joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b5788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebx, ecx
push esi
push edi
push 0
mov esi, dword [ebx + 0x40]
mov edi, dword [ebx + 0x34]
mov eax, edi
mov ebp, esi
and eax, 0xffff
and ebp, 0xffff
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x1c]
lea eax, [eax + ebp + 0x1e]
push eax
mov dword [esp + 0x1c], eax
call fcn.005366a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x612418]
push 1
mov dword [esp + 0x30], 0
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dx, word [ebx + 0xa]
mov word [eax + 4], dx
mov edx, dword [esp + 0x20]
mov cx, word [ebx + 0xc]
mov word [edx + 6], cx
mov ecx, dword [esp + 0x20]
mov ax, word [ebx + 0xe]
mov word [ecx + 8], ax
mov eax, dword [esp + 0x20]
mov dx, word [ebx + 0x10]
mov word [eax + 0xa], dx
mov edx, dword [esp + 0x20]
mov cx, word [ebx + 0x12]
mov word [edx + 0xc], cx
mov ecx, dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0xe], eax
mov eax, dword [esp + 0x20]
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x12], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [ebx + 0x1c]
mov dword [edx + 0x16], ecx
mov eax, dword [esp + 0x20]
mov word [eax + 0x1a], si
mov ecx, dword [esp + 0x20]
mov word [ecx + 0x1c], di
mov edx, dword [esp + 0x20]
mov esi, dword [ebx + 0x3c]
mov ecx, ebp
mov eax, ecx
lea edi, [edx + 0x1e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov esi, dword [ebx + 0x30]
mov eax, ecx
lea edi, [edx + ebp + 0x1e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
push edi
push ecx
mov ecx, esi
call fcn.005362a0
lea ecx, [ebx + 0x2c]
call fcn.00536750
mov ecx, esi
call fcn.00535830
mov ecx, esi
mov word [ebx + 0x20], ax
call fcn.005365b0
sub eax, edi
lea ecx, [esp + 0x18]
mov dword [ebx + 0x28], eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00536720
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x535970
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b5968
push eax
mov al, byte [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x20
test al, al
push ebx
push ebp
push esi
mov esi, ecx
jne 0x535adf
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x48]
add edx, eax
test eax, eax
mov dword [esi + 0x48], edx
je 0x5359bc
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x40]
push eax
push edx
mov ebx, dword [ecx]
call dword [ebx + 0x38]
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x24]
or ebp, 0xffffffff
cmp eax, 1
jne 0x535a45
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00533480
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.005880d5
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebp
call fcn.005880d5
test bl, bl
je 0x535a2c
xor eax, eax
jmp 0x535a42
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
imul eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x20]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x24]
mov ebx, 2
cmp eax, ebx
jne 0x535ad0
mov al, byte [esi + 0x4c]
test al, al
je 0x535ad0
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 0
lea eax, [esp + 0x40]
push 1
push eax
mov ecx, esi
mov dword [esp + 0x40], 1
call fcn.00535b20
mov ecx, dword [esi + 0x1c]
mov byte [esp + 0x34], bl
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov eax, dword [esp + 0x3c]
push eax
call fcn.00532610
add esp, 4
test eax, eax
je 0x535aa4
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00588de5
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.00588dc3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call fcn.005880d5
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], ebp
call fcn.005880d5
jmp 0x535aef
mov ecx, dword [esi + 0x1c]
cmp dword [ecx + 4], ebp
je 0x535aef
mov edx, dword [ecx]
call dword [edx + 0x4c]
jmp 0x535aef
mov ecx, dword [esi + 0x1c]
or ebp, 0xffffffff
cmp dword [ecx + 4], ebp
je 0x535aef
mov eax, dword [ecx]
call dword [eax + 0x4c]
lea ecx, [esi + 0x3c]
call fcn.00536750
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x50], ebp
mov dword [esi + 0x24], 0
mov dword [esi + 0x1c], 0
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x535b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b59de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 8], ebx
jne 0x535b66
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call fcn.00588149
test bl, 1
mov dword [esp + 0x28], 3
je 0x535b8d
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.005880d5
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00531fa0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.005320c0
add esp, 0x10
mov ecx, dword [0x603f10]
mov dword [esp + 0x38], ecx
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x535bda
push 0x61242c
lea ecx, [esp + 0x3c]
call fcn.0058826c
jmp 0x535bf0
mov edx, dword [esi + 0x50]
lea eax, [esp + 0x38]
push edx
push 0x612420
push eax
call fcn.00584d3d
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00588314
push 0x5f8704
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x34], 7
call fcn.0058837a
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x38]
push edx
push eax
push esi
mov byte [esp + 0x34], 8
call fcn.00588314
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.005880d5
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.005880d5
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.005880d5
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.005880d5
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.005880d5
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.005880d5
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x5360e0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x5b5aa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00533480
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.005880d5
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.005880d5
test bl, bl
pop ebx
je 0x536170
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x53a737
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x53a757
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044eed0
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x53a77a
test byte [esp + 8], 2
je 0x53a77a
call fcn.0044ef43
mov dword [eax], 0xd
call fcn.0044ef4c
mov dword [eax], 5
jmp 0x53a753
xor eax, eax
ret

Function at 0x53bfa0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x53bff0
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x53c1c0
push 0
push 0
call fcn.0044ed62
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x53bff0
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x53bfdf
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x53c040
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x53c054
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x53c0a1
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x53cdb2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocString
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x53ce42
cmp eax, ebx
je 0x53ce42
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x53ce4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x53cff5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x53d147
xor edx, edx
cmp eax, edx
je 0x53d147
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x53d02a
cmp eax, ecx
jb 0x53d02a
xor ecx, ecx
jmp 0x53d02f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x53d049
jg 0x53d147
cmp eax, dword [esi + 8]
ja 0x53d147
cmp ecx, edx
jne 0x53d063
cmp eax, dword [esi + 0x42c]
ja 0x53d063
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x53d0a8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x53d083
cmp edi, edx
jb 0x53d083
xor edx, edx
jmp 0x53d088
mov edx, 1
cmp ecx, ebx
ja 0x53d0a8
cmp dword [esp + 0x14], edx
jg 0x53d0a8
jl 0x53d098
cmp eax, edi
ja 0x53d0a8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.0053d160
test eax, eax
je 0x53d147
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x53d0f6
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x53d137
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x53d137
jmp 0x53d106
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x53d137
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53d137
cmp dword [edi], ebp
jne 0x53d137
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x53d590
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b5fb8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x53d5c2
call fcn.00515ed0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x53d5d3
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x53d628
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x53d60e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x53d754
cmp dword [esp + 0x18], ebx
jne 0x53d628
cmp dword [esp + 0x14], ebx
je 0x53d754
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x53d639
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.00587e42
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x53d67f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x53d67f
call fcn.004782a0
test eax, eax
je 0x53d67f
push 0x5f8484
lea ecx, [esp + 0x14]
call fcn.0058826c
push ebx
lea ecx, [esp + 0x14]
call fcn.00588502
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x53d72e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x53d6bb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x53d72e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x53d709
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x53d70c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x53d704
mov dword [esi + 0x10], ebx
jmp 0x53d70c
mov dword [esi + 0x10], ecx
jmp 0x53d70c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.005880d5
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005880d5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x53d5aa
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b5fb8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x53d5c2
call fcn.00515ed0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x53d5d3
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x53d628
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x53d60e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x53d754
cmp dword [esp + 0x18], ebx
jne 0x53d628
cmp dword [esp + 0x14], ebx
je 0x53d754
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x53d639
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.00587e42
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x53d67f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x53d67f
call fcn.004782a0
test eax, eax
je 0x53d67f
push 0x5f8484
lea ecx, [esp + 0x14]
call fcn.0058826c
push ebx
lea ecx, [esp + 0x14]
call fcn.00588502
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x53d72e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x53d6bb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x53d72e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x53d709
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x53d70c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x53d704
mov dword [esi + 0x10], ebx
jmp 0x53d70c
mov dword [esi + 0x10], ecx
jmp 0x53d70c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.005880d5
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005880d5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5405f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.0044d280
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x54061b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x54062d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x540799
push esi
call fcn.00548200
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x540663
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.005411b0
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x5406a2
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.0053f670
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.0053f7e0
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.0053f8e0
add esp, 0x24
jmp 0x5406e1
test ebp, ebp
jl 0x5406ae
cmp ebp, 0x80
jle 0x5406c2
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.005411b0
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x540706
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x54070f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.0053f670
push esi
call fcn.00548200
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.0053f7e0
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x54074b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.0053f670
push esi
call fcn.00548200
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.0053f7e0
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.0053f990
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x54077e
jmp 0x54070d
Function at 0x541030
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.0044d280
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x541079
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x541079
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x608298
call fcn.00583390
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0053a3cf
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x54118b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x54118b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x54118b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x54118b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x54118b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.0044d280
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x54118b
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.0044c903
add esp, 8
test eax, eax
je 0x54118b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret