joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409890
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5b1704], 0
jne 0x409925
push esi
push 0x248
mov dword [ebp - 4], 0x248
call fcn.0040c02f
mov esi, eax
add esp, 4
test esi, esi
je 0x409924
push edi
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
lea eax, [ebp - 4]
push eax
push esi
call edi
cmp eax, 0x6f
jne 0x4098ed
push esi
call fcn.0040c05c
push dword [ebp - 4]
call fcn.0040c02f
mov esi, eax
add esp, 8
test esi, esi
je 0x40991a
lea eax, [ebp - 4]
push eax
push esi
call edi
test eax, eax
jne 0x40991a
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
lea eax, [esi + 0x110]
push eax
call edi
mov dword [0x5b1704], eax
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x40991a
add eax, 4
push eax
call edi
mov dword [0x5b1708], eax
push esi
call fcn.0040c05c
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409c30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5448f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a61b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [edx], ax
jne 0x409c7a
xor ecx, ecx
jmp 0x409c8f
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409c80
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0040b9d0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
cmp word [edi], ax
jne 0x409cbf
xor ecx, ecx
jmp 0x409cd3
mov ecx, edi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409cc4
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x18]
call fcn.0040b9d0
mov byte [esi + 0x30], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409d90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x30], 0
je 0x409ea8
cmp dword [esi + 0x2c], 8
push edi
lea edi, [esi + 0x18]
jb 0x409db1
mov ecx, dword [edi]
jmp 0x409db3
mov ecx, edi
cmp dword [esi + 0x14], 8
jb 0x409dbd
mov eax, dword [esi]
jmp 0x409dbf
mov eax, esi
push ebx
push ecx
push eax
push str.__MULTI_PARTS_FORM_DATA_BOUNDARY
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_n_r_n
push dword [ebp + 8]
call fcn.0052c7dd
mov ebx, dword [esi + 0x10]
add esp, 0x14
add ebx, 0x5c
add ebx, dword [esi + 0x28]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x10], ebx
jb 0x409deb
mov edi, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x409e9d
cmp edi, 0xffffffff
je 0x409e9d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push esi
push ecx
add eax, ebx
mov dword [ebp - 4], 0
push 0x400
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409e7c
mov ebx, dword [ebp - 8]
lea ecx, [ecx]
mov eax, dword [ebp - 4]
test eax, eax
je 0x409e79
cmp esi, ebx
ja 0x409e79
add esi, eax
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp - 0xc]
push 0x400
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409e50
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add esi, ebx
mov ecx, 0xa0d
push edi
mov word [esi + eax], cx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
lea eax, [esi + 2]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x2c], 8
lea eax, [esi + 0x18]
jb 0x409eb3
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x409ebb
mov ecx, dword [esi]
push eax
push ecx
push str.__MULTI_PARTS_FORM_DATA_BOUNDARY
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push dword [ebp + 8]
call fcn.0052c7dd
mov eax, dword [esi + 0x10]
add esp, 0x14
add eax, 0x51
add eax, dword [esi + 0x28]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a1a0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
push 0
push dword [ebp + 8]
mov edi, ecx
push dword [ebp + 0x20]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
test eax, eax
je 0x40a335
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp + 8]
push 4
push ecx
push 3
push eax
mov dword [ebp + 8], 5
call esi
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2bf20
push eax
push 2
push dword [edi + 4]
call esi
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2bf20
push eax
push 5
push dword [edi + 4]
call esi
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2bf20
push eax
push 6
push dword [edi + 4]
call esi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
sub eax, 0
je 0x40a25b
dec eax
je 0x40a247
dec eax
jne 0x40a280
movzx eax, si
test esi, esi
jne 0x40a23f
mov eax, 0x1bb
push 0
push 0
push 3
jmp 0x40a270
movzx eax, si
test esi, esi
jne 0x40a253
mov eax, 0x50
push 0
push 0
push 3
jmp 0x40a270
movzx eax, si
test esi, esi
jne 0x40a267
mov eax, 0x15
push 0
push 0x8000000
push 1
push ecx
push edx
push eax
push ebx
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi + 8], eax
cmp dword [edi + 8], 0
je 0x40a335
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x40a335
cmp word [ebx], ax
jne 0x40a2a3
xor ecx, ecx
jmp 0x40a2bf
mov ecx, ebx
lea edx, [ecx + 2]
jmp 0x40a2b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a2b0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x10]
call fcn.0040b9d0
test esi, esi
jne 0x40a2f5
mov eax, dword [ebp + 0x1c]
sub eax, esi
je 0x40a2ec
dec eax
je 0x40a2e3
dec eax
jne 0x40a2f8
mov dword [edi + 0x70], 0x1bb
jmp 0x40a2f8
mov dword [edi + 0x70], 0x50
jmp 0x40a2f8
mov dword [edi + 0x70], 0x15
jmp 0x40a2f8
mov dword [edi + 0x70], esi
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x74], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40a30e
push eax
lea ecx, [edi + 0x28]
call fcn.0040b760
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x40a31e
push eax
lea ecx, [edi + 0x40]
call fcn.0040b760
mov ecx, edi
call fcn.0040a7e0
mov ecx, edi
call fcn.0040a680
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x1c
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x40a345
push eax
call esi
mov eax, dword [edi + 8]
mov dword [edi + 4], 0
test eax, eax
je 0x40a356
push eax
call esi
mov dword [edi + 8], 0
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x40a470
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x544958
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5a61b0]
xor eax, esp
mov dword [esp + 0x3c], eax
push esi
push edi
mov eax, dword [0x5a61b0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 8]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x14], 0x58811c
mov dword [esp + 0x18], 0
test ecx, ecx
je 0x40a679
xor eax, eax
mov dword [esp + 0x10], 0x800000
cmp dword [edi + 0x74], 2
push 0
cmove eax, dword [esp + 0x14]
or eax, 0x4000000
push eax
lea eax, [esp + 0x1c]
push eax
push edx
push str.HTTP_1.0
push esi
push 0x588138
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0xc], eax
test eax, eax
je 0x40a679
push SysReAllocStringLen
push 0xd
push str.Accept:___r_n
push eax
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
je 0x40a679
cmp dword [edi + 0x84], 0
jbe 0x40a631
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x58], eax
mov eax, dword [edi + 0x74]
dec eax
je 0x40a55a
dec eax
jne 0x40a568
push str.https:__
jmp 0x40a55f
push str.http:__
lea ecx, [esp + 0x20]
call fcn.0040b760
cmp dword [edi + 0x24], 8
lea eax, [edi + 0x10]
jb 0x40a573
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x20]
call fcn.0040b7b0
mov eax, dword [edi + 0x74]
cmp eax, 1
jne 0x40a58b
cmp dword [edi + 0x70], 0x50
je 0x40a5cd
cmp eax, 2
jne 0x40a599
cmp dword [edi + 0x70], 0x1bb
je 0x40a5cd
push dword [edi + 0x70]
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
push 0x588180
push eax
movdqu xmmword [esp + 0x44], xmm0
call fcn.0052bc55
add esp, 0xc
lea eax, [esp + 0x34]
lea ecx, [esp + 0x1c]
push eax
call fcn.0040b7b0
push esi
lea ecx, [esp + 0x20]
call fcn.0040b7b0
mov eax, dword [edi + 0x80]
mov esi, dword [eax]
cmp esi, eax
je 0x40a61e
mov ecx, dword [esi + 8]
cmp dword [ecx + 0x2c], 8
lea edx, [ecx + 0x18]
jb 0x40a5f1
mov edx, dword [edx]
cmp dword [ecx + 0x14], 8
jb 0x40a5f9
mov ecx, dword [ecx]
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push edx
cmovae eax, dword [esp + 0x20]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetSetCookieW]
test eax, eax
je 0x40a666
mov esi, dword [esi]
cmp esi, dword [edi + 0x80]
jne 0x40a5e3
cmp dword [esp + 0x30], 8
jb 0x40a631
push dword [esp + 0x1c]
call fcn.0040c05c
add esp, 4
push 0
push 0
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
setne al
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0052ace1
mov esp, ebp
pop ebp
ret 8
cmp dword [esp + 0x30], 8
jb 0x40a679
push dword [esp + 0x1c]
call fcn.0040c05c
add esp, 4
xor al, al
jmp 0x40a647
Function at 0x40ace0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
cmp dword [eax + 0x7c], ecx
jbe 0x40ad6f
mov eax, dword [eax + 0x78]
push esi
mov esi, dword [eax]
cmp esi, eax
je 0x40ad68
push ebx
push edi
mov eax, dword [esi + 8]
cmp byte [eax + 0x30], 0
je 0x40ad4b
add eax, 0x18
cmp dword [eax + 0x14], 8
jb 0x40ad15
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
lea ebx, [eax + 0x1800]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
jmp 0x40ad50
mov ebx, 0x2000
mov eax, dword [ebp - 8]
add ecx, ebx
mov esi, dword [esi]
mov dword [ebp - 4], ecx
cmp esi, dword [eax + 0x78]
jne 0x40ad01
pop edi
pop ebx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b200
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40b22f
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
mov eax, dword [ebp - 4]
je 0x40b22f
test eax, eax
jne 0x40b247
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40b240
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], 0
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40e403
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40e448
call fcn.0041ab5b
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40e448
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40e464
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041b091
mov ebx, eax
test edi, edi
je 0x40e462
test esi, esi
je 0x40e462
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x417f65
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041ab5b
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417f9c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00417fbd
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ac8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00412ea2
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41acc9
call fcn.0041aeac
mov dword [esi + 0xc], 1
jmp 0x41acce
call fcn.0041aeac
cmp dword [esi], 0
je 0x41ad17
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41acf1
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00404ba0
jmp 0x41ad02
push 0xff
mov ecx, esi
call fcn.00405020
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00404b50
jmp 0x41ad3b
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41ad3b
push dword [esi]
push dword [ebp - 4]
call fcn.0041e5b4
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41ae01
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041aeac
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41ae49
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00404ba0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00404b50
jmp 0x41ae54
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041e5b4
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x453184
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x547e03
call fcn.0052ca55
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404a70
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x587f6c
call fcn.00404530
cmp eax, 0xffffffff
jne 0x453238
push 0
push 0x5882f4
lea ecx, [ebp - 0x4d0]
call fcn.00404530
cmp eax, 0xffffffff
jne 0x453238
push 0
push 0x5882f0
lea ecx, [ebp - 0x4d0]
call fcn.00404530
cmp eax, 0xffffffff
jne 0x453238
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404a70
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x453214
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00402e90
jmp 0x453267
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00405170
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402e90
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45325e
mov ebx, dword [ebp - 0x4cc]
jmp 0x453267
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00402e90
mov eax, ebx
call fcn.0052ca04
ret

Function at 0x51d10c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0051c8bc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0051c871
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
invalid
invalid
dec edx
Function at 0x53eac8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a61b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00532cd3
mov dword [ebp - 0x14], eax
cmp dword [0x5b15f4], esi
jne 0x53ebbb
push 0x800
push esi
push 0x582590
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x53eb48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x53ec9b
push esi
push esi
push 0x582590
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x53ec9b
push 0x5825a8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x53ec9b
push eax
call ebx
push 0x5825b4
push edi
mov dword [0x5b15f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5825c4
push edi
mov dword [0x5b15f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5b15fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b1604], eax
test eax, eax
je 0x53ebb8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b1600], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x53ebe0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x53ebd3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x53ebf5
push 4
pop eax
jmp 0x53ec9d
cmp dword [ebp - 0x14], esi
je 0x53ebf5
push dword [0x5b15f4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x53ebda
mov eax, dword [0x5b1600]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x53ec53
cmp dword [0x5b1604], edi
je 0x53ec53
push eax
call ebx
push dword [0x5b1604]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x53ec53
test eax, eax
je 0x53ec53
call ecx
test eax, eax
je 0x53ec48
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x53ec48
test byte [ebp - 8], 1
jne 0x53ec53
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x53ec83
mov eax, dword [0x5b15f8]
cmp eax, edi
je 0x53ec80
push eax
call ebx
test eax, eax
je 0x53ec80
call eax
mov esi, eax
test esi, esi
je 0x53ec80
mov eax, dword [0x5b15fc]
cmp eax, edi
je 0x53ec80
push eax
call ebx
test eax, eax
je 0x53ec80
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5b15f4]
call ebx
test eax, eax
je 0x53ec9b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x53ec9d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ace1
mov esp, ebp
pop ebp
ret
Function at 0x10105860
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x1505
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x29ed8ebf
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0xa229e44c
je 0x1010594d
jmp 0x1010589e
mov eax, dword [ebp - 0x14]
sub eax, 0x29ed8ebf
je 0x1010590a
jmp 0x101058b1
mov eax, dword [ebp - 0x14]
sub eax, 0x5f656ec6
je 0x10105a9d
nop
jmp 0x101058c5
mov eax, dword [ebp - 0x14]
sub eax, 0x6227d0c7
je 0x10105959
jmp 0x101058d8
mov eax, dword [ebp - 0x14]
nop dword [eax + eax]
sub eax, 0x69a9d8c4
je 0x10105925
jmp 0x101058f0
mov eax, dword [ebp - 0x14]
sub eax, 0x6c889d12
je 0x10105a13
nop
jmp 0x10105905
jmp 0x10105aa5
mov edx, dword [ebp - 0xc]
mov eax, 0x5f656ec6
mov ecx, 0x69a9d8c4
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10105aa5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov al, byte [eax + ecx]
mov byte [ebp - 5], al
movzx edx, byte [ebp - 5]
mov eax, 0x6227d0c7
mov ecx, 0xa229e44c
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10105aa5
mov dword [ebp - 0x10], 0x5f656ec6
jmp 0x10105aa5
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, dword [ebp - 4]
xor ecx, ecx
sub ecx, edx
add ecx, 0
mov edx, 0x6a561e2a
add edx, 0
add edx, ecx
sub edx, 0x6a561e2a
add eax, 0x4f1668bb
add eax, 0x759ba10d
sub eax, 0x4f1668bb
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x2ebb713b
sub eax, 0x759ba10d
add eax, 0x2ebb713b
movzx ecx, byte [ebp - 5]
xor edx, edx
sub edx, 0x17f194ca
sub eax, edx
sub eax, 0xc15a40cd
sub eax, 0xafa0b9df
add eax, 0xc15a40cd
add eax, 0xfeabb46
sub eax, 0x17f194ca
sub eax, 0xfeabb46
add eax, 0xaa6fb0f1
sub eax, 0x59bf5aa6
sub eax, 0xaa6fb0f1
sub eax, 0xe3e3d0e8
add eax, ecx
add eax, 0xe3e3d0e8
sub eax, 0x1882f074
add eax, 0x59bf5aa6
add eax, 0x1882f074
xor edx, edx
sub edx, 0xafa0b9df
add edx, 0
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x6c889d12
jmp 0x10105aa5
mov eax, dword [ebp - 0xc]
add eax, 0x2da44016
sub eax, 0x1b23d2e7
sub eax, 0x2da44016
xor ecx, ecx
sub ecx, 0x1a0658b0
add eax, ecx
xor ecx, ecx
sub ecx, 0x1b23d2e7
sub eax, ecx
xor ecx, ecx
sub ecx, eax
add ecx, 0
xor edx, edx
sub edx, 1
add edx, 0
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xd85e29cb
sub eax, ecx
add eax, 0xd85e29cb
xor ecx, ecx
sub ecx, 0x85fa7465
add eax, ecx
sub eax, 0x4b8bebb0
add eax, 0x1a0658b0
add eax, 0x4b8bebb0
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x85fa7465
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x29ed8ebf
jmp 0x10105aa5
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
jmp 0x10105888