joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
call fcn.00404be8
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffffd8
mov esi, dword [ebp + 0xc]
add esi, 0xffffffc0
mov edi, dword [ebp + 0xc]
add edi, 0xffffffd4
xor eax, eax
push ebp
push 0x4a1988
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
add eax, 0xffffffdf
mov edx, 0x21
call fcn.004075f4
push 0
push edi
push 1
push ebx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile_1
mov eax, dword [ebp + 0xc]
inc dword [eax - 0x44]
and dword [ebx], 0xff
cmp dword [ebx], 1
jb 0x4a196a
push 0
push edi
mov eax, dword [ebx]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xffffffdf
push eax
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile_1
mov eax, dword [ebx]
mov edx, dword [ebp + 0xc]
add dword [edx - 0x44], eax
push 0
push edi
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile_1
mov eax, dword [ebp + 0xc]
add dword [eax - 0x44], 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov eax, dword [ebp + 0xc]
add eax, 0xffffffdf
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 6
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x4a19a0
call fcn.00409d28
mov eax, dword [ebp - 8]
call fcn.004093e0
test al, al
jne 0x4a191f
mov eax, dword [ebp - 8]
call fcn.00409630
push 0
push edi
push 1
push ebx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile_1
mov eax, dword [ebp + 0xc]
inc dword [eax - 0x44]
and dword [ebx], 0xff
cmp dword [ebx], 0x10
jne 0x4a194e
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004a1624
pop ecx
jmp 0x4a1961
cmp dword [ebx], 1
jne 0x4a1961
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004a1840
pop ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
ja 0x4a191f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a198f
lea eax, [ebp - 8]
call fcn.00404738
lea eax, [ebp + 8]
call fcn.00404738
ret
Function at 0x4a1bc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
call fcn.00404be8
mov eax, dword [ebp + 0xc]
call fcn.00404be8
lea esi, [ebp - 0x28]
xor eax, eax
push ebp
push 0x4a1cfa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
call fcn.004093d0
test al, al
je 0x4a1cd1
mov eax, dword [ebp + 0xc]
call fcn.004093e0
test al, al
jne 0x4a1c24
mov eax, dword [ebp + 0xc]
call fcn.00409630
test al, al
je 0x4a1cd1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
call fcn.00404bf8
push eax
call sub.KERNEL32.DLL_CreateFileA_1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x4a1cd1
push 0
push 0
push 0
mov eax, dword [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_SetFilePointer_1
xor eax, eax
mov dword [ebp - 0x44], eax
push 0
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_ReadFile_1
add dword [ebp - 0x44], 4
push 0
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
mov eax, dword [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_ReadFile_1
inc dword [ebp - 0x44]
and dword [esi], 0xff
cmp dword [esi], 1
jne 0x4a1ca8
push ebp
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a1840
pop ecx
jmp 0x4a1cb8
cmp dword [esi], 0x10
jne 0x4a1cb8
push ebp
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a1624
pop ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0
ja 0x4a1c7b
push ebp
call fcn.004a19a8
pop ecx
mov eax, dword [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1d01
lea eax, [ebp - 0x3c]
mov edx, dword [0x4a1604]
call fcn.00405aa4
lea eax, [ebp + 8]
mov edx, 2
call fcn.0040475c
ret

Function at 0x4a2438
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x4a24ff
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x5bd49c
xor ecx, ecx
mov edx, 0x400
call fcn.004031ec
mov esi, 0x5bd49c
mov al, byte [ebp + 8]
mov byte [esi + 0xa], al
mov ebx, 5
lea eax, [esi + 0xb]
mov edx, eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x240
call fcn.00402a5c
add ebx, 0x240
mov eax, ebx
and eax, 3
test eax, eax
je 0x4a2499
shr ebx, 2
inc ebx
mov eax, ebx
shl eax, 2
mov ebx, eax
add ebx, 0xa
call sub.KERNEL32.DLL_GetTickCount_1
mov edi, eax
mov word [esi], bx
mov dword [esi + 2], edi
mov edx, ebx
sub edx, 0xa
lea eax, [esi + 0xa]
call fcn.00491ed0
xor eax, 0x8088405
mov dword [esi + 6], eax
push edi
mov eax, ebx
sub eax, 0xa
push eax
lea eax, [esi + 0xa]
push eax
call fcn.00491dc8
push 0x10
push 0x5bd088
push 0
push ebx
push 0x5bd49c
mov eax, dword [0x5bd084]
push eax
call sub.WSOCK32.DLL_sendto
inc eax
jne 0x4a24f5
call sub.WSOCK32.DLL_WSAGetLastError
cmp eax, 0x3e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2509
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4a5bec
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe8
xor ebx, ebx
push esp
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x4a5c58
mov dword [esp + 8], 1
lea eax, [esp + 0xc]
push eax
push 0x4a5c60
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete bl
mov eax, dword [esp]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, ebx
add esp, 0x18
pop ebx
ret

