joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6679b0
push 0x486f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
lea ecx, [ebp - 0x60]
call fcn.005529a0
lea ecx, [ebp - 0x50]
call fcn.005529a0
lea ecx, [ebp - 0x40]
call fcn.005529a0
lea ecx, [ebp - 0x30]
call fcn.005529a0
push ebx
lea ecx, [ebp - 0x20]
call fcn.00499690
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x44], 0x65786966
mov dword [ebp - 0x34], 0x67707320
mov dword [ebp - 0x24], 0x65786f70
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x74], bl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp - 0x88], eax
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x8c], ecx
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.0055c320
lea ecx, [ebp - 0x84]
call fcn.0055c410
push 0x112
lea ecx, [ebp - 0x70]
call fcn.0055e670
mov dword [ebp - 0x90], eax
mov edi, dword [ebp + 0xc]
cmp eax, ebx
je 0x560f61
cmp edi, ebx
je 0x560f61
mov dword [eax + 8], ebx
push 0x131
lea eax, [ebp - 0x70]
push eax
call fcn.0055e6b0
add esp, 8
mov dword [ebp - 0x90], eax
cmp eax, ebx
je 0x560f8d
push str.Picasa_3.0
push 0x131
mov ecx, eax
call fcn.0055e5e0
push 0xa002
lea ecx, [ebp - 0x50]
call fcn.0055e670
mov dword [ebp - 0x90], eax
cmp eax, ebx
je 0x560fab
cmp edi, ebx
je 0x560fab
mov dword [eax + 8], edi
push 0xa003
lea ecx, [ebp - 0x50]
call fcn.0055e670
mov dword [ebp - 0x90], eax
mov esi, dword [ebp + 0x10]
cmp eax, ebx
je 0x560fcc
cmp esi, ebx
je 0x560fcc
mov dword [eax + 8], esi
push 0xa001
lea ecx, [ebp - 0x50]
call fcn.0055e670
mov dword [ebp - 0x90], eax
cmp eax, ebx
je 0x560fee
cmp edi, ebx
je 0x560fee
mov dword [eax + 8], 0xffff
push 0x1001
lea ecx, [ebp - 0x30]
call fcn.0055e670
mov dword [ebp - 0x90], eax
cmp eax, ebx
je 0x56100c
cmp edi, ebx
je 0x56100c
mov dword [eax + 8], edi
push 0x1002
lea ecx, [ebp - 0x30]
call fcn.0055e670
mov dword [ebp - 0x90], eax
cmp eax, ebx
je 0x56102a
cmp esi, ebx
je 0x56102a
mov dword [eax + 8], esi
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x94], ecx
cmp ecx, ebx
seta cl
push ecx
mov edx, dword [ebp + 0x18]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.0055f590
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004996f0
lea ecx, [ebp - 0x30]
call fcn.00552a20
lea ecx, [ebp - 0x2c]
call fcn.0050ad20
lea ecx, [ebp - 0x40]
call fcn.00552a20
lea ecx, [ebp - 0x3c]
call fcn.0050ad20
lea ecx, [ebp - 0x50]
call fcn.00552a20
lea ecx, [ebp - 0x4c]
call fcn.0050ad20
lea ecx, [ebp - 0x60]
call fcn.005529b0
lea ecx, [ebp - 0x70]
call fcn.005529b0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x6c
push ebx
xor ebx, ebx
push esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
call fcn.005529a0
lea ecx, [esp + 0x5c]
call fcn.005529a0
push ebx
lea ecx, [esp + 0x70]
call fcn.00499690
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x7c]
push eax
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x40], 1
mov dword [esp + 0x50], 0x65786966
mov dword [esp + 0x60], 0x67707320
mov dword [esp + 0x70], 0x65786f70
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x10], ebx
call fcn.0055c320
mov esi, eax
cmp esi, ebx
je 0x562680
lea ecx, [esp + 0x6c]
call fcn.004996f0
lea ecx, [esp + 0x5c]
call fcn.00552a20
lea ecx, [esp + 0x60]
call fcn.0050ad20
lea ecx, [esp + 0x4c]
call fcn.00552a20
lea ecx, [esp + 0x50]
call fcn.0050ad20
lea ecx, [esp + 0x3c]
call fcn.00552a20
