joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5510f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e12a4
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x50]
mov eax, ebx
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x55116d
mov eax, dword [esi + 0x20]
push 5
push eax
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x55116d
lea ecx, [esp + 0x50]
push ecx
push 1
mov edx, ebx
and edx, 0xffffff
push edx
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
test eax, eax
je 0x55116d
mov eax, dword [esp + 0x50]
movzx ebx, byte [esp + 0x52]
shl ebx, 8
movzx ecx, ah
or ebx, ecx
movzx edx, al
shl ebx, 8
or ebx, edx
movzx eax, bl
mov dword [esp + 0x50], eax
movzx ecx, bh
fild dword [esp + 0x50]
fld qword [0x5f38b0]
mov dword [esp + 0x50], ecx
fdiv st(1), st(0)
shr ebx, 0x10
movzx edx, bl
mov eax, 0x5f14a0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
fxch st(1)
fstp qword [esp + 0x18]
fild dword [esp + 0x50]
mov dword [esp + 0x50], edx
fdiv st(1)
fstp qword [esp + 0x28]
fild dword [esp + 0x50]
fdivrp st(1)
fstp qword [esp + 0x38]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x50], 0
call eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x40
ret 4

Function at 0x551200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e12c7
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x50]
mov eax, ebx
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x55127d
mov eax, dword [esi + 0x20]
push 5
push eax
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x55127d
lea ecx, [esp + 0x50]
push ecx
push 1
mov edx, ebx
and edx, 0xffffff
push edx
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
test eax, eax
je 0x55127d
mov eax, dword [esp + 0x50]
movzx ebx, byte [esp + 0x52]
shl ebx, 8
movzx ecx, ah
or ebx, ecx
movzx edx, al
shl ebx, 8
or ebx, edx
movzx eax, bl
mov dword [esp + 0x50], eax
movzx ecx, bh
fild dword [esp + 0x50]
fld qword [0x5f38b0]
mov dword [esp + 0x50], ecx
fdiv st(1), st(0)
shr ebx, 0x10
movzx edx, bl
mov eax, 0x5f14a0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
fxch st(1)
fstp qword [esp + 0x18]
fild dword [esp + 0x50]
mov dword [esp + 0x50], edx
fdiv st(1)
fstp qword [esp + 0x28]
fild dword [esp + 0x50]
fdivrp st(1)
fstp qword [esp + 0x38]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x50], 0
call eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x551700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e1451
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
fld qword [esi + 8]
fsub qword [esi + 0x38]
fabs
fld qword [0x659f28]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x5517d3
fld qword [esi]
fsub qword [esi + 0x10]
fabs
fcompp
fnstsw ax
test ah, 5
jp 0x5517d5
fld qword [esi + 0x18]
mov edi, 0x5f14a0
fsub qword [esi + 8]
mov dword [esp + 0x14], edi
fstp qword [esp + 0x1c]
fld qword [esi + 0x30]
mov dword [esp + 0x60], 0
fsub qword [esi]
mov dword [esp + 0x24], edi
fstp qword [esp + 0x2c]
fld qword [esi + 8]
mov dword [esp + 0x34], edi
fstp qword [esp + 0x3c]
fld qword [esi]
mov dword [esp + 0x44], edi
fstp qword [esp + 0x4c]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x70], 3
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
fstp st(0)
fld qword [esi + 8]
mov edi, 0x5f14a0
fstp qword [esp + 0x4c]
mov dword [esp + 0x44], edi
fld qword [esi]
fstp qword [esp + 0x3c]
mov dword [esp + 0x60], 4
mov dword [esp + 0x34], edi
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x70]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x68], 5
call edx
fld qword [esi + 0x18]
fstp qword [esp + 0x4c]
mov dword [esp + 0x44], edi
fld qword [esi + 0x10]
fstp qword [esp + 0x3c]
mov dword [esp + 0x60], 6
mov dword [esp + 0x34], edi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
lea edx, [esp + 0x44]
push edx
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x68], 7
