joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ca32e
Capabilities:
Authenticate hmac

Disassembly:
pushal
push dword [esp + 3]
pop word [esp + 4]
push dword [esp + 6]
jmp 0x7ca3ff
lea esp, [esp + 5]
mov dword [esp + 0xf], ebp
pop word [esp + 4]
push dword [esp + 0xc]
lea esp, [esp + 0x17]
pop word [esp + 4]
push word [esp + 1]
mov dword [esp + 7], esi
lea esp, [esp + 4]
mov word [esp + 3], si
lea esp, [esp + 8]
push eax
jle 0x7ca298
jg 0x7ca298
sub dword [edi + 0x24448ffa], ebp
add eax, 0x24648966
add ecx, ebp
js 0x7ca44a
invalid
invalid

Function at 0x7ca34c
Capabilities:
Authenticate hmac

Disassembly:
call 0x7ca26b
push edx
mov byte [esp + 2], ah
call fcn.007ca32e
call fcn.007ca2d5
mov edx, 0x59ede1e2
mov byte [esp + 5], ch
push word [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 8]
lea esp, [esp + 3]
jbe 0x7ca289
ja 0x7ca289
push edx
mov byte [esp + 2], ah
jmp 0x7ca293
pushfd
lea esp, [esp + 1]
mov word [esp], bp
mov byte [esp + 1], dh
push word [esp + 2]
mov byte [esp], dl
mov word [esp + 1], di
push dword [esp + 4]
jmp 0x7ca2b5
Function at 0x7ca64c
Capabilities:
Authenticate hmac

Disassembly:
push esp
pushfd
push word [esp + 3]
pop dword [esp]
mov byte [esp + 2], dl
pushal
jmp 0x7ca6e9
push dword [esp + 2]
push dword [esp + 0x16]
pop word [esp + 0x17]
pop word [esp + 0x19]
jmp 0x7ca7d6
mov dword [esp + 0x1e], edi
pop dword [esp + 3]
push word [esp + 1]
pushal
push word [esp + 0x12]
lea esp, [esp + 2]
mov dword [esp + 5], ecx
jmp 0x7ca747
mov word [esp], dx
mov edi, 0x248857ee
xchg byte [esp + 1], dh
mov dh, dl
jmp 0x7ca855
mov ecx, 0x5c9f3e9c
mov ch, dl
pushal
mov byte [esp + 2], cl
push esi
mov ch, byte [esp + 0x18]
mov ecx, 0x3dc514db
lea ecx, [0x7ba35c5c]
mov ch, byte [esp + 0x1d]
pop cx
lea esp, [esp + 2]
mov dword [esp + 4], edx
lea edx, [ebp*4]
mov ecx, 0x1c5c5206
mov ch, 0x6d
lea ecx, [esp + 0x41]
mov dx, 0x4fe7
mov dword [esp], edi
lea ecx, [0x5c8b1a42]
pushfd
jmp 0x7ca726
pop word [esp + 0x17]
pop word [esp + 0x19]
jmp 0x7ca821
push dword [esp + 0x27]
push dword [esp + 0x17]
mov dword [esp + 0x30], esp
jo 0x7ca804
push eax
lea esp, [esp + 3]
jmp 0x7ca832
push dword [esp + 2]
push dword [esp + 0x16]
jmp 0x7ca7be
jmp 0x7ca82d
push dword [esp + 0x27]
jmp 0x7ca7da
push eax
lea esp, [esp + 3]
call 0x7ca8f6
pop esi
setg ch
push word [esp + 3]
not dx
lea esp, [esp + 4]
mov edi, dword [esp]
lea esp, [esp]
push ebp
xchg byte [esp], ch
lea esp, [esp + 2]
mov cx, word [esp]
push sp
mov edi, eax
xchg byte [esp], dh
sete dl
xchg word [esp], di
mov edx, dword [esp]
lea esp, [esp + 2]
mov edi, dword [esp + 4]
mov edx, dword [esp]
mov dh, byte [esp]
push ebp
xchg cl, dh
lea edx, [edx + ebx]
xchg dword [esp], ecx
push dword [esp + 3]
mov byte [esp + 6], ch
lea ecx, [ecx + 0x13e11bf0]
xchg word [esp], dx
mov dx, word [esp + 1]
lea edx, [ebp + 0x2b]
mov dl, ah
mov edx, dword [esp + 0x10]
lea ecx, [edx*4]
xchg cl, ch
not ecx
mov cl, ch
lea ecx, [esp - 0x70]
not ecx
lea ecx, [ecx + esi]
xchg cl, ch
mov cl, byte [esp]
not ch
xchg ch, cl
mov ecx, dword [esp + 0x31]
lea esp, [esp + 0x70]
mov byte [esp + 0xe], bl
js 0x7ca6b8
jns 0x7ca7fa
and ecx, ebp
and dword [ecx], eax
add byte [eax], al
sub ch, byte [edx + 0x2ffab445]
test al, 0x3e
pop ecx
test al, 0xd5
jge 0x7ca908
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
sub byte [ecx + 0x7c910bf2], 0x70
Function at 0x7ca8f6
Capabilities:
Authenticate hmac

Disassembly:
push esp
pushfd
push word [esp + 3]
pop dword [esp]
mov byte [esp + 2], dl
pushal
jmp 0x7ca6e9
push dword [esp + 2]
push dword [esp + 0x16]
pop word [esp + 0x17]
pop word [esp + 0x19]
jmp 0x7ca7d6
mov dword [esp + 0x1e], edi
pop dword [esp + 3]
push word [esp + 1]
pushal
push word [esp + 0x12]
lea esp, [esp + 2]
mov dword [esp + 5], ecx
jmp 0x7ca747
mov word [esp], dx
mov edi, 0x248857ee
xchg byte [esp + 1], dh
mov dh, dl
jmp 0x7ca855
mov ecx, 0x5c9f3e9c
mov ch, dl
pushal
mov byte [esp + 2], cl
push esi
mov ch, byte [esp + 0x18]
mov ecx, 0x3dc514db
lea ecx, [0x7ba35c5c]
mov ch, byte [esp + 0x1d]
pop cx
lea esp, [esp + 2]
mov dword [esp + 4], edx
lea edx, [ebp*4]
mov ecx, 0x1c5c5206
mov ch, 0x6d
lea ecx, [esp + 0x41]
mov dx, 0x4fe7
mov dword [esp], edi
lea ecx, [0x5c8b1a42]
pushfd
jmp 0x7ca726
pop word [esp + 0x17]
pop word [esp + 0x19]
jmp 0x7ca821
push dword [esp + 0x27]
push dword [esp + 0x17]
mov dword [esp + 0x30], esp
jo 0x7ca804
push eax
lea esp, [esp + 3]
jmp 0x7ca832
push dword [esp + 2]
push dword [esp + 0x16]
jmp 0x7ca7be
jmp 0x7ca82d
push dword [esp + 0x27]
jmp 0x7ca7da
push eax
lea esp, [esp + 3]
call 0x7ca8f6
pop esi
setg ch
push word [esp + 3]
not dx
lea esp, [esp + 4]
mov edi, dword [esp]
lea esp, [esp]
push ebp
xchg byte [esp], ch
lea esp, [esp + 2]
mov cx, word [esp]
push sp
mov edi, eax
xchg byte [esp], dh
sete dl
xchg word [esp], di
mov edx, dword [esp]
lea esp, [esp + 2]
mov edi, dword [esp + 4]
mov edx, dword [esp]
mov dh, byte [esp]
push ebp
xchg cl, dh
lea edx, [edx + ebx]
xchg dword [esp], ecx
push dword [esp + 3]
mov byte [esp + 6], ch
lea ecx, [ecx + 0x13e11bf0]
xchg word [esp], dx
mov dx, word [esp + 1]
lea edx, [ebp + 0x2b]
mov dl, ah
mov edx, dword [esp + 0x10]
lea ecx, [edx*4]
xchg cl, ch
not ecx
mov cl, ch
lea ecx, [esp - 0x70]
not ecx
lea ecx, [ecx + esi]
xchg cl, ch
mov cl, byte [esp]
not ch
xchg ch, cl
mov ecx, dword [esp + 0x31]
lea esp, [esp + 0x70]
mov byte [esp + 0xe], bl
js 0x7ca6b8
jns 0x7ca7fa
and ecx, ebp
and dword [ecx], eax
add byte [eax], al
sub ch, byte [edx + 0x2ffab445]
test al, 0x3e
pop ecx
test al, 0xd5
jge 0x7ca908
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
sub byte [ecx + 0x7c910bf2], 0x70
Function at 0x7ca913
Capabilities:
Authenticate hmac

