joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x533573
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x551e00]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
mov edi, dword [esp + 0x24]
push dword [edi + 4]
push dword [edi]
call fcn.00421d10
push 0x128
lea esi, [ebx + 0x24]
mov dword [esp + 0x20], 0
push 0
push esi
mov byte [esi + 0x128], 0
call fcn.004fa8e0
xor eax, eax
cmp byte [esi + 0x128], al
setne al
push eax
push esi
call fcn.0046a790
lea eax, [ebx + 0x150]
mov byte [esp + 0x30], 1
push eax
call fcn.0046bbb0
mov dword [ebx], 0x413a70
add esp, 0x18
mov eax, dword [edi + 8]
mov dword [ebx + 0x154], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0x158], eax
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4ea9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x533789
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x551e00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 8], 0
xorps xmm0, xmm0
mov esi, dword [esp + 0x38]
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
mov dword [esp + 0xc], 1
call fcn.004ea000
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0x34], 1
call fcn.00477e30
cmp dword [esp + 0x24], 0x10
mov byte [esp + 0x30], 0
mov dword [esp + 0xc], 0x408308
jb 0x4eaa4f
push dword [esp + 0x10]
call fcn.004f9345
add esp, 4
lea eax, [esp + 0xc]
push eax
call fcn.004ea030
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0x34], 2
call fcn.00477e30
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0xc], 0x408308
jb 0x4eaa87
push dword [esp + 0x10]
call fcn.004f9345
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x4eae20
Capabilities:
Check for software breakpoints

Disassembly:
push 0xffffffffffffffff
push 0x533816
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x551e00]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
cmp eax, ecx
je 0x4eae5e
jmp 0x4eae50
mov edx, dword [eax]
cmp byte [edx], 0xcc
je 0x4eae70
add eax, 4
cmp eax, ecx
jne 0x4eae50
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
mov eax, dword [0x559fb0]
test eax, eax
jne 0x4eaedf
push 0x20
call fcn.004f92f4
add esp, 4
test eax, eax
je 0x4eaed8
mov dword [eax + 0x1c], 0xf
mov dword [eax + 0x18], 0
mov byte [eax + 8], 0
mov dword [eax + 4], 0x408308
lea ecx, [eax + 8]
mov dword [eax], 0
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4eaeb8
mov ecx, dword [ecx]
mov byte [ecx], 0
mov dword [0x559fb0], eax
mov dword [eax], 0xb
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
xor eax, eax
mov dword [0x559fb0], eax
mov dword [eax], 0xb
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x4eee80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x533cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
mov eax, dword [0x551e00]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x8c]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x7b]
call fcn.004f0500
xor ecx, ecx
mov dword [esp + 0x84], 0
push 0xffffffffffffffff
push ecx
mov word [esp + 0x18], cx
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.0044f550
mov dword [esp + 0xc], 0x408964
lea eax, [esp + 0xc]
mov byte [esp + 0x84], 1
push eax
lea eax, [esi + 0x38]
push 0x80
push eax
call fcn.005241d0
add esp, 0xc
mov dword [esp + 0xc], 0x408964
cmp dword [esp + 0x24], 8
jb 0x4eef37
push dword [esp + 0x10]
call fcn.004f9345
add esp, 4
xor eax, eax
mov dword [esp + 0x24], 7
cmp dword [esp + 0x58], 8
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
mov dword [esp + 0x84], 0xffffffff
jb 0x4eef6c
push dword [esp + 0x44]
call fcn.004f9345
add esp, 4
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x7b]
call fcn.004f05e0
xor ecx, ecx
mov dword [esp + 0x84], 2
push 0xffffffffffffffff
push ecx
mov word [esp + 0x18], cx
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.0044f550
mov dword [esp + 0xc], 0x408964
lea eax, [esp + 0xc]
mov byte [esp + 0x84], 3
push eax
lea eax, [esi + 0xb8]
push 0x80
push eax
call fcn.005241d0
add esp, 0xc
mov dword [esp + 0xc], 0x408964
cmp dword [esp + 0x24], 8