call eax
fld qword [esi + 0x28]
fstp qword [esp + 0x4c]
mov dword [esp + 0x44], edi
fld qword [esi + 0x20]
fstp qword [esp + 0x3c]
mov dword [esp + 0x60], 8
mov dword [esp + 0x34], edi
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x68], 9
call edx
fld qword [esi + 0x38]
fstp qword [esp + 0x4c]
mov dword [esp + 0x44], edi
fld qword [esi + 0x30]
fstp qword [esp + 0x3c]
mov dword [esp + 0x60], 0xa
mov dword [esp + 0x34], edi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
lea edx, [esp + 0x44]
push edx
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x68], 0xb
call eax
fld qword [esi + 8]
fstp qword [esp + 0x4c]
mov dword [esp + 0x44], edi
fld qword [esi]
fstp qword [esp + 0x3c]
mov dword [esp + 0x60], 0xc
mov dword [esp + 0x34], edi
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x68], 0xd
call edx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5576a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e1abe
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x17d], 0
je 0x5576e6
push 4
mov byte [esi + 0x17d], 0
call fcn.005549e0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
call eax
mov ecx, dword [esi + 0xc]
mov byte [esi + 0x1e9], 0
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
cmp dword [esi + 0x128], 0
jne 0x55771b
cmp dword [esi + 0x150], 0
je 0x557722
mov ecx, esi
call fcn.005516b0
cmp byte [esi + 0x1e8], 0
je 0x557752
fld dword [esi + 0x1dc]
push 0
lea ecx, [esp + 0x28]
fstp qword [esp + 0x28]
fld dword [esi + 0x1dc]
push ecx
lea edx, [esp + 0x1c]
fstp qword [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00551e40
mov eax, dword [esi + 0x1d4]
mov ebp, dword [eax]
lea ebx, [esi + 0x1d0]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
lea esp, [esp]
test ebx, ebx
je 0x55777e
lea eax, [esi + 0x1d0]
cmp ebx, eax
je 0x557783
call fcn.0044b7ad
cmp ebp, dword [esp + 0x30]
je 0x55787b
test ebx, ebx
jne 0x557796
call fcn.0044b7ad
cmp ebp, dword [ebx + 4]
jne 0x5577a0
call fcn.0044b7ad
cmp byte [ebp + 0x58], 0
jne 0x557865
cmp ebp, dword [ebx + 4]
jne 0x5577b4
call fcn.0044b7ad
mov eax, dword [ebp + 0x50]
lea edi, [ebp + 0x10]
movzx ecx, al
mov dword [esp + 0x14], ecx
movzx edx, ah
fild dword [esp + 0x14]
fld qword [0x5f38b0]
mov dword [esp + 0x14], edx
fdiv st(1), st(0)
shr eax, 0x10
movzx eax, al
mov ecx, 0x5f14a0
mov dword [esp + 0x20], 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x54], ecx
fxch st(1)
fstp qword [esp + 0x3c]
fild dword [esp + 0x14]
mov dword [esp + 0x14], eax
fdiv st(1)
fstp qword [esp + 0x4c]
fild dword [esp + 0x14]
fdivrp st(1)
fstp qword [esp + 0x5c]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x78], 0
call edx
mov eax, 0x5f13d0
push edi
mov ecx, esi
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x58], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], eax
call fcn.00551700
push 2
mov ecx, esi
call fcn.005549e0
cmp ebp, dword [ebx + 4]
jne 0x557861
call fcn.0044b7ad
mov byte [ebp + 0x58], 1
lea ecx, [esp + 0x24]
call fcn.00489d40
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
jmp 0x557770
fld1
mov byte [esi + 0x1e8], 0
fstp dword [esi + 0x1dc]
mov esi, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562400
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
lea eax, [ecx + 1]
ret
Function at 0x563770
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.00563270
add esp, 0xc
test eax, eax
jl 0x5639ba
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
test edx, edx
push edi
jle 0x5637ed
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x5637b0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x5639b6
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + str.ccccwwww]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff
mov esi, dword [esi*4 + 0x639490]
and edi, 0xff