lea ecx, [esp + 0x40]
call fcn.0050ad20
lea ecx, [esp + 0x2c]
call fcn.005529b0
lea ecx, [esp + 0x1c]
call fcn.005529b0
mov eax, esi
pop esi
pop ebx
add esp, 0x6c
ret
mov edx, dword [esp + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 8], edx
call fcn.0055c410
mov esi, eax
cmp esi, ebx
je 0x5626e7
lea ecx, [esp + 0x6c]
call fcn.004996f0
lea ecx, [esp + 0x5c]
call fcn.00552a20
lea ecx, [esp + 0x60]
call fcn.0050ad20
lea ecx, [esp + 0x4c]
call fcn.00552a20
lea ecx, [esp + 0x50]
call fcn.0050ad20
lea ecx, [esp + 0x3c]
call fcn.005529b0
lea ecx, [esp + 0x2c]
call fcn.005529b0
lea ecx, [esp + 0x1c]
call fcn.005529b0
mov eax, esi
pop esi
pop ebx
add esp, 0x6c
ret
lea ecx, [esp + 8]
call fcn.00552a70
pop esi
xor eax, eax
pop ebx
add esp, 0x6c
ret

Function at 0x563a50
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor edx, edx
test edi, edi
jbe 0x563aab
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + edx*4]
movzx ecx, byte [esi + edx*4 + 3]
inc ecx
mov ebx, eax
and ebx, 0xff00
imul ebx, ecx
mov ebp, eax
and ebp, 0xffff00ff
imul ebp, ecx
xor ebx, ebp
mov ebp, eax
and ebp, 0xff00ff
imul ebp, ecx
and ebx, 0xff0000
xor ebx, ebp
shr ebx, 8
and eax, 0xff000000
or ebx, eax
mov dword [esi + edx*4], ebx
inc edx
cmp edx, edi
jb 0x563a62
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x5a7910
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 8
push 0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [esp + 4], 0x20
je 0x5a79da
push esi
push edi
or ecx, 0xffffffff
xor eax, eax
mov edi, str.Working_offline._state:
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Working_offline._state:
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.0049d9d0
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 1
call fcn.005a7570
mov ecx, eax
call fcn.005c1d70
mov eax, dword [esp + 8]
test eax, eax
je 0x5a79d2
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
mov esi, eax
jae 0x5a79d2
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x5a79c1
mov edx, dword [esi]
and edx, 0xff
cmp edx, 0x80
jae 0x5a79bc
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x5a79c1
mov eax, 0xff
test eax, eax
jne 0x5a79d2
mov eax, dword [esp + 8]
push eax
call fcn.00499410
add esp, 4
pop edi
mov al, 1
pop esi
add esp, 8
ret
xor al, al
add esp, 8
ret
Function at 0x5ac6f0
Capabilities:
Create http request

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
test eax, eax
je 0x5ac713
mov edx, dword [eax]
shr edx, 8
test edx, edx
je 0x5ac713
test eax, eax
je 0x5ac70c
lea edx, [eax + 4]
jmp 0x5ac70e
xor edx, edx
cmp byte [edx], 0
jne 0x5ac720
mov dword [esp + 4], 0
jmp fcn.005ac760
test eax, eax
je 0x5ac729
lea ecx, [eax + 4]
jmp 0x5ac72b
xor ecx, ecx
mov eax, dword [esp + 8]
mov eax, dword [eax]
test eax, eax
je 0x5ac749
push 0
push 0
push ecx
add eax, 4
push 3
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret 8
xor eax, eax
push eax
push eax
push ecx
push 3
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret 8

Function at 0x5ac760
Capabilities:
Create http request

Disassembly:
mov eax, dword [esp + 8]
mov eax, dword [eax]
test eax, eax
je 0x5ac76f
add eax, 4
jmp 0x5ac771
xor eax, eax
mov edx, dword [esp + 4]
xor ecx, ecx
test edx, edx
push 0
sete cl
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret 8
Function at 0x5b4580
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0xc
push ebp
push str.Picasa3
push 0
mov ebp, ecx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x5b45a3
or eax, 0xffffffff
pop ebp
add esp, 0xc
ret
mov eax, dword [ebp + 4]
test eax, eax
push esi
push edi
mov dword [esp + 0xc], 0
je 0x5b45c8
lea ecx, [eax + 4]
test ecx, ecx
je 0x5b45c8
test eax, eax
je 0x5b45c4
lea edi, [eax + 4]
jmp 0x5b45cd
xor edi, edi
jmp 0x5b45cd
mov edi, 0x6b6e10
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x5b45e8
lea ecx, [eax + 4]
test ecx, ecx
je 0x5b45e8
test eax, eax
je 0x5b45e4
lea esi, [eax + 4]
jmp 0x5b45ed
xor esi, esi
jmp 0x5b45ed
mov esi, 0x6b6e10
push str._s_has_crashed.__A_crash_dump_has_been_generated:__s_n
push str.CrashReporter::ErrorLog1
call fcn.004cd840
mov eax, dword [eax]
add esp, 8
test eax, eax
je 0x5b460a
add eax, 4
jmp 0x5b460c
xor eax, eax
push edi
push esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00403a60
mov eax, dword [ebp + 0x28]
add esp, 0x10
test eax, eax
je 0x5b468a
mov ecx, dword [eax]
shr ecx, 8
test ecx, ecx
je 0x5b468a
test eax, eax
je 0x5b4635
add eax, 4
jmp 0x5b4637
xor eax, eax
cmp byte [eax], 0
je 0x5b468a
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x5b4657
lea ecx, [eax + 4]
test ecx, ecx
je 0x5b4657
test eax, eax
je 0x5b4653
lea esi, [eax + 4]
jmp 0x5b465c
xor esi, esi
jmp 0x5b465c
mov esi, 0x6b6e10
push str.Crash_ID___s.
push str.CrashReporter::ErrorLog2
call fcn.004cd840
mov eax, dword [eax]
add esp, 8
test eax, eax
je 0x5b4679
add eax, 4
jmp 0x5b467b
xor eax, eax
push esi
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00403a80
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.0049d350
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5b46a4
add eax, 4
mov dword [esp + 0x10], eax
jmp 0x5b46ac
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 1
push 0
push 0xc0000001
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5b4733
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
mov esi, eax
jae 0x5b4733
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x5b4722
mov edx, dword [esi]
and edx, 0xff
cmp edx, 0x80
jae 0x5b471d
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x5b4722
mov eax, 0xff
test eax, eax
jne 0x5b4733
mov eax, dword [esp + 0xc]
push eax
call fcn.00499410
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x5f29f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
cmp ecx, eax
je 0x5f2ac1
push ebx
push ebp
push esi
lea esi, [ecx + 0x10]
mov ebx, esi
push edi
mov edi, dword [ebx]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x14], ebp
mov ebp, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
mov dword [esp + 0x1c], ebx
lea edx, [eax + 0x10]
mov ebx, edx
mov dword [esp + 0x18], ebp
mov ebp, dword [ebx]
mov dword [esi], ebp
mov ebp, dword [ebx + 4]
mov dword [esi + 4], ebp
mov ebp, dword [ebx + 8]
mov dword [esi + 8], ebp
mov ebx, dword [ebx + 0xc]
mov dword [esi + 0xc], ebx
mov dword [edx], edi
mov esi, dword [esp + 0x14]
mov dword [edx + 4], esi
mov esi, dword [esp + 0x18]
mov dword [edx + 8], esi
mov esi, dword [esp + 0x1c]
mov dword [edx + 0xc], esi
mov esi, dword [eax]
mov edx, dword [ecx]
mov dword [ecx], esi
mov dword [eax], edx
mov si, word [eax + 4]
mov dx, word [ecx + 4]
mov word [ecx + 4], si
mov word [eax + 4], dx
mov si, word [eax + 6]
mov dx, word [ecx + 6]
mov word [ecx + 6], si
mov word [eax + 6], dx
mov esi, dword [eax + 8]
mov edx, dword [ecx + 8]