jb 0x4eefed
push dword [esp + 0x10]
call fcn.004f9345
add esp, 4
xor eax, eax
mov dword [esp + 0x24], 7
cmp dword [esp + 0x58], 8
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
mov dword [esp + 0x84], 0xffffffff
jb 0x4ef022
push dword [esp + 0x44]
call fcn.004f9345
add esp, 4
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x7b]
call fcn.004f0430
xor ecx, ecx
mov dword [esp + 0x84], 4
push 0xffffffffffffffff
push ecx
mov word [esp + 0x34], cx
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], 0
call fcn.0044f550
mov dword [esp + 0x28], 0x408964
lea eax, [esp + 0x28]
mov byte [esp + 0x84], 5
push eax
lea eax, [esi + 0x150]
push 0x100
push eax
call fcn.005241d0
add esp, 0xc
mov dword [esp + 0x28], 0x408964
cmp dword [esp + 0x40], 8
jb 0x4ef0a3
push dword [esp + 0x2c]
call fcn.004f9345
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
cmp dword [esp + 0x70], 8
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov dword [esp + 0x84], 0xffffffff
jb 0x4ef0d8
push dword [esp + 0x5c]
call fcn.004f9345
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
push edi
mov word [esp + 0x60], ax
lea eax, [esi + 0x250]
push 0x80
push eax
mov dword [esp + 0x78], 0
call fcn.00524170
add esp, 0xc
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.004f9e32
add esp, 0x7c
ret 4
Function at 0x4ef560
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x4ef6a0
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4ef7a5
cmp esi, 0xffffffff
je 0x4ef7a5
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x4ef6d4
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4ef6c7
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x4ef6c7
movzx eax, word [edi + 0x18]
mov ecx, 0x10b
cmp cx, ax
jne 0x4ef6fe
add edi, 0x78
jmp 0x4ef712
mov ecx, 0x20b
cmp cx, ax
jne 0x4ef710
add edi, 0x88
jmp 0x4ef712
xor edi, edi
mov eax, dword [edi]
push ebx
push ebp
test eax, eax
je 0x4ef796
cmp dword [edi + 4], 0
je 0x4ef796
mov ebp, dword [eax + esi + 0x1c]
lea ebx, [eax + esi]
mov eax, dword [esp + 0x18]
add ebp, esi
mov dword [esp + 0x14], 0
test eax, 0xffff0000
jne 0x4ef745
sub ax, word [ebx + 0x10]
movzx eax, ax
jmp 0x4ef75d
lea ecx, [esp + 0x14]
push ecx
push eax
push ebx
push esi
call fcn.004ef570
add esp, 0x10
test eax, eax
je 0x4ef796
mov eax, dword [esp + 0x14]
movzx ecx, ax
cmp ecx, dword [ebx + 0x14]
jae 0x4ef796
mov ecx, dword [ebp + ecx*4]
mov edx, dword [edi]
cmp ecx, edx
jb 0x4ef78e
mov eax, dword [edi + 4]
add eax, edx
cmp ecx, eax
jae 0x4ef78e
lea eax, [ecx + esi]
push eax
push esi
call fcn.004ef390
add esp, 8
test eax, eax
je 0x4ef796
pop ebp
pop ebx
pop edi
pop esi
ret
pop ebp
pop ebx
pop edi
lea eax, [ecx + esi]
pop esi
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
Function at 0x4f1180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x58
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
mov esi, dword [esp + 0x64]
xor bl, bl
mov word [esp + 0x10], 0
xorps xmm0, xmm0
movq qword [esp + 8], xmm0
mov dword [esp + 0x18], 0
test esi, esi
jne 0x4f1216
push 6
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x767d677f
push eax
mov dword [esp + 0x28], 0x32382435
mov dword [esp + 0x2c], 0x717c0f6a
mov dword [esp + 0x30], 0x777d5260
mov dword [esp + 0x34], 0x73782d33
mov dword [esp + 0x38], 0x18044a44
call fcn.004f4f60
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004f4110
mov esi, eax
lea eax, [esp + 0x1c]
push 0x40
push 0
push eax
mov dword [esp + 0x1a], esi
call fcn.004fa8e0
add esp, 0xc
jmp 0x4f121a
mov dword [esp + 0xe], esi
test esi, esi
je 0x4f12f5
push 6
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x746b767a
push eax
mov dword [esp + 0x28], 0x624f663c
mov dword [esp + 0x2c], 0x5b6d1f23
mov dword [esp + 0x30], 0x717b6c7b
mov dword [esp + 0x34], 0x6e3d3e
mov dword [esp + 0x38], 0x18044a44
call fcn.004f4f60
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004f4110
push 0x40
mov esi, eax
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004fa8e0
add esp, 0xc
test esi, esi
je 0x4f12f5
lea eax, [esi + 6]
mov word [esp + 8], 0xe933
mov dword [esp + 0xa], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 0xa
push esi
mov dword [esp + 0x24], 0
call fcn.004f71b0
test eax, eax
je 0x4f12f5
mov ax, word [esp + 0x10]
mov word [esp + 8], 0x25ff
movq xmm0, qword [esp + 8]
movq qword [esi], xmm0
mov word [esi + 8], ax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 0xa
push esi
call fcn.004f71b0
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004f9e32
add esp, 0x58
ret 4
mov ecx, dword [esp + 0x5c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.004f9e32
add esp, 0x58
ret 4
Function at 0x4f3a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push 7
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x79784f42
push eax
xor bl, bl
mov dword [esp + 0x14], 0x6f5f2d22
mov dword [esp + 0x18], 0x4977262b
mov dword [esp + 0x1c], 0x5d7b6b61
mov dword [esp + 0x20], 0x74652d26
mov dword [esp + 0x24], 0x6b693c1b
mov dword [esp + 0x28], 0x180f6162
call fcn.004f4f60
lea eax, [esp + 8]
push eax
push 0
push 0x100000
call fcn.004f85f0
push 0x40
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004fa8e0
add esp, 0xc
test esi, esi
je 0x4f3b07
push esi
call fcn.004f4f30
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004f9e32
add esp, 0x44
ret
mov ecx, dword [esp + 0x48]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.004f9e32
add esp, 0x44
ret

Function at 0x4f3ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push 0xf
lea eax, [esp + 8]
mov dword [esp + 8], 0x6a6c6b59
push eax
mov dword [esp + 0x10], 0x66643b3f
mov dword [esp + 0x14], 0x6a6d1c30
mov dword [esp + 0x18], 0x746e7760
mov dword [esp + 0x1c], 0x553c0b00
mov dword [esp + 0x20], 0x4b762f37
mov dword [esp + 0x24], 0x71797071
mov dword [esp + 0x28], 0x61462d33
mov dword [esp + 0x2c], 0x6d572f2f
mov dword [esp + 0x30], 0x7d586766
mov dword [esp + 0x34], 0x546e3a77
mov dword [esp + 0x38], 0x764b2f2c
mov dword [esp + 0x3c], 0x76407b78
mov dword [esp + 0x40], 0x747e0535
mov dword [esp + 0x44], 0x18043221
call fcn.004f4f60
lea eax, [esp + 4]
push eax
push 0
push 0x100000
call fcn.004f85f0
push 0x40
mov esi, eax
lea eax, [esp + 8]
push 0
push eax
call fcn.004fa8e0
add esp, 0xc
test esi, esi
je 0x4f3c76
push esi
call fcn.004f4f30
mov eax, 1
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004f9e32
add esp, 0x44
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004f9e32
add esp, 0x44
ret
Function at 0x4f6480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x44], eax
cmp dword [0x55a118], 0
je 0x4f64a9
inc dword [0x551560]
mov eax, dword [0x55a118]
xor eax, 0x11223344
jne 0x4f6524
push 7
lea eax, [esp + 8]
mov dword [esp + 8], 0x746b767a
push eax
mov dword [esp + 0x10], 0x7445663c
mov dword [esp + 0x14], 0x76613a0b
mov dword [esp + 0x18], 0x7d7d6b50
mov dword [esp + 0x1c], 0x72643c33
mov dword [esp + 0x20], 0x7266053d
mov dword [esp + 0x24], 0x187b6171
call fcn.004f4f60
lea eax, [esp]
mov dword [esp], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.004f4110
mov dword [esp + 0x1c], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp], 0
movdqu xmmword [esp + 4], xmm0
test eax, eax
je 0x4f653c
cmp dword [0x55a118], 0
jne 0x4f653c
mov dword [0x55a118], eax
xor dword [0x55a118], 0x11223344
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004f9e32
add esp, 0x48
ret

Function at 0x4f8100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
mov bl, byte [esp + 0x50]
test bl, bl
jne 0x4f8161
cmp dword [0x55a188], 0
je 0x4f8127
mov eax, dword [0x55a188]
jmp 0x4f816f
mov dword [esp + 0x10], 0x6c610d6a
mov dword [esp + 0x14], 0x6c7c7b47
mov dword [esp + 0x18], 0x694d2535
mov dword [esp + 0x1c], 0x79732736
mov dword [esp + 0x20], 0x795b6766
mov dword [esp + 0x24], 0x6e2432
mov dword [esp + 0x28], 0x18044a44
jmp 0x4f81c2
cmp dword [0x55a18c], 0
je 0x4f818a
mov eax, dword [0x55a18c]
xor eax, 0x180f0214
test eax, eax
je 0x4f81d2
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004f9e32
add esp, 0x48
ret 4
mov dword [esp + 0x10], 0x6d6a0f6a
mov dword [esp + 0x14], 0x6b765179
mov dword [esp + 0x18], 0x46662d24
mov dword [esp + 0x1c], 0x6f69382d
mov dword [esp + 0x20], 0x4c6a7075
mov dword [esp + 0x24], 0x65672a31
mov dword [esp + 0x28], 0x18044a37
mov dword [esp + 0xc], 0x32382435
mov dword [esp + 8], 0x767d677f
push esi
push 9
lea eax, [esp + 0x10]
push eax
call fcn.004f4f60
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004f4110
push 0x40
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004fa8e0
add esp, 0xc
mov dword [esp + 8], 0
mov eax, esi
test esi, esi
je 0x4f8241
xor eax, 0x180f0214
test bl, bl
jne 0x4f823a
mov dword [0x55a188], eax
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004f9e32
add esp, 0x48
ret 4
mov dword [0x55a18c], eax
mov eax, esi
mov ecx, dword [esp + 0x4c]
pop esi
pop ebx
xor ecx, esp
call fcn.004f9e32
add esp, 0x48
ret 4
Function at 0x4f84c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x88
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x90]
mov dword [esp], 0
cmp eax, 1
jge 0x4f85d3
test eax, eax
jne 0x4f85d3
push 5
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x6b6e4048
push eax
mov dword [esp + 0x30], 0x6d6a0635
mov dword [esp + 0x34], 0x7a4b2e21
mov dword [esp + 0x38], 0x6c6c677e
mov dword [esp + 0x3c], 0xb4823
call fcn.004f4f60
push 0x40
lea eax, [esp + 0x48]
push 0
push eax
call fcn.004fa8e0
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004f50e0
xorps xmm0, xmm0
lea eax, [esp + 0x44]
push eax
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x38], xmm0
movq qword [esp + 8], xmm0
movdqu xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call fcn.004f5200
add eax, eax
mov dword [esp + 0xc], 0x18
mov word [esp + 4], ax
mov eax, dword [esp + 4]
add eax, 2
mov word [esp + 6], ax
lea eax, [esp + 0x44]
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
call fcn.004f6480
test eax, eax
je 0x4f85b9
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x90]
lea ecx, [esp + 8]
push ecx
call eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004f9e32
add esp, 0x88
ret 8
mov ecx, dword [esp + 0x84]
xor eax, eax
xor ecx, esp
call fcn.004f9e32
add esp, 0x88
ret 8
Function at 0x513f62
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x551e00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005009f3
mov dword [ebp - 0x14], eax
cmp dword [0x55b110], esi
jne 0x514055
push 0x800
push esi
push 0x419478
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x513fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x514135
push esi
push esi
push 0x419478
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x514135
push 0x419490
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x514135
push eax
call ebx
push 0x41949c
push edi
mov dword [0x55b110], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4194ac
push edi
mov dword [0x55b114], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4194c0
push edi
mov dword [0x55b118], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55b120], eax
test eax, eax
je 0x514052
push 0x4094e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55b11c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x51407a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x51406d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x51408f
push 4
pop eax
jmp 0x514137
cmp dword [ebp - 0x14], esi
je 0x51408f
push dword [0x55b110]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x514074
mov eax, dword [0x55b11c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5140ed
cmp dword [0x55b120], edi
je 0x5140ed
push eax
call ebx
push dword [0x55b120]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5140ed
test eax, eax
je 0x5140ed
call ecx
test eax, eax
je 0x5140e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5140e2
test byte [ebp - 8], 1
jne 0x5140ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x51411d
mov eax, dword [0x55b114]
cmp eax, edi
je 0x51411a
push eax
call ebx
test eax, eax