xor esi, dword [edi*4 + 0x639c90]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x63a090]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + str.ccccwwww]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x639890]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + str.ccccwwww]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff
mov esi, dword [esi*4 + 0x639490]
and edi, 0xff
xor esi, dword [edi*4 + 0x639c90]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
xor esi, dword [edi*4 + 0x639890]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x63a090]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + str.ccccwwww]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff
mov esi, dword [esi*4 + 0x639490]
and edi, 0xff
xor esi, dword [edi*4 + 0x639c90]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
xor esi, dword [edi*4 + 0x639890]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x63a090]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + str.ccccwwww]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff
mov esi, dword [esi*4 + 0x639490]
and edi, 0xff
xor esi, dword [edi*4 + 0x639c90]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and edi, 0xff
xor esi, dword [edi*4 + 0x639890]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x63a090]
add edx, 1
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x563801
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x565a60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, 1
xor ecx, ecx
push esi
jmp 0x565a70
mov byte [ecx + 0x68dc80], al
mov edx, eax
imul eax, eax, 0x2d
and edx, 0xff
mov byte [edx + 0x68db80], cl
xor edx, edx
mov esi, 0x101
div esi
add ecx, 1
cmp ecx, 0x100
mov eax, edx
jl 0x565a70
mov byte [0x68dd00], 0
mov byte [0x68db80], 0x80
xor eax, eax
pop esi
ret
Function at 0x566400
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
movzx edx, byte [ecx]
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movzx edi, byte [esi]
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [ecx + 4]
add esi, 1
mov byte [eax + 4], dl
movzx edi, byte [esi]
movzx edx, byte [ecx + 1]
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [ecx + 5]
add esi, 1
mov byte [eax + 5], dl
movzx edx, byte [esi]
movzx edi, byte [ecx + 2]
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [ecx + 6]
add esi, 1
mov byte [eax + 6], dl
movzx edx, byte [esi]
movzx edi, byte [ecx + 3]
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [ecx + 7]
add esi, 1
mov byte [eax + 7], dl
movzx ebx, byte [esi]
mov dl, byte [eax + 4]
movzx edi, dl
xor ebx, edi
movzx ebx, byte [ebx + 0x685668]
xor bl, byte [ecx + 1]
add esi, 1
mov byte [eax + 1], bl
movzx ebx, byte [eax + 5]
xor ebx, edi
movzx ebx, byte [ebx + 0x685668]
xor bl, byte [ecx + 2]
movzx edi, byte [eax + 6]
mov byte [eax + 2], bl
movzx ebx, byte [esi]
xor edi, ebx
movzx ebx, byte [edi + 0x685668]
xor bl, byte [ecx + 3]
movzx edi, byte [eax + 7]
mov byte [eax + 3], bl
movzx ebx, byte [esi + 1]
add esi, 1
xor edi, ebx
movzx ebx, byte [edi + 0x685668]
xor bl, byte [ecx]
add esi, 1
mov byte [eax], bl
mov ebp, 7
movzx edi, byte [esi]
movzx ecx, byte [eax]
xor ecx, edi
movzx ecx, byte [ecx + 0x685668]
xor cl, dl
mov byte [eax + 4], cl
movzx edi, byte [esi + 1]
mov cl, byte [eax + 1]
movzx edx, cl
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [eax + 5]
add esi, 1
mov byte [eax + 5], dl
movzx edi, byte [esi + 1]
movzx edx, byte [eax + 2]
add esi, 1
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [eax + 6]
add esi, 1
mov byte [eax + 6], dl
movzx edi, byte [esi]
movzx edx, byte [eax + 3]
xor edx, edi
movzx edx, byte [edx + 0x685668]
xor dl, byte [eax + 7]
add esi, 1
mov byte [eax + 7], dl
movzx ebx, byte [esi]
mov dl, byte [eax + 4]
movzx edi, dl
xor ebx, edi
mov bl, byte [ebx + 0x685668]
xor bl, cl
movzx ecx, byte [eax + 5]
xor ecx, edi
mov byte [eax + 1], bl
movzx ecx, byte [ecx + 0x685668]
xor cl, byte [eax + 2]
add esi, 1
mov byte [eax + 2], cl
movzx edi, byte [esi]
movzx ecx, byte [eax + 6]
xor ecx, edi
movzx ecx, byte [ecx + 0x685668]
xor cl, byte [eax + 3]
add esi, 1
mov byte [eax + 3], cl
movzx edi, byte [esi]
movzx ecx, byte [eax + 7]
xor ecx, edi
movzx ecx, byte [ecx + 0x685668]
xor cl, byte [eax]
sub ebp, 1
add esi, 1
test ebp, ebp
mov byte [eax], cl
jne 0x5664d7
movzx edx, byte [esi]
movzx ecx, cl
xor edx, ecx
movzx edx, byte [edx + 0x685668]
xor byte [eax + 4], dl
movzx edx, byte [esi + 1]
add esi, 1
movzx ecx, bl
xor ecx, edx
movzx ecx, byte [ecx + 0x685668]
xor byte [eax + 5], cl
movzx edx, byte [esi + 1]
movzx ecx, byte [eax + 2]
add esi, 1
xor edx, ecx
movzx edx, byte [edx + 0x685668]
xor byte [eax + 6], dl
movzx ecx, byte [esi + 1]
movzx edx, byte [eax + 3]
pop edi
xor ecx, edx
movzx ecx, byte [ecx + 0x685668]
xor byte [eax + 7], cl
pop esi
pop ebp
pop ebx
ret
Function at 0x569010
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x63ba90
push ebx
call fcn.00450150
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x56903a
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
nop
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x56905c
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x56906d
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x56907e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x56908f
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x56909e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x5690af
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x5690c0
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x5690d1
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x5690e0
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x5690f1
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x569102
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x569113
mov eax, edi
xor dword [esi], edx
add esi, 0xc
sub dword [esp + 0x1c], 1
jne 0x569050
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.005688b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x569130
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call fcn.005688b0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x569158
pop esi
pop ebx
add esp, 8
ret
Function at 0x56d7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
mov dword [esp + 4], ecx
call fcn.0056c2c0
cmp dword [esp + 0x34], 0
je 0x56d8ed
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], 0x70616d63
mov dword [esp + 0x18], 0x20747663
mov dword [esp + 0x1c], 0x6d677066
mov dword [esp + 0x20], 0x66796c67
mov dword [esp + 0x24], 0x64616568
mov dword [esp + 0x28], 0x61656868
mov dword [esp + 0x2c], 0x78746d68
mov dword [esp + 0x30], 0x61636f6c
mov dword [esp + 0x34], 0x7078616d
mov dword [esp + 0x38], 0x70657270
mov dword [esp + 0xc], eax
push edi
mov ebp, dword [esp + eax*4 + 0x18]
mov eax, dword [esp + 0x44]
push 0
push 0
push 0
push ebp
push eax
call dword [sym.imp.GDI32.dll_GetFontData]
mov esi, eax
cmp esi, 0xffffffff
je 0x56d8d5
and eax, 3
mov edi, esi
je 0x56d86a
sub edi, eax
add edi, 4
push edi
call fcn.00427501
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x56d8d5
push edi
push 0
push ebx
call fcn.0044dac0
mov ecx, dword [esp + 0x50]
add esp, 0xc
push esi
push ebx
push 0
push ebp
push ecx
call dword [sym.imp.GDI32.dll_GetFontData]
cmp eax, 0xffffffff
jne 0x56d8a5
push ebx
call fcn.004274fc
add esp, 4
jmp 0x56d8d5
push 0x10
call fcn.004274d1
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x56d89a
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x14]
push eax
mov dword [eax], ebp
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov dword [eax + 4], ebx
call fcn.0056c410
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x10], eax
jb 0x56d841
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x575150
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
push edi
mov dword [esi], vtable.CGlyphs.0
je 0x56aee3
push ebx
xor ebx, ebx
cmp word [esi + 0x20], bx
jbe 0x56aecd
lea esp, [esp]
mov ecx, dword [esi + 0x28]
movzx eax, bx
cmp byte [eax + ecx], 0
je 0x56aec4
mov edx, dword [esi + 0x24]
mov edi, dword [edx + eax*4]
test edi, edi
je 0x56aec4
mov eax, dword [edi]
push eax
call sub.gdiplus.dll_GdipDeletePath
push edi
call sub.gdiplus.dll_GdipFree
add ebx, 1
cmp bx, word [esi + 0x20]
jb 0x56aea0
mov ecx, dword [esi + 0x28]
push ecx
call fcn.004274fc
mov edx, dword [esi + 0x24]
push edx
call fcn.004274fc
add esp, 8
pop ebx
mov edi, dword [esi + 4]
test edi, edi
je 0x56aef8
mov eax, dword [edi]
push eax
call sub.gdiplus.dll_GdipDeleteMatrix
push edi
call sub.gdiplus.dll_GdipFree
mov edi, dword [esi + 8]
test edi, edi
je 0x56af0d
mov ecx, dword [edi]
push ecx
call sub.gdiplus.dll_GdipDeleteMatrix
push edi
call sub.gdiplus.dll_GdipFree
mov edi, dword [esi + 0x44]
test edi, edi
je 0x56af22
mov edx, dword [edi]
push edx
call sub.gdiplus.dll_GdipDeleteFont
push edi
call sub.gdiplus.dll_GdipFree
lea eax, [esi + 0x3c]
push eax
mov dword [esi + 0x38], vtable.Gdiplus::PrivateFontCollection.0
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
pop edi
mov dword [esi + 0x38], vtable.Gdiplus::FontCollection.0
pop esi
ret
push esi
push edi
mov edi, ecx
mov dword [edi], vtable.CType1Base.0
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x57519a
mov eax, dword [eax]
test eax, eax
je 0x57519a
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x57519a
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x57517d
mov eax, dword [eax]
jmp 0x57517f
xor eax, eax
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x575191
mov eax, dword [eax]
jmp 0x575193
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi + 0x4c]
test esi, esi
je 0x5751e0
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x5751d9
test esi, esi
je 0x5751d9
mov eax, dword [esi]
test eax, eax
je 0x5751c0
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x5751d0
push eax
call fcn.004274fc
add esp, 4
push esi
call fcn.004274fc
add esp, 4
mov dword [edi + 0x4c], 0
mov ecx, edi
pop edi
pop esi
jmp 0x56ae80
Function at 0x576c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push esi
mov esi, ecx
mov ecx, dword [esi + 0x840]
push eax
push esi
call ecx
add esp, 8
test eax, eax
je 0x576ca4
xor eax, eax
pop esi
add esp, 0x90
ret
mov eax, dword [esi + 0x83c]
push esi
push 0xc
lea edx, [esp + 0xc]
push 4
push edx
call eax
add esp, 0x10
cmp eax, 0xc
jne 0x576c9a
lea eax, [esp + 7]
mov esi, 0xc
push ebx
jmp 0x576cd0
mov dl, byte [eax - 2]
mov bl, byte [eax - 1]
mov cl, byte [eax - 3]
mov byte [eax - 2], bl
mov byte [eax - 1], dl
movzx edx, byte [eax]
mov byte [eax - 3], dl
mov byte [eax], cl
add eax, 4
sub esi, 1
jne 0x576cd0
fild dword [esp + 8]
mov eax, dword [esp + 0xa0]
fld qword [0x643d70]
push eax
mov eax, dword [esp + 0xa0]
fmul st(1), st(0)
lea ecx, [esp + 0x3c]
fxch st(1)
push ecx
lea edx, [esp + 0x58]
fstp qword [esp + 0x58]
push edx
fild dword [esp + 0x18]
push eax
fmul st(1)
fstp qword [esp + 0x68]
fild dword [esp + 0x20]
fmul st(1)
fstp qword [esp + 0x70]
fild dword [esp + 0x24]
fmul st(1)
fstp qword [esp + 0x78]
fild dword [esp + 0x28]
fmul st(1)
fstp qword [esp + 0x80]
fild dword [esp + 0x2c]
fmul st(1)
fstp qword [esp + 0x88]
fild dword [esp + 0x30]
fmul st(1)
fstp qword [esp + 0x90]
fild dword [esp + 0x34]
fmul st(1)
fstp qword [esp + 0x98]
fild dword [esp + 0x38]
fmul st(1)
fstp qword [esp + 0xa0]
fild dword [esp + 0x3c]
fmul st(1)
fstp qword [esp + 0x48]
fild dword [esp + 0x40]
fmul st(1)
fstp qword [esp + 0x50]
fimul dword [esp + 0x44]
fstp qword [esp + 0x58]
call fcn.0057e320
add esp, 0x10
pop ebx
lea eax, [esi + 1]
pop esi
add esp, 0x90
ret