mov dword [ecx + 8], esi
mov dword [eax + 8], edx
mov si, word [eax + 0xc]
mov dx, word [ecx + 0xc]
mov word [ecx + 0xc], si
mov word [eax + 0xc], dx
mov si, word [eax + 0xe]
mov dx, word [ecx + 0xe]
mov word [ecx + 0xe], si
mov word [eax + 0xe], dx
mov bl, byte [eax + 0x21]
mov dl, byte [ecx + 0x21]
mov byte [ecx + 0x21], bl
pop edi
mov byte [eax + 0x21], dl
mov bl, byte [eax + 0x20]
mov dl, byte [ecx + 0x20]
pop esi
mov byte [ecx + 0x20], bl
pop ebp
mov byte [eax + 0x20], dl
pop ebx
add esp, 0x10
ret 4

Function at 0x5f2e80
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, ecx
cmp word [esi + 0xe], 0
push edi
jne 0x5f2ebf
movzx edi, word [esi + 6]
push 1
call fcn.005f42d0
mov eax, dword [esi]
lea eax, [eax + edi*8]
lea edi, [esi + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
movzx ebx, word [edi + 6]
push 1
mov ecx, edi
call fcn.005f4320
mov ecx, dword [edi]
mov byte [ebx + ecx], 0
movzx ebx, word [esi + 6]
movzx eax, word [esi + 4]
lea edx, [ebx + 2]
cmp edx, eax
jbe 0x5f2ef1
mov eax, dword [esi]
lea edi, [ebx + 6]
mov ecx, edi
shr ecx, 2
add edi, ecx
lea edx, [edi*8]
push edx
push eax
call fcn.005f9460
add esp, 8
mov dword [esi], eax
mov word [esi + 4], di
mov ecx, dword [esi]
add word [esi + 6], 2
mov edx, dword [esp + 0x10]
lea eax, [ecx + ebx*8]
mov ecx, dword [esp + 0x14]
mov dword [eax], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
movzx ebx, word [esi + 0xe]
movzx edx, word [esi + 0xc]
lea eax, [ebx + 1]
cmp eax, edx
jbe 0x5f2f43
mov ecx, dword [esi + 8]
lea edi, [eax + 4]
mov eax, edi
shr eax, 2
add edi, eax
push edi
push ecx
call fcn.005f9460
add esp, 8
mov dword [esi + 8], eax
mov word [esi + 0xc], di
mov edx, dword [esi + 8]
inc word [esi + 0xe]
mov byte [ebx + edx], 2
pop edi
mov byte [esi + 0x20], 1
pop esi
pop ebx
ret 0x10
Function at 0x5f2f60
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, ecx
cmp word [esi + 0xe], 0
push edi
jne 0x5f2f9f
movzx edi, word [esi + 6]
push 1
call fcn.005f42d0
mov eax, dword [esi]
lea eax, [eax + edi*8]
lea edi, [esi + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
movzx ebx, word [edi + 6]
push 1
mov ecx, edi
call fcn.005f4320
mov ecx, dword [edi]
mov byte [ebx + ecx], 0
movzx ebx, word [esi + 6]
movzx eax, word [esi + 4]
lea edx, [ebx + 3]
cmp edx, eax
jbe 0x5f2fd1
mov eax, dword [esi]
lea edi, [ebx + 7]
mov ecx, edi
shr ecx, 2
add edi, ecx
lea edx, [edi*8]
push edx
push eax
call fcn.005f9460
add esp, 8
mov dword [esi], eax
mov word [esi + 4], di
mov ecx, dword [esi]
add word [esi + 6], 3
mov edx, dword [esp + 0x10]
lea eax, [ecx + ebx*8]
mov ecx, dword [esp + 0x14]
mov dword [eax], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
movzx ebx, word [esi + 0xe]
movzx edx, word [esi + 0xc]
lea eax, [ebx + 1]
cmp eax, edx
jbe 0x5f3031
mov ecx, dword [esi + 8]
lea edi, [eax + 4]
mov eax, edi
shr eax, 2
add edi, eax
push edi
push ecx
call fcn.005f9460
add esp, 8
mov dword [esi + 8], eax
mov word [esi + 0xc], di
mov edx, dword [esi + 8]
inc word [esi + 0xe]
mov byte [ebx + edx], 3
pop edi
mov byte [esi + 0x20], 1
pop esi
pop ebx
ret 0x18
Function at 0x5f3810
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, word [edi + 6]
push eax
mov esi, ecx
call fcn.005f2c30
push 0
push edi
lea ecx, [esp + 0x34]
call fcn.005f3e30
mov edi, dword [esp + 0x54]
mov ecx, edi
call fcn.005f7280
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
mov ebx, eax
call fcn.005f3f50
cmp eax, 5
je 0x5f3941
cmp eax, 4
ja case.default.0x5f385f
jmp dword [eax*4 + 0x5f394c]
push ebx
push 1
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.005f8e90
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
mov ecx, esi
call fcn.005f2cd0
jmp case.default.0x5f385f
push ebx
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.005f8e90
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.005f2d90
jmp case.default.0x5f385f
push ebx
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.005f8e90
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
mov ecx, esi
call fcn.005f2e80
jmp case.default.0x5f385f
push ebx
push 3
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.005f8e90
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.005f2f60
jmp case.default.0x5f385f
mov ecx, esi
call fcn.005f3050
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.005f3f50
cmp eax, 5
jne 0x5f3856
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x5f4890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x659e00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x34]
shr eax, 0xe
push edi
xor ebx, ebx
and eax, 3
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], eax
call fcn.005f4570
mov eax, dword [esi + 0x34]
shr eax, 1
test al, 1
mov dword [esp + 0x5c], ebx
je 0x5f48f7
mov eax, dword [esi + 4]
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
push 0x800000
sar ebx, 7
call fcn.005f45d0
mov ecx, dword [esp + 0x74]
xor eax, eax
test ecx, ecx
je 0x5f4910
push ecx
push ecx
lea ecx, [esp + 0x38]
call fcn.005f75b0
lea eax, [esp + 0x30]
push eax
push esi
call fcn.005fb230
mov ebp, eax
add esp, 8
mov dword [esp + 0x74], ebp
mov edi, dword [esp + 0x6c]
test edi, edi
mov byte [esp + 0x5c], 1
jne 0x5f4935
mov eax, dword [esp + 0x70]
test eax, eax
je 0x5f49a7
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.005fb1f0
test ebx, ebx
je 0x5f498f
mov eax, ebx
cdq
mov edi, eax
mov eax, dword [esp + 0x18]
mov ebp, edx
push ebp
cdq
push edi
push edx
push eax
call fcn.004898f0
mov ecx, 0x10
call fcn.00487dc0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
cdq
push edi
push edx
push eax
call fcn.004898f0
mov ecx, 0x10
call fcn.00487dc0
mov edi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x74]
jmp 0x5f4993
mov eax, dword [esp + 0x20]
test edi, edi
je 0x5f499d
mov ecx, dword [esp + 0x18]
mov dword [edi], ecx
mov ecx, dword [esp + 0x70]
test ecx, ecx
je 0x5f49a7
mov dword [ecx], eax
mov eax, dword [esp + 0x68]
xor edi, edi
test eax, eax
jbe 0x5f49d8
lea edx, [esp + 0x6c]
push edx
push eax
mov eax, dword [esp + 0x6c]
push eax
push ebp
mov ecx, esi
call fcn.005f4830
test ebx, ebx
mov edi, eax
je 0x5f49d8
imul ebx
mov ecx, 0x10
call fcn.00487dc0
mov edi, eax
test ebp, ebp
mov byte [esp + 0x5c], 0
je 0x5f49ea
push ebp
call fcn.005fb470
add esp, 4
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.005f4570
mov edx, dword [esp + 0x10]
push edx
call fcn.005f45d0
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x14
Function at 0x5fbfb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov edx, 0xf
nop
lea esp, [esp]
xor eax, dword [ecx]
add ecx, 4
dec edx
jne 0x5fbfc0
ret
Function at 0x601c00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov ecx, esi
call fcn.005f2b20
test al, al
je 0x601c20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret
push 1
lea eax, [esp + 0x14]
xor edi, edi
push eax
mov ecx, esi
mov word [esp + 0x3c], di
mov word [esp + 0x3e], di
call fcn.005f2bd0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add ecx, 0x8000
add ecx, 0xffff
sub eax, 0x8000
add edx, 0x8000
sar ecx, 0x10
sar eax, 0x10
sub ebp, 0x8000
add edx, 0xffff
mov word [esi + 4], cx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], ebp
mov word [esi], ax
mov ax, word [esp + 0x16]
sar edx, 0x10
cmp ecx, edi
mov word [esi + 2], ax
mov word [esi + 6], dx
je 0x601ce2
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], edx
mov edx, dword [ecx]
push eax
mov byte [esp + 0x2e], 1
mov dword [esp + 0x20], edi
call dword [edx + 0x10]
test al, al
jne 0x601cd5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [esp + 0x38]
cmp eax, edi
je 0x601d80
mov bp, word [eax]
cmp bp, word [esi + 4]
jge 0x601d17
mov bx, word [esi]
cmp bx, word [eax + 4]
jge 0x601d17
mov di, word [eax + 2]
cmp di, word [esi + 6]
jge 0x601d17
mov cx, word [esi + 2]
mov dx, word [eax + 6]
cmp cx, dx
jl 0x601d21
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret
cmp bp, bx
jg 0x601d3b
cmp di, cx
jg 0x601d3b
mov cx, word [eax + 4]
cmp cx, word [esi + 4]
jl 0x601d3b
cmp dx, word [esi + 6]
jge 0x601d80
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x10], ecx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.005f9550
movsx eax, word [esp + 0x36]
movsx ecx, word [esp + 0x34]
neg eax
add word [esp + 0x12], ax
sub word [esp + 0x16], ax
neg ecx
add word [esp + 0x10], cx
sub word [esp + 0x14], cx
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.005f9550
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret
Function at 0x601d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65a76e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push esi
lea ecx, [esp + 0x10]
call fcn.005f5610
lea ecx, [esp + 4]
mov dword [esp + 0x98], 0
call fcn.005fdd30
lea ecx, [esp + 0x58]
mov byte [esp + 0x98], 1
call fcn.005f4360
mov esi, dword [esp + 0xa0]
movzx eax, word [esi + 0xc]
movsx ecx, word [esi + 0xa]
movsx edx, word [esi + 6]
push eax
movsx eax, word [esi + 8]
sub ecx, edx
push ecx
movsx ecx, word [esi + 4]
sub eax, ecx
push eax
push 2
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 2
call fcn.005f56e0
mov edx, dword [esi]
push edx
lea ecx, [esp + 0x14]
call fcn.005f5720
movsx ecx, word [esi + 6]
movsx eax, word [esi + 0xa]
movsx edx, word [esi + 8]
sub eax, ecx
push eax
movsx eax, word [esi + 4]
sub edx, eax
push edx
push 0
push 0
lea ecx, [esp + 0x14]
call fcn.005fde60
movsx ecx, word [esi + 6]
movsx edx, word [esi + 4]
shl ecx, 0x10
neg ecx
shl edx, 0x10
push ecx
neg edx
push edx
lea ecx, [esp + 0x3c]
call fcn.005f73b0
lea ecx, [esp + 4]
lea eax, [esp + 0x10]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x34]
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call fcn.005f91b0
push 1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0
call fcn.005f44f0
mov ecx, dword [esp + 0xa4]
push 0
push 0
lea eax, [esp + 0x60]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.005ffc70
lea ecx, [esp + 0x58]
mov byte [esp + 0x98], 1
call fcn.005f4410
lea ecx, [esp + 4]
mov byte [esp + 0x98], 0
call fcn.005fdd90
mov dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.005f5660
mov ecx, dword [esp + 0x90]
pop esi
mov dword fs:[0], ecx
add esp, 0x98
ret