
lea ecx, [esi + 0xc]
call fcn.0058f4f0
lea ecx, [esi + 0x10]
call fcn.005ecc50
mov dword [esi + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x24], 0x86746c
lea edi, [esi + 0x2c]
mov byte [esp + 0x1c], 1
mov dword [esp + 0x24], edi
lea ecx, [edi + 4]
mov dword [edi], method.SubWnd.virtual_4
call fcn.005ecc50
lea ecx, [edi + 0x1c]
mov byte [esp + 0x1c], 2
call fcn.005ecc50
mov al, byte [esp + 0x24]
mov dword [edi + 0x34], ebx
mov byte [edi + 0x30], al
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi], 0x8671bc
mov ecx, dword [esi + 4]
mov dword [esi], 0x867408
pop edi
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], 0x8673dc
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 4], 0x8673cc
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov ecx, dword [esi + 4]
mov dword [esi], 0x867368
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], 0x86733c
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 4], 0x86732c
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov ecx, dword [esi + 4]
mov dword [esi], 0x869a48
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], 0x869a1c
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 4], 0x869a0c
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x5ba730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81ac8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea esi, [ecx + 0x74]
push edi
mov dword [esp + 8], esi
mov dword [esp + 0x18], 0
lea edi, [esi - 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 3
call fcn.005a9910
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
call fcn.00477f50
lea ecx, [edi + 4]
mov byte [esp + 0x18], 1
call fcn.00477f50
lea ecx, [esi - 0x48]
mov byte [esp + 0x18], 0
call fcn.0058f120
lea ecx, [esi - 0x48]
mov dword [esp + 0x18], 0xffffffff
call fcn.0058eed0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5ba9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81ad69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ecx
cmp eax, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
je 0x5baa5b
mov dword [edi + 4], 0x86997c
mov dword [edi + 0xcc], 0x869b8c
mov eax, dword [edi + 0xcc]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xcc], 0x866dbc
mov edx, dword [edi + 0xcc]
mov eax, dword [edx + 8]
mov dword [edi + eax + 0xcc], 0x866d90
mov ecx, dword [edi + 0xcc]
mov dword [edi + 0xc8], 0x866d78
mov edx, dword [ecx + 4]
mov dword [edx + edi + 0xcc], 0x866d68
mov eax, dword [edi + 0xcc]
mov ecx, dword [eax + 8]
mov dword [ecx + edi + 0xcc], 0x866d3c
lea esi, [edi + 4]
push ebp
mov ecx, esi
call fcn.0058f2c0
push 1
lea ecx, [esi + 4]
call fcn.005bab20
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov dword [esi + eax], 0x869b7c
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esi + edx], 0x869b50
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
mov dword [esi + ecx], 0x869b38
lea ebx, [edi + 0x80]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebx
lea ecx, [ebx + 4]
mov dword [ebx], method.SubWnd.virtual_4
call fcn.005ecc50
lea ecx, [ebx + 0x1c]
mov byte [esp + 0x20], 1
call fcn.005ecc50
mov dl, byte [esp + 0x28]
mov dword [ebx + 0x34], ebp
mov byte [ebx + 0x30], dl
mov dword [ebx + 0x38], ebp
mov dword [ebx + 0x3c], ebp
mov dword [ebx], 0x8671bc
mov eax, dword [esi]
mov dword [edi], 0x869b18
mov ecx, dword [eax + 8]
mov dword [ecx + edi + 4], 0x869b08
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov dword [eax + edi + 4], 0x869adc
mov ecx, dword [esi]
mov eax, edi
mov edx, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
mov dword [edx + edi + 4], 0x869ac4
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x5bab20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81ada1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp eax, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
je 0x5bab5d
mov dword [esi + 4], 0x869ba4
mov dword [esi + 0xc], 0x869b98
push ebx
mov ecx, esi
call fcn.005bac90
push ebx
lea ecx, [esi + 0xc]
mov dword [esi + 8], ebx
call fcn.0058f4f0
lea ecx, [esi + 0x10]
call fcn.005ecc50
mov dword [esi + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x24], 0x86746c
lea edi, [esi + 0x2c]
mov byte [esp + 0x1c], 1
mov dword [esp + 0x24], edi
lea ecx, [edi + 4]
mov dword [edi], method.SubWnd.virtual_4
call fcn.005ecc50
lea ecx, [edi + 0x1c]
mov byte [esp + 0x1c], 2
call fcn.005ecc50
mov al, byte [esp + 0x24]
mov dword [edi + 0x34], ebx
mov byte [edi + 0x30], al
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi], 0x8671bc
mov ecx, dword [esi + 4]
mov dword [esi], 0x867408
pop edi
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], 0x8673dc
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 4], 0x8673cc
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov ecx, dword [esi + 4]
mov dword [esi], 0x867368
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], 0x86733c
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
mov dword [ecx + esi + 4], 0x86732c
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x5bcd60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81af50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0xc], al
mov edi, str.ThisObject:
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebx
push ecx
push str.ThisObject:
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.004030a0
mov ecx, 0x912c80
mov dword [esp + 0x34], ebx
call fcn.007ad187
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.0044de30
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [esp + 0x34], 1
cmp eax, ebx
jne 0x5bcde3
mov eax, 0x8522f4
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi]
push ecx
push 0x912c80
push eax
mov ecx, esi
