joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52e900
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x612fac
push eax
mov eax, dword [0x6a4f4c]
mov dword fs:[0], esp
sub esp, 0x114
test eax, eax
push esi
jne 0x52ead7
push edi
call fcn.004ccd60
push str.GlobalTEC_USBKEY
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x6a4f4c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x6a4f54], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x6a4f50], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.00467740
add esp, 8
test eax, eax
pop edi
push 0x1f
je 0x52e9a1
inc eax
push eax
jmp 0x52e9a6
lea edx, [esp + 0x18]
push edx
push 0x6a4f58
call fcn.00466960
mov eax, dword [0x6a4f4c]
add esp, 0xc
test eax, eax
mov eax, dword [0x6a4f78]
je 0x52ea4b
cmp eax, 1
jb 0x52ead7
mov eax, dword [0x682534]
mov dword [esp + 4], eax
push 0x6a4f58
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0
call fcn.005ece5a
mov ecx, dword [0x6a4f50]
mov edx, dword [0x6a4f54]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push str.CTUsbKey::Initialize_CreateMutex_succeed____s___d___d_
push ecx
mov byte [esp + 0x134], 1
call fcn.005e20b1
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 0
call fcn.005ecd91
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 4]
jmp 0x52ead2
cmp eax, 1
jb 0x52ead7
push 0x69dc58
lea ecx, [esp + 0xc]
call fcn.005ece05
push 0x6a4f58
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 2
call fcn.005ece5a
mov ecx, dword [0x6a4f50]
mov edx, dword [0x6a4f54]
mov eax, dword [eax]
push esi
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
push str.CTUsbKey::Initialize_CreateMutex_fail____s___d___d__GetLastError_d
push ecx
mov byte [esp + 0x138], 3
call fcn.005e20b1
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x120], 2
call fcn.005ecd91
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 8]
call fcn.005ecd91
mov ecx, dword [0x6a4f4c]
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x118]
pop esi
setne al
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x52eb00
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x612fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x6a4f4c]
mov eax, 1
test ecx, ecx
je 0x52eb88
cmp dword [0x6a4f78], eax
jb 0x52eb71
push 0x69dc58
lea ecx, [esp + 4]
call fcn.005ece05
lea eax, [esp]
push str.CTUsbKey::Finalize_close_handle_
push eax
mov dword [esp + 0x14], 0
call fcn.005e20b1
mov ecx, dword [esp + 8]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.005ecd91
mov edx, dword [0x6a4f4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6a4f4c], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x52fb90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 1
lea edx, [eax + 0x19]
sub eax, edx
add eax, 0x3c
mov esi, eax
mov al, byte [edx]
cmp esi, ecx
jle 0x52fbb6
push ebx
mov bl, byte [ecx + edx]
xor al, bl
inc ecx
cmp ecx, esi
jl 0x52fbab
pop ebx
pop esi
ret
Function at 0x5320d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
push edi
push 0x12345678
mov esi, ecx
push str._SetPwd
call fcn.00532c10
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x5c]
mov ecx, esi
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
push 0x3c
push 0
push ebp
call fcn.00531910
test eax, eax
mov dword [esi + 4], eax
je 0x532146
push 0x12345678
push str.result__ReadHeader_error_
mov ecx, esi
call fcn.00532c10
push 0x12345678
push str.result__SetPwd__ReadHeader_Fail_
mov ecx, esi
call fcn.00532c10
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x4c
ret 0xc
xor ecx, ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 0xd], ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x11], ecx
push edx
mov dword [esp + 0x19], ecx
push eax
mov word [esp + 0x21], cx
mov byte [esp + 0x14], 0
mov byte [esp + 0x23], cl
mov ecx, dword [esp + 0x6c]
push ecx
push 1
push ebp
mov ecx, esi
call fcn.00531b20
test eax, eax
mov dword [esi + 4], eax
je 0x53219e
push 0x12345678
push str.result__SetPwd__CalcHmacMd5_Fail_
mov ecx, esi
call fcn.00532c10
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x4c
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0x37]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
inc al
mov edx, 0x23
mov ecx, 1
mov byte [esp + 0x37], al
mov al, byte [esp + 0x35]
cmp edx, ecx
jle 0x5321e3
xor al, byte [esp + ecx + 0x35]
inc ecx
cmp ecx, edx
jl 0x5321da
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x34], al
mov eax, dword [esi + 0x2c]
mov edi, 0x23
mov dword [eax], ecx
mov edx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x2c]
mov ecx, 1
mov dword [eax + 0xc], edx
mov al, byte [esp + 0x35]
cmp edi, ecx
mov dl, al
jle 0x532222
xor dl, byte [esp + ecx + 0x35]
inc ecx
cmp ecx, edi
jl 0x532219
cmp dl, byte [esp + 0x34]
je 0x532231
mov dword [esi + 0x10], 0xfe
jmp 0x532241
mov ecx, dword [esp + 0x35]
and ecx, 0xff
shr ecx, 4
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x36]
and al, 0xf
and ecx, 0xff
mov edx, ecx
and edx, 0xf
shr ecx, 4
neg al
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x1c]
sbb eax, eax
push ecx
neg eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x3b]
push 0x3c
push 0
push ebp
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], eax
call fcn.005319f0
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x532296
push 0x12345678
push str.result__WriteHeader_error_
mov ecx, esi
call fcn.00532c10
xor edx, edx
test edi, edi
sete dl
mov edi, edx
test edi, edi
jne 0x5322b4
push 0x12345678
push str.result__SetPwd__WriteHeader_Fail_
mov ecx, esi
call fcn.00532c10
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x532fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
jl 0x533079
mov ecx, dword [esp + 0x24]
test ecx, ecx
jl 0x533079
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x533079
test eax, eax
jle 0x533000
cmp eax, 0x3c
jl 0x533079
add eax, ecx
cmp eax, 0x3e8
jg 0x533079
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp ecx, 0x3c
jne 0x533079
cmp word [ebx], 0x5549
jne 0x533079
lea edi, [ebx + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
jb 0x533079
mov dl, byte [ebx + 0x19]
lea esi, [ebx + 0x19]
mov eax, ebx
mov ecx, 1
sub eax, esi
add eax, 0x3c
cmp eax, ecx
jle 0x53303c
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, eax
jl 0x533034
cmp dl, byte [ebx + 0x18]
jne 0x533079
xor eax, eax
mov ecx, 4
mov dword [esp + 0xd], eax
lea edi, [esp + 0xc]
mov dword [esp + 0x11], eax
lea esi, [ebx + 0x1c]
mov dword [esp + 0x15], eax
xor edx, edx
mov word [esp + 0x19], ax
mov byte [esp + 0xc], 0
mov byte [esp + 0x1b], al
mov eax, edx
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
setne al
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x537870
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x208
push ebp
push esi
call fcn.004d8310
test eax, eax
je 0x5378c2
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push eax
mov eax, dword [esp + 0x224]
push ecx
mov ecx, dword [esp + 0x224]
push edx
mov edx, dword [esp + 0x220]
push eax
push ecx
push edx
call fcn.00537c10
add esp, 0x18
pop esi
pop ebp
add esp, 0x208
ret
mov esi, dword [esp + 0x218]
test esi, esi
je 0x537a0c
mov ebp, dword [esp + 0x21c]
test ebp, ebp
je 0x537a0c
mov eax, dword [0x6a56f4]
test eax, eax
jne 0x537916
push 1
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004a6a20
add esp, 0xc
mov dword [0x6a56f4], eax
test eax, eax
jne 0x537916
pop esi
mov eax, 0xf0000002
pop ebp
add esp, 0x208
ret
push 0x6979f8
call fcn.00538a00
add esp, 4
push esi
push 0
push 0x43a
call eax
mov esi, eax
test esi, esi
jne 0x537954
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.RemoteLoadDll_ProcID____OpenProcess___failed__errno___ld_n
call fcn.005a6fd0
add esp, 8
mov eax, esi
pop esi
pop ebp
add esp, 0x208
ret
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x114]
push 0x104
push eax
push 0xffffffffffffffff
push ebp
call fcn.00493a70
mov eax, dword [esp + 0x238]
add esp, 0x14
test eax, eax
je 0x5379c1
push 0
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0xffffffffffffffff
push eax
call fcn.00493a70
add esp, 0x14
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
push edx
push eax
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x11c]
push edx
push eax
push ecx
push esi
call fcn.00537d70
add esp, 0x1c
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x208
ret
pop esi
mov eax, 0xf0000001
pop ebp
add esp, 0x208
ret
Function at 0x537a20
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20c
push ebp
push esi
call fcn.004d8310
test eax, eax
je 0x537a72
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x22c]
push eax
mov eax, dword [esp + 0x22c]
push ecx
mov ecx, dword [esp + 0x22c]
push edx
mov edx, dword [esp + 0x224]
push eax
push ecx
push edx
call fcn.00537c10
add esp, 0x18
pop esi
pop ebp
add esp, 0x20c
ret
mov ebp, dword [esp + 0x21c]
test ebp, ebp
je 0x537bf5
mov esi, dword [esp + 0x220]
test esi, esi
je 0x537bf5
mov eax, dword [esp + 0x224]
test eax, eax
je 0x537bf5
mov eax, dword [0x6a56f4]
test eax, eax
jne 0x537ad5
push 1
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004a6a20
add esp, 0xc
mov dword [0x6a56f4], eax
test eax, eax
jne 0x537ad5
pop esi
mov eax, 0xf0000002
pop ebp
add esp, 0x20c
ret
push edi
xor edi, edi
test esi, esi
jbe 0x537be9
push ebx
mov ebx, dword [esp + 0x230]
mov dword [esp + 0x10], esi
push 0x6979f8
call fcn.00538a00
mov ecx, dword [ebp]
add esp, 4
push ecx
push 0
push 0x43a
call eax
mov esi, eax
test esi, esi
jne 0x537b2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp]
mov edi, eax
push edi
push edx
push str.RemoteLoadDll_ProcIDArray____OpenProcess___failed_ID:__ld__errno___ld_n
call fcn.005a6fd0
add esp, 0xc
jmp 0x537bd6
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x22c]
push 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x11c]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
call fcn.00493a70
add esp, 0x14
test ebx, ebx
je 0x537b97
push 0
lea edx, [esp + 0x18]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
call fcn.00493a70
add esp, 0x14
mov eax, dword [esp + 0x23c]
mov ecx, dword [esp + 0x238]
mov edx, dword [esp + 0x234]
push eax
push ecx
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x22c]
lea ecx, [esp + 0x124]
push eax
push ecx
push edx
push esi
call fcn.00537d70
add esp, 0x1c
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
add ebp, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x537aec
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop esi
mov eax, 0xf0000001
pop ebp
add esp, 0x20c
ret
Function at 0x537c10
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x138
test eax, eax
push ebx
push ebp
push esi
jne 0x537c30
pop esi
pop ebp
mov eax, 0xf0000001
pop ebx
add esp, 0x138
ret
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x6823d0
call esi
push str.comctl32.dll
mov ebp, eax
call esi
test ebp, ebp
mov ebx, eax
je 0x537d41
test ebx, ebx
je 0x537d41
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
test eax, eax
je 0x537ceb
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x44]
mov byte [esp + 0x10], al
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [str.nelThreadCreateKer]
push 9
add ecx, 9
lea edx, [esp + 0x48]
push ecx
push edx
stosb byte es:[edi], al
call fcn.00466960
mov eax, dword [str.nelThreadCreateKer]
push 9
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00466960
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x44]
push eax
push ebp
call esi
push 0x47
push ebx
call esi
push 0x49
push ebx
call esi
push str.LoadLibraryA
push ebp
call esi
push str.FreeLibrary
push ebp
call esi
push str.GetProcAddress
push ebp
call esi
push str.GetModuleHandleA
push ebp
call esi
push str.RemoteLoadDll9x_____Can_not_get_function_address
call fcn.005a6fd0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
Function at 0x53a870
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630c00
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x53a8a4
mov ebx, 0x10000
jmp 0x53a8aa
add ebx, 0x10000
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or edi, 0xffffffff
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jbe 0x53a958
cmp dword [ebp - 0x28], 0x1000
jne 0x53a970
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x53a970
test ah, 1
jne 0x53a970
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x40
jbe 0x53a96d
cmp word [ebx], 0x5a4d
jne 0x53a96d
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov dword [ebp - 0x40], esi
mov ecx, esi
sub ecx, ebx
add ecx, 4
cmp ecx, eax
jb 0x53a928
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x53a96d
cmp dword [esi], 0x4550
mov dword [ebp - 4], edi
jne 0x53a970
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + edx]
jmp 0x53a8b9
Function at 0x53ab80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630c20
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
xor edi, edi
cmp eax, edi
jne 0x53abc0
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edi
cmp word [ecx], 0x5a4d
je 0x53abd4
push 0xc1
jmp 0x53acc8
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax], 0x4550
je 0x53abee
push 0xbf
jmp 0x53acc8
mov cx, word [eax + 0x14]
cmp cx, di
je 0x53acc3
and ecx, 0xffff
lea ecx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edi
xor edx, edx
mov dx, word [eax + 6]
cmp edi, edx
jae 0x53acc3
lea eax, [edi + edi*4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
mov esi, str.tdetour
mov ecx, eax
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [esi]
jne 0x53ac4d
test dl, dl
je 0x53ac49
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [esi + 1]
jne 0x53ac4d
add ecx, 2
add esi, 2
test dl, dl
jne 0x53ac29
xor ecx, ecx
jmp 0x53ac52
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x53acae
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x53acc3
mov edx, dword [eax + 0x10]
test edx, edx
je 0x53acc3
mov edx, dword [ebp - 0x1c]
lea esi, [ecx + edx]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov eax, dword [esi]
cmp eax, 0x40
jb 0x53acc3
cmp dword [esi + 4], 0x727444
jne 0x53acc3
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x53ac8a
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x24]
jmp 0x53ac0b
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53af10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630c40
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xc]
test eax, eax
mov esi, 0x10000
je 0x53af48
lea esi, [eax + 0x10000]
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or ebx, 0xffffffff
mov edi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x53af88
mov eax, dword [ebp - 0x2c]
mov ecx, eax
and ecx, 0xfff
cmp ecx, 0xfff
je 0x53af88
mov edx, dword [ebp - 0x38]
add eax, edx
cmp eax, esi
jae 0x53af9d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 0x28], 0x1000
jne 0x53b05e
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x53b05e
test ah, 1
jne 0x53b05e
mov dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x78]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x53afea
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x53af5a
cmp word [ebp - 0x78], 0x5a4d
jne 0x53b018
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x2c]
ja 0x53b018
cmp eax, 0x40
jb 0x53b018
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x53b029
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x53af5a
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
mov dword [ebp - 4], ebx
jne 0x53b05e
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x53af5a
Function at 0x53c950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630c50
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x53c988
lea esi, [eax + 0x10000]
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or ebx, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call edi
test eax, eax
jbe 0x53ca16
cmp dword [ebp - 0x28], 0x1000
jne 0x53c9d3
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x53c9d3
test ah, 1
jne 0x53c9d3
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], esi
cmp word [esi], 0x5a4d
je 0x53c9de
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x2c]
lea esi, [edx + ecx]
jmp 0x53c99d
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 0x40], eax
cmp dword [eax], 0x4550
mov dword [ebp - 4], ebx
jne 0x53c9d3
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53cc30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630c70
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
xor edi, edi
cmp eax, edi
jne 0x53cc70
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edi
cmp word [ecx], 0x5a4d
je 0x53cc84
push 0xc1
jmp 0x53cd78
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax], 0x4550
je 0x53cc9e
push 0xbf
jmp 0x53cd78
mov cx, word [eax + 0x14]
cmp cx, di
je 0x53cd73
and ecx, 0xffff
lea ecx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edi
xor edx, edx
mov dx, word [eax + 6]
cmp edi, edx
jae 0x53cd73
lea eax, [edi + edi*4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
mov esi, str.tdetour
mov ecx, eax
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [esi]
jne 0x53ccfd
test dl, dl
je 0x53ccf9
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [esi + 1]
jne 0x53ccfd
add ecx, 2
add esi, 2
test dl, dl
jne 0x53ccd9
xor ecx, ecx
jmp 0x53cd02
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x53cd5e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x53cd73
mov edx, dword [eax + 0x10]
test edx, edx
je 0x53cd73
mov edx, dword [ebp - 0x1c]
lea esi, [ecx + edx]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov eax, dword [esi]
cmp eax, 0x40
jb 0x53cd73
cmp dword [esi + 4], 0x727444
jne 0x53cd73
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x53cd3a
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x24]
jmp 0x53ccbb
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4