Function at 0x4a6888
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor eax, eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4a6a53
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b88
xor eax, eax
push ebp
push 0x4a6a06
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.OLE32.DLL_OleInitialize
lea edx, [ebp - 4]
mov eax, dword [0x5bb70c]
call fcn.004929ac
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x4a6a60
call fcn.004061a0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0x4a6a70
call fcn.004061a0
mov eax, dword [ebp - 0x14]
call fcn.00404bf8
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x14]
call fcn.004094c0
mov eax, dword [ebp - 0x124]
call fcn.00404bf8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x10]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4a6a80
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
push 0
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.004049a8
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, 0x4a6a94
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0xb
lea edx, [ebp - 0x134]
xor ecx, ecx
mov eax, 0x4a6aa8
call fcn.00409d28
mov edx, dword [ebp - 0x12c]
pop eax
call fcn.00404a00
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x18]
call fcn.00404f64
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404f74
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6a0d
call sub.OLE32.DLL_OleUninitialize
ret
Function at 0x4a6ab0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0x198]
push eax
mov dl, 2
mov al, 2
call fcn.004075c0
push eax
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
jne 0x4a6b6c
push 6
push 1
push 2
call sub.WSOCK32.DLL_socket
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a6b65
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
je 0x4a6b49
mov word [ebp - 0x1a8], 2
push 0
call sub.WSOCK32.DLL_htonl
mov dword [ebp - 0x1a4], eax
push ebx
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x1a6], ax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_bind
test eax, eax
je 0x4a6b49
call sub.WSOCK32.DLL_WSAGetLastError
cmp eax, 0x2740
jne 0x4a6b49
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6b6c
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_closesocket
call sub.WSOCK32.DLL_WSACleanup
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a9874
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4a9883
or edx, 0x200
test eax, 0x20000000
je 0x4a98b7
test eax, 0x40000000
je 0x4a98a2
test eax, 0x80000000
je 0x4a989d
or edx, 0x40
jmp 0x4a98de
or edx, 0x20
jmp 0x4a98de
test eax, 0x80000000
je 0x4a98b1
or edx, 0x80
jmp 0x4a98de
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4a98cf
test eax, 0x80000000
je 0x4a98ca
or edx, 4
jmp 0x4a98de
or edx, 2
jmp 0x4a98de
test eax, 0x80000000
je 0x4a98db
or edx, 8
jmp 0x4a98de
or edx, 1
mov eax, edx
ret
Function at 0x594020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x594028
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42119e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4211b4
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00576ef0
lea ecx, [ebp - 0x10]
mov edx, 0x4211c8
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00576ef0
lea ecx, [ebp - 0x14]
mov edx, fcn.004211e0
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00576ef0
lea ecx, [ebp - 0x18]
mov edx, 0x4211fc
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00576ef0
lea ecx, [ebp - 0x1c]
mov edx, 0x421218
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00576ef0
lea ecx, [ebp - 0x24]
mov edx, 0x421230
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0057a128
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0057a508
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x421248
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x28]
call fcn.00590ec8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x421258
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x2c]
call fcn.00590ec8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x421270
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0057a508
inc eax
je 0x5941bd
lea ecx, [ebp - 0x34]
mov edx, 0x421270
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x34]
call fcn.0057a4cc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0057b850
fstp qword [ebp - 0x3c]
wait
call fcn.0057bbb4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x5941d8
lea ecx, [ebp - 0x40]
mov edx, 0x421270
mov eax, esi
call fcn.00591db0
mov eax, dword [ebp - 0x40]
call fcn.00590ec8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x421280
mov eax, esi
call fcn.00591db0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00576ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4211a5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00576ec0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00576ec0
ret
Function at 0x5a04b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x42d496
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.005a04a8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0058fb34
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0058f734
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d49d
lea eax, [ebp - 4]
call fcn.00576e9c
ret