call dword [edx + 4]
mov cl, al
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0x3c], cl
je 0x5bce1e
mov dl, byte [eax - 1]
dec eax
cmp dl, bl
je 0x5bce11
dec dl
mov byte [eax], dl
jmp 0x5bce1e
push eax
call fcn.007d7349
mov cl, byte [esp + 0x40]
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
cmp eax, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
je 0x5bce3e
mov dl, byte [eax - 1]
dec eax
cmp dl, bl
je 0x5bce54
dec dl
mov byte [eax], dl
pop edi
pop esi
mov al, cl
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push eax
call fcn.007d7349
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x40]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
Function at 0x5be759
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81b138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
lea edx, [esp + 0xc]
push edi
push edx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + esi + 0xc]
call fcn.00593f00
mov edi, str.gss_gex_sha1_toWM5Slw5Ew8Mqkayal2g
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x58], ebx
not ecx
dec ecx
push ecx
push str.gss_gex_sha1_toWM5Slw5Ew8Mqkayal2g
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.004830c0
test eax, eax
jne 0x5be7e1
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 8]
mov byte [edx + esi + 0xc], 1
mov ecx, dword [esi + 0x50]
cmp ecx, ebx
je 0x5be7b7
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
lea ecx, [esp + 0x14]
mov dword [esi + 0x50], ebx
mov dword [esp + 0x5c], 0xffffffff
call fcn.00404c40
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
mov edi, str.gss_group1_sha1_toWM5Slw5Ew8Mqkayal2g
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x1c]
push str.gss_group1_sha1_toWM5Slw5Ew8Mqkayal2g
push ecx
push ebx
lea ecx, [esp + 0x20]
call fcn.004830c0
test eax, eax
jne 0x5be85a
push 0x951a80
mov ecx, esi
call fcn.005be560
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x5be846
mov cl, byte [eax - 1]
dec eax
cmp cl, bl
je 0x5be83d
dec cl
pop edi
mov byte [eax], cl
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x50]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret
mov edi, str.SspiKexHandler:_key_exchange_algorithm_unsupported
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0xf]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x20], dl
push ecx
push str.SspiKexHandler:_key_exchange_algorithm_unsupported
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.004030a0
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.007ac4ef
mov al, byte [esp + 0x20]
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x5c], 2
mov dword [esp + 0x40], 6
mov byte [esp + 0x44], al
call fcn.00404c40
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
push ebx
push ecx
lea ecx, [esp + 0x4c]
call fcn.00402e90
lea edx, [esp + 0x30]
push 0x8a24ec
push edx
mov dword [esp + 0x38], vtable.CryptoPP::Exception.0
mov byte [esp + 0x60], 1
call fcn.007ac5c6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x5c2410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x81b946
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov al, byte [esi]
xor edi, edi
mov byte [ebp], al
mov ecx, dword [esi + 4]
lea eax, [esi + 8]
mov dword [ebp + 4], ecx
lea ecx, [ebp + 8]
push 0xffffffffffffffff
mov dl, byte [eax]
push edi
push eax
mov dword [esp + 0x24], ebp
mov byte [ecx], dl
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
call fcn.00402e90
mov dl, byte [esi + 0x18]
lea eax, [esi + 0x18]
lea ecx, [ebp + 0x18]
push 0xffffffffffffffff
push edi
push eax
mov dword [esp + 0x30], edi
mov byte [ecx], dl
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
call fcn.00402e90
mov eax, dword [esi + 0x28]
lea ebx, [ebp + 0x2c]
mov dword [ebp + 0x28], eax
mov cl, byte [esi + 0x2c]
lea eax, [esi + 0x2c]
mov byte [ebx], cl
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov edx, dword [eax + 8]
mov ecx, edx
mov byte [esp + 0x24], 1
cmp ecx, 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jbe 0x5c24bd
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 0x10]
cmp ebx, eax
jne 0x5c24d9
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call fcn.0040f500
push edi
push edi
mov ecx, ebx
call fcn.0040f500
jmp 0x5c256c
cmp ecx, edi
jbe 0x5c2529
cmp ecx, edx
jne 0x5c2529
mov eax, dword [eax + 4]
cmp eax, edi
jne 0x5c24ed
mov eax, 0x8522f4
xor edx, edx
mov dl, byte [eax - 1]
cmp edx, 0xffffffff
jge 0x5c2529
push 1
mov ecx, ebx
call fcn.00404c40
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
cmp eax, edi
jne 0x5c2510
mov eax, 0x8522f4
mov dword [ebx + 4], eax
mov edx, dword [ecx + 8]
mov dword [ebx + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [ebx + 0xc], ecx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x5c256c
push 1
push ecx
mov ecx, ebx
call fcn.00404a50
test al, al
je 0x5c256c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
test eax, eax
jne 0x5c2547
mov eax, 0x8522f4
mov ecx, dword [esp + 0x10]
mov edi, dword [ebx + 4]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.004049b0
mov esi, dword [esp + 0x2c]
mov edx, dword [esi + 0x3c]
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x3c], edx
mov eax, dword [esi + 0x40]
mov dword [ebp + 0x40], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5c3be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x81bbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.0044f140
mov esi, dword [esp + 0x30]
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.0044f1f0
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x5c3c55
mov cl, byte [eax - 1]
dec eax
test cl, cl
je 0x5c3c4c
dec cl
mov byte [eax], cl
mov eax, esi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret