joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100700d0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10070129
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10070131
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10070146
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x1007015c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
call fcn.1008a221
mov esp, ebp
pop ebp
ret
push 0x100d8878
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.1008f709
int3

Function at 0x10070170
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100701cc
cmp dword [ebp - 0x88], 2
jne 0x100701cc
cmp dword [ebp - 0x94], 6
jb 0x100701cc
cmp dword [ebp - 0x90], 2
jb 0x100701cc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a221
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1008a221
mov esp, ebp
pop ebp
ret
Function at 0x10071800
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1e58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x10071838
mov edi, dword [esi]
jmp 0x1007183a
mov edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10071850
shr al, 4
and al, 1
jmp 0x100718d1
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10071090
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x1007186c
mov eax, dword [esi]
jmp 0x1007186e
mov eax, esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
push 0
call fcn.10071710
test eax, eax
je 0x100718be
lea eax, [ebp - 0x28]
push eax
call fcn.10071800
add esp, 4
test al, al
je 0x100718be
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100718ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100718be
push esi
call fcn.100718f0
add esp, 4
test al, al
je 0x100718be
mov bl, 1
jmp 0x100718c0
xor bl, bl
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10070da0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a221
mov esp, ebp
pop ebp
ret

Function at 0x100718f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x100718fe
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10071912
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x10071920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1007192e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x100730e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b21d8
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], 0
push esi
mov dword [ebp - 4], 0
call fcn.10004f87
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10066780
mov dword [ebp - 0xf8], 0x100bc728
mov dword [ebp - 0xe8], 0x100bc720
push 0
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ebp - 0x44], 1
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], 0x100b46c4
mov dword [ebp - 0x94], 0x50
movlpd qword [ebp - 0xf0], xmm0
call fcn.10005f6c
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], 0x100b470c
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xec], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf8], 0x100b477c
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0xfc], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 4], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf8], 0x100b4784
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xfc], eax
lea ecx, [ebp - 0xe0]
call fcn.100043ae
mov dword [ebp - 0xe0], 0x100b4734
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push eax
push 0x100bc260
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x100bc264
push 0x1e
push 0x100bc268
push str.dcheck.cpp
push 0x100bc27c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xe8]
push 0x100bc284
push eax
call fcn.10004db9
add esp, 8
mov ecx, eax
call fcn.10003157
push eax
call fcn.10004db9
add esp, 8
push eax
call fcn.10004db9
add esp, 8
push eax
call fcn.10004db9
add esp, 8
mov ecx, eax
call fcn.10003057
push eax
call fcn.10004db9
add esp, 8
mov ecx, eax
call fcn.10003157
push eax
call fcn.10004db9
add esp, 8
push eax
call fcn.1005acfb
push eax
call fcn.10004f87
add esp, 0xc
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xf8]
push eax
call fcn.100032f9
cmp dword [eax + 0x14], 0x10
jb 0x100732d7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x2c], 0x10
jb 0x100732ef
push dword [ebp - 0x40]
call fcn.1008a230
add esp, 4
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.100032ca
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0x100b46b4
push eax
call fcn.10073845
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x10073328
push dword [ebp - 0x28]
call fcn.1008a230
add esp, 4
add esi, 0x50
mov dword [ebp - 0x14], 0xf
mov ecx, esi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
call fcn.100666b0
push esi
mov dword [esi], 0x100b46b4
call fcn.10073845
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a221
mov esp, ebp
pop ebp
ret
Function at 0x10003100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000310f
pop dword [ebp - 0x44]
mov eax, 0x1000310f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3878bdbd
add dword [ebp - 0x54], 0x15d9878e
mov dword [ebp - 0x50], 0x74f2f31c
sub dword [ebp - 0x50], 0x42bfa6d7
mov dword [ebp - 0x4c], 0x5d119cb6
sub dword [ebp - 0x4c], 0x10c55888
mov dword [ebp - 0x48], 0x4fb93af9
sub dword [ebp - 0x48], 0x4fb93af9
lea eax, [ebp - 0x54]
push eax
mov eax, 0xef33b768
add eax, 0x20d209a4
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x183ccf67
add dword [ebp - 0x54], 0x5c3599ef
mov dword [ebp - 0x50], 0x8bdc02
sub dword [ebp - 0x50], 0xbf1f7a8d
mov dword [ebp - 0x4c], 0x5dad558f
sub dword [ebp - 0x4c], 0xfa3de923
mov dword [ebp - 0x48], 0x6e0bc193
add dword [ebp - 0x48], 0x91f43e6d
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x8c1915c
add eax, 0x7442ee4
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x5afe3
push 0
call eax
mov ecx, 0x4ce6
xor edx, edx
add edx, eax
mov edi, 0x82dba795
add edi, 0x8d2b226b
add edi, dword [ebp - 0x44]
mov esi, 0x15217d51
sub esi, 0x6f72e2c3
xor dword [ebp - 0x28], edi
mov ebx, dword [edi]
xor dword [ebp - 0x38], 0x438c2517
xor ebx, esi
sub dword [ebp - 0x10], ecx
mov dword [edx], ebx
add edx, 4
add edi, 4
loop 0x10003228
add eax, 0xd3aac6b4
add eax, 0x2c565fb7
mov ebx, eax
add eax, 0x4dd2c5bd
sub eax, 0x4dd2c5b8
mov ecx, 0x2ddd48dc
sub ecx, 0x1ddd48dc
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x426380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5e34ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x370]
mov dword [esp + 0x18], 0x27
call fcn.005df184
lea ecx, [esi + 0x36c]
mov byte [esp + 0x18], 0x26
call fcn.005df184
lea ecx, [esi + 0x368]
mov byte [esp + 0x18], 0x25
call fcn.005df184
lea ecx, [esi + 0x350]
mov byte [esp + 0x18], 0x24
call fcn.005df184
lea ecx, [esi + 0x340]
mov byte [esp + 0x18], 0x23
call fcn.005df184
lea ecx, [esi + 0x330]
mov byte [esp + 0x18], 0x22
call fcn.005df184
lea ecx, [esi + 0x32c]
mov byte [esp + 0x18], 0x21
call fcn.005df184
lea ecx, [esi + 0x328]
mov byte [esp + 0x18], 0x20
call fcn.005df184
lea ecx, [esi + 0x314]
mov byte [esp + 0x18], 0x1f
call fcn.005df184
lea ecx, [esi + 0x310]
mov byte [esp + 0x18], 0x1e
call fcn.005df184
lea ecx, [esi + 0x30c]
mov byte [esp + 0x18], 0x1d
call fcn.005df184
lea ecx, [esi + 0x308]
mov byte [esp + 0x18], 0x1c
call fcn.005df184
mov byte [esp + 0x18], 0x1b
lea ecx, [esi + 0x304]
call fcn.005df184
lea ecx, [esi + 0x300]
mov byte [esp + 0x18], 0x1a
call fcn.005df184
lea ecx, [esi + 0x2fc]
mov byte [esp + 0x18], 0x19
call fcn.005df184
lea ecx, [esi + 0x2f8]
mov byte [esp + 0x18], 0x18
call fcn.005df184
lea ecx, [esi + 0x2f4]
mov byte [esp + 0x18], 0x17
call fcn.005df184
lea ecx, [esi + 0x2f0]
mov byte [esp + 0x18], 0x16
call fcn.005df184
lea ecx, [esi + 0x2ec]
mov byte [esp + 0x18], 0x15
call fcn.005df184
lea ecx, [esi + 0x2e8]
mov byte [esp + 0x18], 0x14
call fcn.005df184
lea ecx, [esi + 0x2e4]
mov byte [esp + 0x18], 0x13
call fcn.005df184
lea ecx, [esi + 0x2e0]
mov byte [esp + 0x18], 0x12
call fcn.005df184
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 0x11
call fcn.005df184
lea ecx, [esi + 0x2d8]
mov byte [esp + 0x18], 0x10
call fcn.005df184
lea ecx, [esi + 0x154]
mov byte [esp + 0x18], 0xf
call fcn.005df250
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 0xe
call fcn.005df250
lea ecx, [esi + 0x108]
mov byte [esp + 0x18], 0xd
call fcn.005df184
lea ecx, [esi + 0x104]
mov byte [esp + 0x18], 0xc
call fcn.005df184
lea ecx, [esi + 0x100]
mov byte [esp + 0x18], 0xb
call fcn.005df184
lea ecx, [esi + 0xfc]
mov byte [esp + 0x18], 0xa
call fcn.005df184
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 9
call fcn.005df184
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 8
call fcn.005df184
lea ecx, [esi + 0xf0]
mov byte [esp + 0x18], 7
call fcn.005df184
lea ecx, [esi + 0xec]
mov byte [esp + 0x18], 6
call fcn.005df184
lea ecx, [esi + 0xe8]
mov byte [esp + 0x18], 5
call fcn.005df184
lea ecx, [esi + 0xe4]
mov byte [esp + 0x18], 4
call fcn.005df184
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 3
call fcn.005df184
lea ecx, [esi + 0xdc]
mov byte [esp + 0x18], 2
call fcn.005df184
lea ecx, [esi + 0xd8]
mov byte [esp + 0x18], 1
call fcn.005df184
lea edi, [esi + 0x60]
mov dword [esp + 0xc], edi
mov dword [edi], 0x5fe928
mov ecx, edi
mov byte [esp + 0x18], 0x28
call fcn.005df54a
mov ecx, esi
mov dword [edi], 0x5fe914
mov dword [esp + 0x18], 0xffffffff
call fcn.005df16c
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4603a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e6818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.005df190
xor ebp, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x70], ebp
call fcn.005df190
lea eax, [esp + 0x2c]
push 0x1d
push eax
lea ecx, [esi + 0x9c70]
mov byte [esp + 0x78], 1
call fcn.005df580
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005df424
call fcn.00542e20
fmul qword [0x5ff1b8]
add esp, 4
call fcn.005dfdf0
fld qword [esp + 0x78]
fcomp qword [0x5fd8b0]
mov edi, eax
fnstsw ax
test ah, 0x41
jne 0x46043e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
fild qword [esp + 0x1c]
fcomp qword [esp + 0x78]
fnstsw ax
test ah, 1
je 0x460535
push edi
lea eax, [esp + 0x30]
push 0x629424
push eax
call dword [0x5fca58]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
call fcn.005df27a
push 0xc6
lea ecx, [esp + 0x14]
call fcn.005df18a
cmp dword [0x63c2fc], ebp
jne 0x4604ed
lea edx, [esp + 0x10]
push 0x62b250
lea eax, [esp + 0x20]
push edx
push eax
call fcn.005df262
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x7c], 2
call fcn.005df25c
push 0x62b248
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x78], 3
push eax
call fcn.005df262
mov eax, dword [eax]
push ebp
push ebp
push eax
mov byte [esp + 0x7c], 4
call fcn.005df352
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 3
call fcn.005df184
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 2
call fcn.005df184
lea ecx, [esp + 0x1c]
mov byte [esp + 0x70], 1
call fcn.005df184
fld qword [esp + 0x78]
fcomp qword [0x5fd8b0]
fnstsw ax
test ah, 0x41
je 0x46050e
push 0x6292ec
lea ecx, [esi + 0x9a70]
call fcn.005df26e
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
fild qword [esp + 0x24]
fcomp qword [esp + 0x78]
fnstsw ax
test ah, 1
je 0x460535
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [esi + 0x9a70]
call fcn.005df26e
fld qword [esp + 0x78]
fsub qword [0x5fd8a8]
dec edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
fmul qword [0x5fdad8]
fild qword [esp + 0x24]
fdivp st(1)
fsubr qword [0x5fdad8]
call fcn.005dfdf0
push ebp
mov ecx, esi
mov dword [esi + 0x9cb4], eax
call fcn.005df1a2
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x30c8], edx
mov ecx, esi
mov dword [esi + 0x30cc], eax
call fcn.00469980
lea ecx, [esp + 0xc]
mov byte [esp + 0x70], 0
call fcn.005df184
lea ecx, [esp + 0x10]
mov dword [esp + 0x70], 0xffffffff
call fcn.005df184
mov ecx, dword [esp + 0x68]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x68
ret 0xc
Function at 0x475b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e714b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x602738
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x475b90
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x475b57
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x5fc0a0]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x475b81
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.005df64c
jmp 0x475b96
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.005df64c
jmp 0x475b96
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x5fe928
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.005df54a
mov ecx, esi
mov dword [edi], 0x5fe914
mov dword [esp + 0x1c], 0xffffffff
call fcn.005df616
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a9c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005df190
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0
call fcn.005df190
push str.psfdefault.psf
lea eax, [esp + 0x10]
push 0x63c118
push eax
mov byte [esp + 0x30], 1
call fcn.005df262
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.005df274
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.005df184
mov eax, dword [0x63c520]
cmp eax, 1
jle 0x4a9d24
dec eax
lea ecx, [esp + 8]
push eax
push 0x629424
push ecx
call fcn.005df346
add esp, 0xc
lea edx, [esp + 0x14]
push str.psfdefault
push 0x63c118
push edx
call fcn.005df262
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x30], 3
call fcn.005df25c
push str..psf
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x2c], 4
push eax
call fcn.005df262
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 5
call fcn.005df274
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.005df184
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.005df184
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.005df184
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.005df334
mov ecx, esi
call fcn.0049ab10
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.005df184
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.005df184
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x5249c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f1ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
lea ecx, [esp + 4]
call fcn.005df190
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x1c], 0
call fcn.005df274
push 0x635508
push 0x6327c4
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x629274
push 0x6295f0
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x629274
push 0x62a880
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x6327b8
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x6327b0
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x6327a8
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x6327a0
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632798
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632790
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632788
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632780
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632778
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632770
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632768
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632760
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632758
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632750
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632748
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632740
lea ecx, [esp + 0xc]
call fcn.005df55c
push 0x6327c0
push 0x632738
lea ecx, [esp + 0xc]
call fcn.005df55c
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [0x5fc030]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [esp + 0x18], 0xffffffff
call fcn.005df184
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x525280
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0xffff
mov dx, cx
add ecx, eax
test dx, dx
je 0x5252c5
mov edx, dword [esp + 4]
and ecx, eax
push ebx
inc ecx
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
xor cl, al
mov bl, ah
mov byte [esp + 0x10], cl
inc edx
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov ax, word [ecx*2 + 0x60a118]
xor ax, bx
dec esi
jne 0x52529e
pop esi
pop ebx
ret
Function at 0x543280
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x5f3377
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.005df190
fld qword [esp + 0x24]
fcom qword [0x5fd8b0]
mov ebx, 1
xor esi, esi
mov dword [esp + 0x18], ebx
fnstsw ax
test ah, 0x40
je 0x5432f0
push 0x629274
lea ecx, [esp + 0xc]
fstp st(0)
call fcn.005df27a
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.005df334
mov dword [esp + 0xc], ebx
jmp 0x543422
fcom qword [0x5fd8b0]
push edi
fnstsw ax
test ah, 1
je 0x543308
fchs
fst qword [esp + 0x28]
xor edi, edi
jmp 0x54330a
mov edi, ebx
fcom qword [0x5fd8a8]
fnstsw ax
test ah, 1
je 0x543331
fmul qword [0x5fe940]
sub esi, 3
fcom qword [0x5fd8a8]
fnstsw ax
test ah, 1
jne 0x543317
fst qword [esp + 0x28]
fcom qword [0x5fe940]
fnstsw ax
test ah, 1
jne 0x54338f
fmul qword [0x5fe948]
add esi, 3
fcom qword [0x5fe940]
fnstsw ax
test ah, 1
je 0x54333e
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x14]
push 0x6295e8
push eax
call fcn.005df346
lea eax, [esi + 0x18]
add esp, 0x10
cmp eax, 0x30
ja case.0x543384.8
xor ecx, ecx
mov cl, byte [eax + 0x543488]
jmp dword [ecx*4 + 0x543444]
push 0x79
jmp 0x5433d0
fstp st(0)
jmp 0x543358
push 0x7a
jmp 0x5433d0
push 0x61
jmp 0x5433d0
push 0x66
jmp 0x5433d0
push 0x70
jmp 0x5433d0
push 0x6e
jmp 0x5433d0
push 0xb5
jmp 0x5433d0
push 0x6d
jmp 0x5433d0
push 0x6b
jmp 0x5433d0
push 0x4d
jmp 0x5433d0
push 0x47
jmp 0x5433d0
push 0x54
jmp 0x5433d0
push 0x50
jmp 0x5433d0
push 0x45
jmp 0x5433d0
push 0x5a
jmp 0x5433d0
push 0x59
lea ecx, [esp + 0x10]
call fcn.005df33a
test edi, edi
pop edi
jne 0x54340e
lea edx, [esp + 8]
lea eax, [esp + 0x24]
push edx
push 0x62a880
push eax
call fcn.005df268
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call fcn.005df274
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call fcn.005df184
mov esi, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.005df334
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.005df184
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret