joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412699
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edi, dword [esp + 0x11c]
push 1
push 0x1b6
push 0x20
push edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x124], ebx
call fcn.004834d0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
test byte [esp + eax + 0x38], 6
mov byte [esp + 0x114], 1
je 0x483cbb
push 0x11
push 0x414014
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0047e680
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xf8]
push edx
mov byte [esp + 0x120], 2
call fcn.00483370
add esp, 0xc
push eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0x118], 3
call fcn.00482fd0
push 0x416bbc
lea eax, [esp + 0xcc]
push eax
call fcn.004858ad
mov ecx, dword [esp + eax + 0x40]
lea eax, [esp + eax + 0x30]
and ecx, 0xfffffffe
push 2
mov dword [eax + 0x10], ecx
push ebx
lea ecx, [esp + 0x38]
call fcn.00480460
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call fcn.004804d0
mov ecx, dword [eax]
mov edi, dword [eax + 8]
sub esp, 0x18
mov eax, esp
mov dword [eax], ebx
mov edx, dword [0x418e68]
add edi, ecx
mov dword [eax + 8], edx
mov ecx, dword [0x418e6c]
mov dword [eax + 0xc], ecx
mov edx, dword [0x418e24]
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], esp
mov dword [eax + 0x10], edx
call fcn.004803d0
push ebx
lea eax, [edi + 1]
push eax
mov ecx, esi
call fcn.00483b80
mov eax, dword [esi + 4]
push edi
push eax
lea ecx, [esp + 0x38]
call fcn.004816a0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x94]
mov byte [eax + edi], bl
mov byte [esp + 0x114], bl
call fcn.00483630
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], 0x413374
call fcn.00484a0f
mov ecx, dword [esp + 0x10c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10c
ret 4
Function at 0x483c0c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412699
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edi, dword [esp + 0x11c]
push 1
push 0x1b6
push 0x20
push edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x124], ebx
call fcn.004834d0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
test byte [esp + eax + 0x38], 6
mov byte [esp + 0x114], 1
je 0x483cbb
push 0x11
push 0x414014
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0047e680
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xf8]
push edx
mov byte [esp + 0x120], 2
call fcn.00483370
add esp, 0xc
push eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0x118], 3
call fcn.00482fd0
push 0x416bbc
lea eax, [esp + 0xcc]
push eax
call fcn.004858ad
mov ecx, dword [esp + eax + 0x40]
lea eax, [esp + eax + 0x30]
and ecx, 0xfffffffe
push 2
mov dword [eax + 0x10], ecx
push ebx
lea ecx, [esp + 0x38]
call fcn.00480460
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call fcn.004804d0
mov ecx, dword [eax]
mov edi, dword [eax + 8]
sub esp, 0x18
mov eax, esp
mov dword [eax], ebx
mov edx, dword [0x418e68]
add edi, ecx
mov dword [eax + 8], edx
mov ecx, dword [0x418e6c]
mov dword [eax + 0xc], ecx
mov edx, dword [0x418e24]
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], esp
mov dword [eax + 0x10], edx
call fcn.004803d0
push ebx
lea eax, [edi + 1]
push eax
mov ecx, esi
call fcn.00483b80
mov eax, dword [esi + 4]
push edi
push eax
lea ecx, [esp + 0x38]
call fcn.004816a0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x94]
mov byte [eax + edi], bl
mov byte [esp + 0x114], bl
call fcn.00483630
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], 0x413374
call fcn.00484a0f
mov ecx, dword [esp + 0x10c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10c
ret 4
Function at 0x488977
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4889a5
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4889ac
cmp ebx, dword [eax + 4]
jae 0x4889ac
xor eax, eax
jmp 0x488b9c
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4889bd
xor eax, eax
inc eax
jmp 0x488b9b
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4889d3
cmp ecx, edx
jae 0x488b18
cmp dword [eax + 4], 0
je 0x4889dc
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4889c4
cmp dword [ebp + 8], 0
je 0x4889fe
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x488b18
cmp eax, esi
jae 0x488b18
mov eax, dword [0x418fe0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x488a23
cmp dword [esi*4 + 0x418fe8], edi
je 0x488b1c
inc esi
cmp esi, eax
jl 0x488a11
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4130ec]
test eax, eax
je 0x488b98
cmp dword [ebp - 8], 0x1000000
jne 0x488b98
test byte [ebp - 0xc], 0xcc
je 0x488aa1
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x488b98
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x488b98
cmp word [eax + 0x18], 0x10b
jne 0x488b98
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x488b98
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x488aa1
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x488aa1
test byte [ecx + 0x27], 0x80
jne 0x488b18
push 1
push 0x419028
call dword [0x413000]
test eax, eax
jne 0x4889b5
mov ecx, dword [0x418fe0]
test ecx, ecx
mov edx, ecx
jle 0x488ad5
lea eax, [ecx*4 + 0x418fe4]
cmp dword [eax], edi
je 0x488ad5
dec edx
sub eax, 4
test edx, edx
jg 0x488ac9
test edx, edx
jne 0x488b06
push 0xf
pop ebx
cmp ecx, ebx
jg 0x488ae2
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x488afa
lea eax, [edx*4 + 0x418fe8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x488ae8
cmp ecx, 0x10
jge 0x488b06
inc ecx
mov dword [0x418fe0], ecx
push 0
push 0x419028
call dword [0x413000]
jmp 0x4889b5
xor eax, eax
jmp 0x488b9b
test esi, esi
jle 0x4889b5
mov ebx, dword [0x413000]
push 1
push 0x419028
call ebx
test eax, eax
jne 0x4889b5
cmp dword [esi*4 + 0x418fe8], edi
je 0x488b72
mov eax, dword [0x418fe0]
lea esi, [eax - 1]
test esi, esi
jl 0x488b60
cmp dword [esi*4 + 0x418fe8], edi
je 0x488b5c
dec esi
jns 0x488b50
test esi, esi
jge 0x488b70
cmp eax, 0x10
jge 0x488b6b
inc eax
mov dword [0x418fe0], eax
lea esi, [eax - 1]
jmp 0x488b72
je 0x488b8a
xor ecx, ecx
test esi, esi
jl 0x488b8a
lea eax, [ecx*4 + 0x418fe8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x488b78
push 0
push 0x419028
call ebx
jmp 0x4889b5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a9ae8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x429cf1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [edi + 0x4c]
mov ecx, dword [eax]
lea esi, [edi + 0x48]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x28], 2
call fcn.004a54d8
mov eax, dword [esi + 4]
push eax
call fcn.004bea0e
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x40]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x3c]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.004a54d8
mov edx, dword [esi + 4]
push edx
call fcn.004bea0e
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x30]
add esp, 4
cmp eax, ebx
je 0x4a9b78
push eax
call fcn.004bea0e
add esp, 4
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
cmp dword [edi + 0x28], 8
jb 0x4a9b93
mov eax, dword [edi + 0x14]
push eax
call fcn.004bea0e
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], 7
mov word [edi + 0x14], bx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4a9c88
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x429d21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esi + 0x28], 7
mov dword [esi + 0x24], ebp
push edi
mov dword [esp + 0xc], esi
mov word [esi + 0x14], bp
mov dword [esp + 0x18], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.004a3278
mov dword [edi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x48]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.004a3278
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
pop edi
mov dword [esi], 0xffffffff
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a9c9f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x429d21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esi + 0x28], 7
mov dword [esi + 0x24], ebp
push edi
mov dword [esp + 0xc], esi
mov word [esi + 0x14], bp
mov dword [esp + 0x18], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.004a3278
mov dword [edi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x48]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.004a3278
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
pop edi
mov dword [esi], 0xffffffff
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ac6e8
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x433970]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
push eax
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004ac568
mov ecx, dword [esp + 0x68]
lea eax, [esp]
push eax
push ecx
call fcn.004ac628
mov ecx, dword [esp + 0x58]
call fcn.004be2c1
add esp, 0x5c
ret 0xc

Function at 0x4ad3a8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x429ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004a3488
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004a2d88
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4ad43a
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b4c48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42a570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x433970]
push 0x42c734
mov dword [esp + 0x5c], eax
call dword [fcn.0042b07c]