Disassembly:
push word [esp + 3]
lea esp, [esp + 3]
mov dword [esp + 8], edx
push edi
jmp 0x7ca6d9
jbe 0x7ca58e
push word [esp + 9]
jmp 0x7ca607
push word [esp + 9]
mov dword [esp + 2], eax
push cx
lea esp, [esp + 0xc]
mov word [esp], dx
push word [esp + 1]
call fcn.007ca5e9
push edi
rol byte [esi + 0x21], 1
shr byte [ebp - 0x2b72e265], 1
daa
mov byte [0x648d9bba], al
and al, 0xc
lea esp, [esp + 0xc]
mov word [esp], dx
jmp 0x7ca5a1
mov dword [esp + 2], eax
push cx
jmp 0x7ca5b9
push dword [esp + 3]
push ebx
pop word [esp + 1]
jmp 0x7ca570
mov dword [esp + 8], edx
push edi
push dword [esp + 3]
jmp 0x7ca6dd
push word [esp + 3]
lea esp, [esp + 3]
jmp 0x7ca714
pop word [esp + 1]
pop word [esp + 1]
mov word [esp + 2], bp
jmp 0x7caeef
push ebp
push word [esp + 3]
lea esp, [esp + 3]
push ebp
lea esp, [esp + 2]
mov word [esp + 2], ax
mov word [esp + 1], ax
pop word [esp]
mov byte [esp + 1], dl
mov byte [esp + 1], ch
mov word [esp], cx
mov word [esp], di
lea esp, [esp + 3]
push eax
mov ah, dl
mov eax, 0x23c030e3
bswap ax
push esp
push ebp
mov word [esp + 4], ax
mov dword [esp + 3], edx
bswap ax
bswap dx
setl dh
xchg dx, ax
mov eax, 0x224a4d6f
mov dh, bh
not eax
mov ax, 0x4dd2
bswap dx
xchg ah, al
lea edx, [ebp*4]
mov dh, 0xf9
push ecx
mov dl, bl
push bx
mov edx, edi
mov cl, byte [esp]
push word [esp]
pop edx
lea eax, [ecx + edx]
mov ecx, dword [esp]
xchg ch, dl
mov cx, dx
mov ah, dh
mov edx, 0x54b87a62
mov ah, byte [esp]
mov cx, 0x7171
pop ecx
xchg dx, ax
mov eax, 0x239917e2
bswap eax
mov edx, dword [esp]
mov al, bl
mov dx, 0x624a
mov edx, dword [esp + 3]
push ecx
xchg ah, al
mov dword [esp], esi
mov ax, word [esp]
mov eax, 0x9342584
mov al, 0x97
mov ah, 0x8f
lea eax, [esi - 0x113a]
xchg word [esp], ax
mov dword [esp], esi
mov eax, 0x72c275f7
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x10]
lea esp, [esp + 1]
jne 0x7ca54d
je 0x7ca7a6
loopne 0x7caa76
sti
sahf
insd dword es:[edi], dx
in al, dx
cmp bh, byte [eax - 0x7647b6d2]
or al, 0x8d
sbb eax, 0x65b39764
push cx
mov word [esp], si
push word [esp + 1]
push word [esp]
mov word [esp], ax
push sp
lea esp, [esp + 8]
push dword [esp + 1]
jg 0x7ca838
jle 0x7caa53
pop edx
fimul dword [eax + 0x2f]
ficomp dword [ebp + 0x4f28ba3b]
mov edx, 0x13d95ce7
jmp dword [edx - 9]
pop word [esp + 1]
pop word [esp + 1]
jmp fcn.007cb055
retf
lea esp, [esp + 1]
call 0x7cad4f
pop ds
cdq
or dword [eax - 0x65], ebp
push ds
in eax, dx
push 0xef6899fe
jns 0x7caeff
imul ecx, dword [eax], 0x3ab9c8fb
test al, 0xcf
cmp bl, byte [esi]
nop
and dword [eax], esi
mov edx, 0x17af2a02
je 0x7caff6
sub esp, 8
pop ebx
xchg byte [esp], ch
jmp 0x7ca2a2
pop ebx
xchg byte [esp], ch
sub esp, 8
jmp 0x7cafac

Function at 0x7cac30
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 4]
lea esp, [esp + 1]
jmp 0x7cacac
pushfd
mov byte [esp + 2], dl
push dword [esp + 1]
push word [esp + 6]
pop word [esp + 3]
pop word [esp + 1]
lea esp, [esp + 5]
lea esp, [esp]
push edi
jmp 0x7cac13
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jne 0x7cac7a
mov dword [esp + 0x60], edi
jmp 0x7caceb
Function at 0x7cad19
Capabilities:
Authenticate hmac

Disassembly:
mov byte [esp + 1], dl
pushfd
pop word [esp + 4]
pop word [esp + 2]
call fcn.007cac30
in ax, 0x75
sbb al, 0xef
mov al, 0x2c
push ebx
push ss
sbb edx, dword [ecx + eax*2 - 0x17]
insd dword es:[edi], dx
invalid
pop word [esp + 4]
pop word [esp + 2]
jmp 0x7cabfa
pushfd
mov ebp, dword [esp]
jmp 0x7cacfc
mov byte [esp + 1], dl
pushfd
jmp 0x7cac61
lea edx, [eax*4]
xor dh, ch
lea esi, [esp + 0x6ba9]
jmp 0x7caddb
lea esp, [esp + 2]
mov dword [esp], ebp
jp 0x7cabeb
jnp 0x7cac9f
xchg ecx, eax
push ss
test bl, ah
push ds
arpl di, bp
aaa
mov bh, byte [esi - 0x77]
lea esp, [esp + 0x60]
jmp 0x7cac82
jo 0x7cacb4
lea edx, [eax*4]
jmp 0x7cae27
push bp
lea esp, [esp + 1]
pushal
push dword [esp + 0x11]
push dword [esp + 0x24]
mov word [esp + 0xa], si
lea esp, [esp + 9]
push dword [esp + 0x1f]
lea esp, [esp + 0x15]
push dword [esp + 5]
lea esp, [esp + 0x11]
jmp 0x7cacd1
mov eax, dword [esp]
mov edx, ecx
mov edx, dword [esp]
lea esi, [esp]
bswap edi
jmp 0x7caea7
mov ebp, dword [esp + 0x28]
dec edi
jl 0x7cadad
jge 0x7cadf9
sbb al, 0x98
push cs
imul ebx, dword [eax - 0x3eae29e1], 0x17d653a0
wait
or ebp, dword [esi - 0x63]
stosb byte es:[edi], al
mov edx, 0x48beb61
and al, 0x8b
shr ebx, 1
dec ecx
cmp eax, 0xfdaf61f
iretd
mov eax, dword [esp]
mov edx, ecx
jmp 0x7cae49
neg dl
bswap edi
lea edi, [eax + ebx]
jmp 0x7cae76
xor dh, ch
lea esi, [esp + 0x6ba9]
jmp 0x7cacc4
mov edx, dword [esp]
jmp 0x7cadb5
bswap edi
lea edi, [eax + ebx]
jmp 0x7cae09
sub esp, 0xc0
mov edi, esp
mov edx, dword [esp]
jmp 0x7caeb1
bswap eax
mov ebx, dword [esp]
jmp 0x7caed8
jl 0x7cae02
neg dl
jmp 0x7cae65
jp 0x7caed0
bts eax, ebp
jmp 0x7cae84
bts eax, ebp
bswap eax
mov ebx, dword [esp]
mov eax, ebp
jmp 0x7caf14
Function at 0x7d50fd
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x7d51b2
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x80350b
Capabilities:
Hash data with md5

Disassembly:
call fcn.007d4954
jmp 0x7d50f8

Function at 0x8038fc
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
pushal
mov dword [esp + 6], edi
lea esp, [esp + 0x20]
pushal
mov eax, ebp
bswap ax
popal
push esp
lea esp, [esp + 1]
mov word [esp], ax
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x80393c
mov word [esp], ax
mov word [esp], ax
mov word [esp], sp
lea esp, [esp + 2]
jmp 0x7d4688
Function at 0x803a23
Capabilities:
Hash data with md5

Disassembly:
bswap ax
mov word [esp], cx
mov ah, 9
lea eax, [ecx - 0x646e]
lea esp, [esp + 2]
push edi
jmp 0x803b98
push ecx
pop word [esp]
mov byte [esp], bl
mov word [esp], sp
mov byte [esp], bl
lea esp, [esp + 2]
push eax
pushfd
pop eax
mov eax, dword [esp]
push cx
lea eax, [0x61e216c3]
jmp 0x803a00
bswap esi
bswap esi
lea esi, [edx*4]
lea esi, [ebx*4]
push edi
pop si
jmp 0x803cd2
lea esi, [edx*4]
bswap esi
lea esi, [edx + edx]
lea esi, [edi*4]
jmp 0x803a71
mov cx, sp
pushal
xchg dword [esp + 0x18], esi
mov eax, dword [esp + 0x26]
bswap si
bswap esi
mov ecx, 0x61b77397
mov si, ax
mov ch, byte [esp]
mov esi, 0x41014277
bswap esi
mov ecx, dword [esp + 0x2b]
mov si, word [esp]
jmp 0x803a97
mov dword [esp + 0x14], edx
xchg dword [esp + 3], esi
bswap si
mov si, 0x5db8
xchg dword [esp + 8], esi
mov esi, 0x3ea0392c
mov si, word [esp + 0x12]
mov si, word [esp + 0xb]
xchg dword [esp + 0xc], esi
lea esi, [ebx + ebp]
mov dword [esp + 3], ecx
mov ch, 0xab
not esi
mov si, bx
bswap si
xchg esi, ecx
push cx
mov byte [esp], al
lea esi, [esp + edi]
lea ecx, [esp + 0x67]
push word [esp + 1]
xchg word [esp], si
push dword [esp + 3]
not ch
not ch
mov dword [esp + 6], eax
lea eax, [edi*4]
mov si, 0x318e
lea esi, [ebx*4]
mov eax, dword [esp]
mov ch, 0xe
mov ecx, esp
bswap eax
mov si, word [esp]
xchg si, ax
lea esi, [esi - 0x199b]
mov esi, 0x3ca44072
mov si, word [esp]
jmp 0x803ab8
lea edi, [edx + edx]
bswap edi
lea eax, [edx*4]
mov eax, ebx
lea edi, [esi*4]
bswap ax
setae ah
mov al, dl
mov al, byte [esp]
bswap ax
push ebp
xchg bp, di
lea edi, [0x318f6291]
bswap di
setb al
mov edi, esi
mov eax, edx
lea edi, [edx - 0xa2]
mov edi, ebp
mov al, byte [esp]
lea edi, [edx + 0x5411204c]
not di
pop ebp
mov edi, ecx
lea edi, [ebp + 0x52]
xchg di, ax
mov ah, 0x4a
mov ah, 0x17
mov eax, 0x5ab8435f
not ah
mov edi, ebp
mov edi, dword [esp]
mov edi, dword [esp]
setns ah
bswap edi
pop edi
lea eax, [edi + 0x6c061e00]
mov eax, dword [esp]
push bp
lea eax, [ebx + ebp]
mov byte [esp], bl
mov ah, bh
bswap ax
xchg ah, al
mov word [esp], bx
mov ah, 0x46
lea esp, [esp + 2]
pop eax
push sp
mov word [esp], di
push word [esp + 1]
push word [esp]
lea esp, [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 3]
push esi
bswap si
mov esi, 0x382153ca
pushal
lea esi, [edi - 0xd4]
jmp 0x803af6
bswap esi
xchg word [esp], si
lea esp, [esp + 2]
mov esi, dword [esp + 0x48]
lea esp, [esp + 0x4c]
jmp 0x7d50f8
Function at 0x100024a2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10002590
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10002505
add dword [esp], 5
retf

Function at 0x10002590
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100025cb
add dword [esp], 5
retf

Function at 0x100026eb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10002726
add dword [esp], 5
retf

Function at 0x10002f85
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10002590
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10002fe8
add dword [esp], 5
retf

Function at 0x1000583c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10005846
add dword [esp], 5
retf

Function at 0x10005960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x100059b4
mov al, cl
cmp al, 0x61
jb 0x1000598f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x100059b4
mov al, cl
cmp al, 0x61
jb 0x100059a7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10005980
cmp edx, dword [esp + 0x18]
je 0x100059c4
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10005979
xor eax, eax
jmp 0x100059c7
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10005a04
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10005a0e
add dword [esp], 5
retf
Function at 0x10005ac5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10005bc6
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10005bcc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005b27
cmp al, 0x61
jb 0x10005b1f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005b12
cmp edx, dword [esp + 0x14]
je 0x10005b37
dec ecx
jne 0x10005b07
xor eax, eax
jmp 0x10005bc6
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10005bc6
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10005bc6
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10005b77
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10005b86
jmp 0x10005b6e
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x10005bcc
test eax, eax
je 0x10005bc6
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005bc1
cmp al, 0x61
jb 0x10005bb9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005bac
call 0x10005adb
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005bf4
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005c0c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10005be5
cmp edx, dword [esp + 0x18]
je 0x10005c29
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10005bde
xor eax, eax
jmp 0x10005c2c
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x10005adb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10005bc6
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10005bcc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005b27
cmp al, 0x61
jb 0x10005b1f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005b12
cmp edx, dword [esp + 0x14]
je 0x10005b37
dec ecx
jne 0x10005b07
xor eax, eax
jmp 0x10005bc6
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10005bc6
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10005bc6
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10005b77
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10005b86
jmp 0x10005b6e
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x10005bcc
test eax, eax
je 0x10005bc6
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005bc1
cmp al, 0x61
jb 0x10005bb9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005bac
call 0x10005adb
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005bf4
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005c0c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10005be5
cmp edx, dword [esp + 0x18]
je 0x10005c29
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10005bde
xor eax, eax
jmp 0x10005c2c
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x10005bcc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10005bc6
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10005bcc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005b27
cmp al, 0x61
jb 0x10005b1f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005b12
cmp edx, dword [esp + 0x14]
je 0x10005b37
dec ecx
jne 0x10005b07
xor eax, eax
jmp 0x10005bc6
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10005bc6
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10005bc6
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10005b77
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10005b86
jmp 0x10005b6e
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x10005bcc
test eax, eax
je 0x10005bc6
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005bc1
cmp al, 0x61
jb 0x10005bb9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005bac
call 0x10005adb
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005bf4
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10005c19
mov al, cl
cmp al, 0x61
jb 0x10005c0c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10005be5
cmp edx, dword [esp + 0x18]
je 0x10005c29
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10005bde
xor eax, eax
jmp 0x10005c2c
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10005c5c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10005c66
add dword [esp], 5
retf