Function at 0x5e531a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005e5399
jae 0x5e5326
xor ecx, ecx
call fcn.005e5399
jae 0x5e5350
xor eax, eax
call fcn.005e5399
jae 0x5e5361
mov al, 0x10
call fcn.005e5399
adc al, al
jae 0x5e5342
jne 0x5e538e
stosb byte es:[edi], al
jmp 0x5e5327
call fcn.005e53a5
dec ecx
loop 0x5e536d
mov eax, ebp
call fcn.005e53a3
jmp 0x5e538f
lodsb al, byte [esi]
shr eax, 1
je 0x5e53b5
adc ecx, 2
mov ebp, eax
jmp 0x5e538f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005e53a3
cmp eax, 0x7d00
jae 0x5e538d
cmp eax, 0x500
jae 0x5e538e
cmp eax, 0x7f
ja 0x5e538f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5e5327
pop ebp
ret 8
Function at 0x401170
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4011e4
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call edi
add esp, 8
test eax, eax
je 0x4011fe
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x4011c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401795
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401795
mov esp, ebp
pop ebp
ret
Function at 0x401bac
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401be1
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401bde
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x401bea
add edx, 0x28
cmp edx, esi
jne 0x401bcc
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401be7

Function at 0x40205f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40209e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40209e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40209e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40209e
cmp dword [ecx + 0x74], 0xe
jbe 0x40209e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5e2d54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e2e43
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e2e43
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e2def
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e2e43
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a6d85]
pop edi
pop ecx
test eax, eax
jne 0x5e2da8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e2df5
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e2e43
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e2e43
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e2e43
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e2e43
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e2c9d
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x59671f
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [esi*4]
xchg dword [esp], ebx
pop ebx
mov bx, word [esp]
call fcn.00596701
xor eax, 0xb04126b0
pop es
and eax, 0xb7443dad
add bh, byte [edi + ecx]
xchg esi, eax
Function at 0x5bb03c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jbe 0x586d93
ja 0x586d32
adc dword [edx + ecx*4], reloc.SHELL32.dll_ShellExecuteW
sbb al, 0xac
pop ss
adc dword [ecx], reloc.SHELL32.dll_ShellExecuteW
cmp dword [edx], 0x15
test byte [edi], dh

Function at 0x5bb842
Capabilities:
Encode data using base64

Disassembly:
call fcn.005bb904
lds edx, [eax - 0x3a]
mov eax, dword [reloc.SHELL32.dll_ShellExecuteW]
pop ebp
and al, 0xd7
adc esp, ebx
das
and dword ss:[eax - 0x73], esp
and al, 4
lea esp, [esp + 4]
cmp edi, 3
jmp 0x5bb844
jmp 0x5bb82c
jne 0x5bae3a
mov byte [ecx + 2], al
jmp 0x5bae3a

Function at 0x5bc8f6
Capabilities:
Encode data using base64

Disassembly:
cmp cl, 0x39
jmp 0x5bc934
cmp cl, 0x5a
push ebx
lea esp, [esp + 4]
jmp 0x5bc294
movzx ecx, cl
call fcn.005bc99a
mov al, 0x25
mov ch, 0xdc
das
popfd
ret 0xc456
lea esp, [esp + 4]
cmp cl, 0x2f
jmp 0x5bc903
pushal
lea esp, [esp + 0x20]
jne 0x5bc219
je 0x5bc92d
jnp 0x5bc915
xchg ebx, eax
test byte [0x5ac443b4], 0x3d
mov ah, 0x43
push 0x3f
push si
lea esp, [esp + 1]
pushfd
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x5bc96c
ja 0x5bc286
call fcn.005bc9b0
add ecx, 4
jmp fcn.005bc245

Function at 0x777aec
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 2
mov cx, 0xc081
pop dword [esp + 2]
mov word [esp + 3], ax
jmp 0x777b30
stc
add esp, 0
push word [esp + 6]
lea ebx, [ecx + esi]
xchg byte [esp], ch
not cl
jmp 0x777b5d
rdtsc
cpuid
lea edi, [ebp*4]
neg ch
pop word [esp + 6]
xchg byte [esp], cl
jmp 0x777b16
mov edx, dword [esp + 9]
dec ecx
rdtsc
inc edi
xchg byte [esp + 7], al
xchg si, dx
jmp 0x777b9b
mov bp, si
mov ax, word [esp + 8]
neg bh
pop word [esp + 5]
jmp 0x777b47
inc ebp
inc cl
neg di
pushal
bt dx, di
mov bx, bp
jmp 0x777bf7
mov dh, byte [esp + 9]
mov si, cx
bsf edx, ebx
bswap esi
push word [esp + 5]
jmp 0x777b85
cpuid
mov ah, 0x5b
lea esi, [ecx + edx]
xchg word [esp + 0x1d], cx
mov cx, word [esp + 4]
xchg al, bl
sub esp, 9
jmp 0x777bbf
rol bx, cl
pop bx
mov dword [esp + 4], edi
xchg word [esp + 0x15], bp
rol ah, cl
neg bl
jmp 0x777bd5

Function at 0x777db7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop cx
pop ax
xchg byte [esp + 0x13], bh
add esp, 0x18
jmp 0x777ed7
mov dword [esp + 0x1d], edi
mov ah, 0xb3
pop ebp
bsf bx, bp
inc cx
jmp 0x777da1
lea ecx, [ecx + ecx]
xchg ebp, eax
xchg edi, ecx
ror ax, 3
sete bl
xchg cx, ax
jmp 0x777dda
adc ebp, ebp
mov word [esp + 2], cx
rcr cl, 2
add esp, 6
mov byte [esp + 1], dl
mov si, 0x50c8
jmp 0x777df0
push word [esp + 3]
xchg bp, dx
rol edi, 0xc
std
xchg dword [esp + 1], esi
pop bp
jmp 0x777e35
lea esi, [ecx*4]
rdtsc
lea ebx, [esi + edi]
lea ecx, [edi + ebp]
rdtsc
xchg ah, dh
jmp 0x777e7e
Function at 0x777f10
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, cl
pop bx
dec bx
jmp 0x777f1c
xchg byte [esp + 0xe], dh
std
lea edx, [esi*4]
xchg word [esp + 0xe], si
mov ah, byte [esp + 0xb]
cpuid
jmp 0x777fa8
pop word [esp]
btc esi, ecx
neg cx
rdtsc
xchg byte [esp + 1], bh
neg dh
jmp 0x777f91
lea esp, [esp + 0xc]
bsr cx, di
lea ebx, [esi*4]
mov dword [esp], ebp
rdtsc
bsf dx, bp
jmp 0x777f55
lea edx, reloc.SHELL32.dll_ShellExecuteW
mov si, 0xf231
mov byte [esp + 1], cl
jmp 0x777fd7
mov byte [esp + 2], ch
mov si, sp
xchg dword [esp + 7], esi
mov word [esp + 7], ax
mov dword [esp + 2], eax
add esp, 0
jmp 0x777f77
mov byte [esp + 2], al
push dword [esp + 1]
mov eax, dword [esp + 7]
bswap edi
jmp 0x777fea
mov al, byte [esp + 2]
mov bx, sp
sub esp, 5
pop ebx
mov bh, byte [esp]
xchg bx, si
jmp 0x777fc1
add esp, 2
mov bx, word [esp + 1]
not bp
pop di
jmp 0x778052
push word [esp]
rdtsc
dec bh
lea esi, [ebx*4]
xchg word [esp + 2], ax
call fcn.00778013
bt dx, sp
push word [esp]
mov byte [esp + 6], dh
xchg dword [esp + 3], eax
jmp 0x77825d
mov bx, 0x2928
push dword [esp]
pop edi
neg ch
push dword [esp + 2]
call fcn.007780bb
push word [esp + 0x11]
bsr ax, di
stc
lea esp, [esp + 4]
bswap edi
lea ebx, [ebx*4]
jmp 0x778203
mov cl, 0x21
cld
call fcn.0077816e
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
int3
btc ecx, edi
lea ecx, [esp + 0x4b]
xchg word [esp], bx
neg al
pop si
lea edi, [ebx*4]
jmp 0x77812a
mov ebp, dword [esp + 0xb]
mov ebx, ecx
xchg dx, di
lea edx, reloc.SHELL32.dll_ShellExecuteW
cmc
mov word [esp + 0xb], si
jmp 0x778140
pop bx
mov bl, byte [esp + 4]
xchg bp, si
pop word [esp + 5]
xchg ah, dh
mov si, di
jmp 0x7780d5