test eax, eax
je 0x4b4e5b
push edi
push 0x42c718
push eax
call dword [fcn.0042b1f4]
mov edi, eax
test edi, edi
je 0x4b4e5a
push ebx
push ebp
push esi
mov esi, 0x19000
push esi
push 8
call dword [fcn.0042b0ec]
mov ebx, dword [fcn.0042b0e8]
push eax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4b4cba
xor eax, eax
jmp 0x4b4e57
push 0
push 0x19000
push ebp
push 5
call edi
cmp eax, 0xc0000004
jne 0x4b4cfe
push ebp
mov ebp, dword [fcn.0042b0ec]
push 0
call ebp
push eax
call dword [fcn.0042b0e4]
add esi, esi
push esi
push 8
call ebp
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x4b4cb3
push 0
push esi
push ebp
push 5
call edi
cmp eax, 0xc0000004
je 0x4b4ccd
mov ebx, dword [esp + 0x7c]
mov edi, ebp
lea esp, [esp]
cmp word [edi + 0x38], 0
je 0x4b4e2b
mov eax, dword [0x43597c]
mov ecx, 0x43597c
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x7c], esi
movzx ecx, word [edi + 0x38]
mov eax, dword [esi - 4]
shr ecx, 1
mov edx, 1
sub edx, eax
mov eax, dword [esi - 8]
inc ecx
sub eax, ecx
or eax, edx
mov dword [esp + 0x74], 0
jge 0x4b4d5a
push ecx
lea ecx, [esp + 0x80]
call fcn.004a2d38
mov esi, dword [esp + 0x7c]
movzx eax, word [edi + 0x38]
mov ecx, dword [edi + 0x3c]
shr eax, 1
inc eax
push eax
push ecx
push esi
call fcn.004be615
add esp, 0xc
test esi, esi
jne 0x4b4d77
xor eax, eax
jmp 0x4b4d88
push esi
call fcn.004be987
add esp, 4
test eax, eax
jl 0x4b4e38
cmp eax, dword [esi - 8]
jg 0x4b4e38
mov dword [esi - 0xc], eax
lea ecx, [esp + 0x7c]
mov word [esi + eax*2], 0
call fcn.004b01b8
lea ecx, [esp + 0x10]
call fcn.004a9c88
mov ecx, dword [edi + 0x44]
mov edx, dword [edi + 0x48]
mov esi, dword [esp + 0x7c]
push esi
mov byte [esp + 0x78], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.004be987
add esp, 4
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.004a3e68
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, edx
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
call fcn.004aa4c8
mov ecx, eax
call fcn.004b4238
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], 0
call fcn.004a9ae8
lea eax, [esi - 0x10]
mov dword [esp + 0x74], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4e2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi]
test eax, eax
je 0x4b4e42
add edi, eax
jmp 0x4b4d08
push 0x80070057
call fcn.004a2668
push ebp
push 0
call dword [fcn.0042b0ec]
push eax
call dword [fcn.0042b0e4]
mov eax, 1
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x58]
call fcn.004be2c1
add esp, 0x68
ret 4
Function at 0x4baf88
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42a968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004babb8
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004ba878
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4bb01a
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4bd088
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d100
push 0x41d380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [fcn.0042b118]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4bd11f
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x4bd11f
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x4bd11f
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x4bd11f
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd4b8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d110
push 0x41d380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [fcn.0042b118]
test eax, eax
je 0x4bd53f
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x4bd538
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ecx], 0x4550
jne 0x4bd538
cmp word [ecx + 0x14], 0
je 0x4bd538
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c015e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4c018c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4c0193
cmp ebx, dword [eax + 4]
jae 0x4c0193
xor eax, eax
jmp 0x4c0383
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4c01a4
xor eax, eax
inc eax
jmp 0x4c0382
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4c01ba
cmp ecx, edx
jae 0x4c02ff
cmp dword [eax + 4], 0
je 0x4c01c3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4c01ab
cmp dword [ebp + 8], 0
je 0x4c01e5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4c02ff
cmp eax, esi
jae 0x4c02ff
mov eax, dword [0x4354d8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4c020a
cmp dword [esi*4 + 0x4354e0], edi
je 0x4c0303
inc esi
cmp esi, eax
jl 0x4c01f8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [fcn.0042b118]
test eax, eax
je 0x4c037f
cmp dword [ebp - 8], 0x1000000
jne 0x4c037f
test byte [ebp - 0xc], 0xcc
je 0x4c0288
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4c037f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4c037f
cmp word [eax + 0x18], 0x10b
jne 0x4c037f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4c037f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4c0288
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4c0288
test byte [ecx + 0x27], 0x80
jne 0x4c02ff
push 1
push 0x435520
call dword [0x42b1ec]
test eax, eax
jne 0x4c019c
mov ecx, dword [0x4354d8]
test ecx, ecx
mov edx, ecx
jle 0x4c02bc
lea eax, [ecx*4 + 0x4354dc]
cmp dword [eax], edi
je 0x4c02bc
dec edx
sub eax, 4
test edx, edx
jg 0x4c02b0
test edx, edx
jne 0x4c02ed
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4c02c9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4c02e1
lea eax, [edx*4 + 0x4354e0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4c02cf
cmp ecx, 0x10
jge 0x4c02ed
inc ecx
mov dword [0x4354d8], ecx
push 0
push 0x435520
call dword [0x42b1ec]
jmp 0x4c019c
xor eax, eax
jmp 0x4c0382
test esi, esi
jle 0x4c019c
mov ebx, dword [0x42b1ec]
push 1
push 0x435520
call ebx
test eax, eax
jne 0x4c019c
cmp dword [esi*4 + 0x4354e0], edi
je 0x4c0359
mov eax, dword [0x4354d8]
lea esi, [eax - 1]
test esi, esi
jl 0x4c0347
cmp dword [esi*4 + 0x4354e0], edi
je 0x4c0343
dec esi
jns 0x4c0337
test esi, esi
jge 0x4c0357
cmp eax, 0x10
jge 0x4c0352
inc eax
mov dword [0x4354d8], eax
lea esi, [eax - 1]
jmp 0x4c0359
je 0x4c0371
xor ecx, ecx
test esi, esi
jl 0x4c0371
lea eax, [ecx*4 + 0x4354e0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4c035f
push 0
push 0x435520
call ebx
jmp 0x4c019c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5acc3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
inc dl
not bh
btr eax, ebx
jle 0x5acc06
mov eax, edx
mov bx, si
jmp 0x5acc08
mov dword [esp + 7], ebp
setl al
lea esp, [esp + 2]
jmp 0x5acbc3
mov eax, edx
mov bx, si
jmp 0x5acc08
jmp 0x5acbec
and edx, 0x3c
mov bx, 0x1483
rcl ebx, 0x1d
jne 0x5acc43
je 0x5acca6
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
mov dword [esp + 7], ebp
setl al
lea esp, [esp + 2]
jmp 0x5acbc3
xchg ebx, eax
sub esp, 0x12
js 0x5acc1e
jns 0x5acbdf
bsr bx, bp
mov ax, bx
jmp 0x5acc88
sub esi, 4
mov eax, ecx
seto al
mov ax, sp
mov al, byte [esp]
jmp 0x5acde2
bsr bx, bp
mov ax, bx
jmp 0x5acc88
lea edx, [ecx + 0xb3]
mov eax, dword [edx + ebp]
inc dh
jg 0x5acd7f
lea edx, [ecx + 0xb3]
lea ebx, [edi*4]
adc bx, 0xc74c
jmp 0x5acd48

Function at 0x5b5a63
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, bl
not bx
clc
shl bl, 1
lea ebx, [esi*4]
jmp 0x5b5b3a
xchg dword [esp], ebx

Function at 0x5b5e14
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ebx + edi]
sub edx, esi
mov ebx, 0xbf982c9c
and dh, bh
call fcn.005b5e9d
mov byte [edi], dl
xchg edx, esp
adc ebx, ebx
push ss
mov byte [esi], bl
jns 0x5b5db8
mov eax, 0x2fdcb525
in al, dx
aam 0x8d
sbb al, 0x19

Function at 0x5b6956
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5a099a
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x5a09b6
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5a09a2
jmp 0x5a09c1
ret
jmp 0x5b69c5
jmp 0x5a098f

Function at 0x5cba0f
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], eax
sub esp, 2
lea esp, [esp + 2]
jmp 0x5cba56
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 5]
sub esp, 0x1c
pop dword [esp + 6]
push esp
jmp 0x5cba35
and edx, ecx
call 0x5cba3d
mov bl, 0x66
pop dword [esp]
add esp, 1
sub esp, 2
lea esp, [esp + 3]
jmp 0x5cba69
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GlobalAlloc]
pushal
mov ebx, 0xca8059bc
jmp 0x5cba1b
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GlobalAlloc]
sub esp, 0xc
mov word [esp + 8], dx
and edx, ecx
jmp 0x5cbace
sub esp, 0x12
mov byte [esp + 2], bh
lea esp, [esp + 2]
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GlobalAlloc]
jmp 0x5cbaa3

Function at 0x5cba3d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], eax
sub esp, 2
lea esp, [esp + 2]
jmp 0x5cba56
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 5]
sub esp, 0x1c
pop dword [esp + 6]
push esp
jmp 0x5cba35
and edx, ecx
call 0x5cba3d
mov bl, 0x66
pop dword [esp]
add esp, 1
sub esp, 2
lea esp, [esp + 3]
jmp 0x5cba69
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GlobalAlloc]
pushal
mov ebx, 0xca8059bc
jmp 0x5cba1b
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GlobalAlloc]
sub esp, 0xc
mov word [esp + 8], dx
and edx, ecx
jmp 0x5cbace
sub esp, 0x12
mov byte [esp + 2], bh
lea esp, [esp + 2]
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GlobalAlloc]
jmp 0x5cbaa3