je 0x51411a
call eax
mov esi, eax
test esi, esi
je 0x51411a
mov eax, dword [0x55b118]
cmp eax, edi
je 0x51411a
push eax
call ebx
test eax, eax
je 0x51411a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x55b110]
call ebx
test eax, eax
je 0x514135
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x514137
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f9e32
mov esp, ebp
pop ebp
ret
Function at 0x519aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
cmp byte [ecx + 0x20], 0
lea eax, [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], ecx
jbe 0x519ace
mov edi, dword [eax]
mov dword [esp + 0xc], edi
cmp esi, edi
jb 0x519ac5
cmp esi, dword [eax + 8]
jb 0x519adc
add eax, 8
cmp byte [eax + 4], 0
ja 0x519ab6
mov eax, dword [ecx + 0x14]
pop edi
mov al, byte [esi + eax]
pop esi
add esp, 8
ret 4
movzx eax, byte [eax + 4]
sub esi, edi
push ebx
push ebp
lea ebx, [eax*4 + 0x55b124]
lea ebp, [eax - 1]
mov edi, edi
movzx eax, byte [ebx]
movzx edx, byte [ebx + 1]
add ecx, eax
movzx eax, byte [ecx]
and edx, eax
mov al, byte [ebx + 2]
test al, al
je 0x519b13
movzx ecx, byte [ecx + 1]
movzx eax, al
and ecx, eax
shl ecx, 8
or edx, ecx
mov cl, byte [ebx + 3]
shr edx, cl
test ebp, ebp
je 0x519b7b
mov edi, 1
mov ecx, ebp
shl edi, cl
test esi, edi
setne al
mov byte [esp + 0x1c], al
test dl, 1
je 0x519b3a
test al, al
sete byte [esp + 0x1c]
shr edx, 1
mov eax, edx
xor edx, edx
div ebp
mov eax, 1
mov ecx, edx
shl eax, cl
test esi, eax
je 0x519b53
or esi, edi
jmp 0x519b57
not edi
and esi, edi
cmp byte [esp + 0x1c], 0
je 0x519b6a
mov ecx, dword [esp + 0x10]
or esi, eax
dec ebp
sub ebx, 4
jmp 0x519af0
mov ecx, dword [esp + 0x10]
not eax
and esi, eax
dec ebp
sub ebx, 4
jmp 0x519af0
pop ebp
pop ebx
test dl, 1
je 0x519b85
xor esi, 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, dword [eax + 0x14]
add eax, esi
pop esi
mov al, byte [eax + ecx]
add esp, 8
ret 4
Function at 0x51c350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5345b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x551e00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0xc]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x10], xmm0
movdqu xmmword [esp + 0x20], xmm0
call fcn.0051b8a0
mov edx, dword [esi]
lea edi, [esi + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
cmp edi, eax
je 0x51c3ec
push eax
mov ecx, edi
call fcn.0051ce90
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], 2
cmp edx, 0xffffffff
je 0x51c408
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x51c41b
push dword [esp + 0x14]
call fcn.004f9345
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004f9e32
add esp, 0x30
ret 4
Function at 0x51d080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push edi
mov edi, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 4], 0x310030
mov dword [esp + 8], 0x330032
mov dword [esp + 0xc], 0x350034
mov dword [esp + 0x10], 0x370036
mov dword [esp + 0x14], 0x390038
mov dword [esp + 0x18], 0x420041
mov dword [esp + 0x1c], 0x440043
mov dword [esp + 0x20], 0x460045
test edi, edi
je 0x51d109
mov eax, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x2c]
jmp 0x51d0e0
movzx ecx, byte [edx + esi]
lea eax, [eax + 4]
shr ecx, 4
movzx ecx, word [esp + ecx*2 + 8]
mov word [eax - 4], cx
movsx ecx, byte [edx + esi]
inc edx
and ecx, 0xf
movzx ecx, word [esp + ecx*2 + 8]
mov word [eax - 2], cx
cmp edx, edi
jne 0x51d0e0
pop esi
pop edi
add esp, 0x20
ret

Function at 0x51d1c0
Capabilities:
Create directory

Disassembly:
sub esp, 0x28
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push 1
push eax
mov byte [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x51d21b
push 0
push 0
push 1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x51d21b
lea eax, [esp + 0x10]
mov dword [esp + 4], 0xc
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov byte [esp + 0x24], 0
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x28]
neg eax
pop esi
sbb eax, eax
xor ecx, esp
neg eax
call fcn.004f9e32
add esp, 0x28
ret