joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100025b0
Capabilities:
Check if file exists
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x678
mov eax, dword [0x10011050]
xor eax, esp
mov dword [esp + 0x674], eax
push esi
push str.BlackShot
push str.Gamebryo_Application
mov esi, ecx
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x100025f3
xor al, al
pop esi
mov ecx, dword [esp + 0x674]
xor ecx, esp
call fcn.10004fd7
add esp, 0x678
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x64]
push eax
call esi
push str.blackshot.exe
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100025db
push edi
push str.update.exe
push eax
call esi
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x478]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x474]
push ecx
call edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x10002684
cmp esi, 0xffffffff
je 0x10002684
push 0
lea eax, [esp + 0x20]
push eax
push 0x10c00
push 0x10011ea8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100026ac
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x674]
xor ecx, esp
call fcn.10004fd7
add esp, 0x678
ret
push 0x40
lea edx, [esp + 0x28]
push 0
push edx
call fcn.10005ba0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x104
lea eax, [esp + 0x270]
push eax
push 0
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x26c]
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1000f1f8
lea edx, [esp + 0x68]
push edx
call esi
lea eax, [esp + 0x26c]
push eax
lea ecx, [esp + 0x68]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x47c]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x84]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000276c
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10002785
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x674]
xor ecx, esp
call fcn.10004fd7
add esp, 0x678
ret
mov ecx, dword [esp + 0x67c]
xor eax, eax
cmp dword [esp + 8], 2
pop edi
sete al
pop esi
xor ecx, esp
call fcn.10004fd7
add esp, 0x678
ret

Function at 0x10004100
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push str.http:__forum.blackshotonline.com_board.asp_channel8
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
ret 4
Function at 0x10004db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10022ae0], 0
push esi
jne 0x10004d23
call fcn.10004c49
test eax, eax
je 0x10004d66
mov eax, dword [0x10022ae0]
cmp eax, 1
jne 0x10004d44
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10004d66
pop esi
ret
push eax
call dword [0x10022ae8]
test eax, eax
jne 0x10004dae
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10004d6a
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10022ae0]
call dword [0x10022ae8]
mov edi, eax
test edi, edi
je 0x10004d8f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10004dab
mov edi, esi
add esi, 0xff0
push edi
push dword [0x10022ae0]
call dword [0x10022ae4]
add edi, 0x10
cmp edi, esi
jb 0x10004d97
mov eax, edi
pop edi
pop esi
ret
jmp 0x10004d10

Function at 0x10004fd7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011050]
jne 0x10004fe1
repz ret
jmp fcn.10005fd8
Function at 0x1000b11c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10006b3f
and dword [ebp - 4], 0
cmp dword [0x10023510], 0
mov ebx, eax
jne 0x1000b1cd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000b27e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000b27e
push eax
call fcn.10006acd
mov dword [esp], 0x1000e2a8
push edi
mov dword [0x10023510], eax
call esi
push eax
call fcn.10006acd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10023514], eax
call esi
push eax
call fcn.10006acd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10023518], eax
call esi
push eax
call fcn.10006acd
pop ecx
mov dword [0x10023520], eax
test eax, eax
je 0x1000b1cd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10006acd
pop ecx
mov dword [0x1002351c], eax
mov eax, dword [0x1002351c]
cmp eax, ebx
je 0x1000b225
cmp dword [0x10023520], ebx
je 0x1000b225
push eax
call fcn.10006b48
push dword [0x10023520]
mov esi, eax
call fcn.10006b48
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000b225
test edi, edi
je 0x1000b225
call esi
test eax, eax
je 0x1000b21c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000b21c
test byte [ebp - 0xc], 1
jne 0x1000b225
or dword [ebp + 0x10], 0x200000
jmp 0x1000b25e
mov eax, dword [0x10023514]
cmp eax, ebx
je 0x1000b25e
push eax
call fcn.10006b48
pop ecx
test eax, eax
je 0x1000b25e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000b25e
mov eax, dword [0x10023518]
cmp eax, ebx
je 0x1000b25e
push eax
call fcn.10006b48
pop ecx
test eax, eax
je 0x1000b25e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10023510]
call fcn.10006b48
pop ecx
test eax, eax
je 0x1000b27e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000b280
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42aa04
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42aa0a
ret

Function at 0x437aa4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x437c55
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404af4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x437c6c
call fcn.00404750
mov eax, ebx
call fcn.00428918
mov edi, eax
dec edi
test edi, edi
jl 0x437b5c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004288ec
mov edx, dword [0x44a9f4]
call fcn.004036bc
test al, al
je 0x437b58
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004288ec
lea edx, [ebp - 0x14]
call fcn.004581bc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404af4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047c4
inc esi
dec edi
jne 0x437b0a
mov al, byte [0x437c70]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x437c7c
mov eax, dword [ebp - 0xc]
call fcn.0040eb78
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004044dc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004581bc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x437c6c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004581bc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x437c6c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x437c6c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x437c88
call fcn.0040a4a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437c5c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404468
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404468
lea eax, [ebp - 0x14]
call fcn.00404444
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404468
ret
Function at 0x50cc84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x50cc9e
add esp, 0xfffffff0
call fcn.00403894
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x50cd3b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403500
mov dword [edi + 0x20], esi
mov dl, 1
mov eax, dword [0x429dd8]
call fcn.0042b54c
mov esi, eax
mov dword [edi + 0x10], esi
mov eax, edi
call fcn.0050d0c4
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x10]
mov dword [eax + 0xc], edi
mov dword [eax + 8], 0x50cf68
mov dl, 1
mov eax, dword [0x41c740]
call fcn.00403500
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
call fcn.0041982c
lea edx, [ebp - 0x10]
lea eax, [edi + 0x30]
call fcn.004118f0
mov byte [edi + 0x28], 1
mov dl, byte [0x50cd60]
mov ax, 0x2e
call fcn.00467b7c
mov word [edi + 0x26], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cd42
lea eax, [ebp - 0x10]
call fcn.004114d8
ret
Function at 0x54ba78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov word [eax], 0
test dl, dl
je 0x54bab2
test bl, bl
je 0x54baa3
mov eax, dword [edi]
mov esi, dword [eax + 0x21c]
jmp 0x54baad
mov eax, dword [edi]
movzx esi, byte [eax + 0x405]
dec esi
xor bl, 1
jmp 0x54bac3
mov eax, dword [edi]
mov edx, dword [eax + 0x420]
mov eax, dword [edi]
call fcn.0053ceb4
mov esi, eax
mov eax, esi
test bl, bl
je 0x54bacc
inc esi
jmp 0x54bacd
dec esi
mov edx, dword [edi]
cmp esi, dword [edx + 0x21c]
jl 0x54bae2
mov edx, dword [edi]
movzx esi, byte [edx + 0x405]
jmp 0x54bb02
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
cmp esi, edx
jge 0x54bb02
mov edx, dword [edi]
mov esi, dword [edx + 0x21c]
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
sub esi, edx
cmp eax, esi
je 0x54bb46
jmp 0x54bb1e
test bl, bl
je 0x54bb0f
inc esi
jmp 0x54bb10
dec esi
test esi, esi
jl 0x54bb46
mov eax, dword [edi]
cmp esi, dword [eax + 0x21c]
jge 0x54bb46
mov eax, dword [edi]
mov edx, esi
call fcn.0053cea8
mov edx, eax
mov eax, dword [edi]
call fcn.0054aa68
test al, al
je 0x54bb08
mov eax, dword [edi]
mov edx, esi
call fcn.0053cea8
mov edx, eax
mov eax, dword [edi]
call fcn.0054ab3c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5564b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5564ca
add esp, 0xfffffff0
call fcn.00403894
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x556558
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403500
mov dword [edi + 4], esi
lea eax, [edi + 0x40]
call fcn.0052850c
mov byte [edi + 0x34], 1
mov dl, 1
mov eax, dword [0x41c740]
call fcn.00403500
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41c740]
call fcn.00403500
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x5064a0]
call fcn.00506640
mov esi, eax
mov dword [edi + 0x30], esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], 0x556e88
lea eax, [ebp - 0x10]
call fcn.0041982c
lea edx, [ebp - 0x10]
lea eax, [edi + 0x18]
call fcn.004118f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55655f
lea eax, [ebp - 0x10]
call fcn.004114d8
ret
Function at 0x567360
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x56739b
cmp dword [ebx + 0x5c], 0
je 0x56739b
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.0055f62c
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x5674e6
cmp dword [ebx + 0x7c], 0
jne 0x5673c1
mov dl, 1
mov eax, dword [0x41c198]
call fcn.00403500
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x5674bf
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x5674ec]
push eax
mov al, byte [0x5674f0]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x5ceba4]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x557950]
call fcn.005597bc
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x5674b8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0055f62c
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.0055f62c
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x55cee8]
call fcn.00405bf0
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x56748b
mov edx, dword [0x5cef6c]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x56749c
cmp eax, 0x1007
jne 0x567498
mov byte [ebx + 0x74], 0x18
jmp 0x56749c
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5674e6
mov eax, dword [ebp - 4]
call fcn.00403530
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0055f62c
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x581370
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x581378
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x58156a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x581580
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404498
lea ecx, [ebp - 0x10]
mov edx, 0x581594
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404498
lea ecx, [ebp - 0x14]
mov edx, 0x5815ac
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404498
lea ecx, [ebp - 0x18]
mov edx, 0x5815c8
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404498
lea ecx, [ebp - 0x1c]
mov edx, 0x5815e4
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404498
lea ecx, [ebp - 0x24]
mov edx, 0x5815fc
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004090f4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409798
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x581614
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x28]
call fcn.0057e108
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x581624
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x2c]
call fcn.0057e108
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x58163c
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409798
inc eax
je 0x58150d
lea ecx, [ebp - 0x34]
mov edx, 0x58163c
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x34]
call fcn.0040975c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b328
fstp qword [ebp - 0x3c]
wait
call fcn.0040b79c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x581528
lea ecx, [ebp - 0x40]
mov edx, 0x58163c
mov eax, esi
call fcn.0057eff0
mov eax, dword [ebp - 0x40]
call fcn.0057e108
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x58164c
mov eax, esi
call fcn.0057eff0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581571
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404468
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404468
ret
Function at 0x59c1ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x59c206
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.0059c210
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c20d
ret
Function at 0x10051f16
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1008b2eb
call fcn.1005e07b
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x28], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x1d]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x1d], dl
call fcn.1005c963
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.1005b7b7
push ecx
mov ecx, esp
push eax
call fcn.1004f878
call fcn.100525a7
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x24], eax
je 0x10051feb
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1004ee7c
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1004f4fd
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.1004f94a
call fcn.10051b95
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor edi, edi
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
je 0x1005201e
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + str.MUVHPMEJCLCKHEVOFUNNKPELDEVFVS]
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x1d]
push eax
call fcn.1005c963
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x10051ff5
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push eax
mov ecx, ebx
call fcn.1005c963
lea ecx, [ebp - 0x34]
call fcn.1005b5ff
lea ecx, [ebp - 0x1c]
call fcn.1005b5ff
lea ecx, [ebp + 0xc]
call fcn.1005b5ff
mov eax, ebx
call fcn.1005e025
ret
Function at 0x1005204d
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1008b341
call fcn.1005e07b
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x24], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x1d]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x1d], dl
call fcn.1005c963
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.1005b7b7
push ecx
mov ecx, esp
push eax
call fcn.1004f878
call fcn.100525a7
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x28], eax
je 0x10052122
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1004ee7c
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1004f4fd
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.1004f94a
call fcn.10051b95
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
xor edi, edi
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
je 0x1005215a
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + str.MUVHPMEJCLCKHEVOFUNNKPELDEVFVS]
cbw
movzx eax, ax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.1005ca5c
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x1005212c
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.1005ca5c
lea ecx, [ebp - 0x34]
call fcn.1005b5ff
lea ecx, [ebp - 0x1c]
call fcn.1005b5ff
lea ecx, [ebp + 0xc]
call fcn.1005b5ff
mov eax, ebx
call fcn.1005e025
ret