joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a26d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x90
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x94
call fcn.005f7e70
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5a2742
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x5a271c
cmp dword [esp + 4], 5
jb 0x5a2742
mov eax, 0x40cc0020
add esp, 0x94
ret
cmp eax, 1
jne 0x5a2742
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x5a2736
cmp eax, 4
jne 0x5a2742
cmp dword [esp + 8], 0xa
jb 0x5a2742
mov eax, 0x40cc0020
add esp, 0x94
ret
mov eax, 0xcc0020
add esp, 0x94
ret

Function at 0x5a3980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
push 0x62d888
call edx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x5a3b0e
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
jmp 0x5a39b4
mov eax, dword [esp + 0x44]
xor edi, edi
test eax, eax
jbe 0x5a39de
lea ebx, [ebx]
movzx esi, word [ebp + edi*2]
cmp si, 0x20
jb 0x5a39de
cmp si, 0x22
je 0x5a39de
cmp si, 0x5c
je 0x5a39de
add edi, 1
cmp edi, eax
jb 0x5a39c0
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push edi
push ebp
call edx
sub dword [esp + 0x44], edi
lea ebp, [ebp + edi*2]
je 0x5a3b0b
cmp si, 0x22
jne 0x5a3a10
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push 2
push 0x67cd7c
jmp 0x5a3afb
cmp si, 0x5c
jne 0x5a3a29
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push 2
push 0x67cd74
jmp 0x5a3afb
movzx eax, si
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov word [esp + 0x1c], 0x30
mov word [esp + 0x1e], 0x31
mov word [esp + 0x20], 0x32
mov word [esp + 0x22], 0x33
mov word [esp + 0x24], 0x34
mov word [esp + 0x26], 0x35
mov word [esp + 0x28], 0x36
mov word [esp + 0x2a], 0x37
mov word [esp + 0x2c], 0x38
mov word [esp + 0x2e], 0x39
mov word [esp + 0x30], 0x41
mov word [esp + 0x32], 0x42
mov word [esp + 0x34], 0x43
mov word [esp + 0x36], 0x44
mov word [esp + 0x38], 0x45
mov word [esp + 0x3a], 0x46
movzx edx, word [esp + ecx*2 + 0x1c]
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov word [esp + 0x14], dx
movzx edx, word [esp + ecx*2 + 0x1c]
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov word [esp + 0x16], dx
movzx edx, word [esp + ecx*2 + 0x1c]
mov ecx, dword [ebx + 4]
and eax, 0xf
mov ax, word [esp + eax*2 + 0x1c]
mov word [esp + 0x18], dx
mov word [esp + 0x1a], ax
mov word [esp + 0x10], 0x5c
mov word [esp + 0x12], 0x75
mov edx, dword [ecx]
mov edx, dword [edx]
push 6
lea eax, [esp + 0x14]
push eax
call edx
add ebp, 2
sub dword [esp + 0x44], 1
jne 0x5a39b0
pop edi
pop esi
pop ebp
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
pop ebx
add esp, 0x2c
mov dword [esp + 8], 1
mov dword [esp + 4], 0x62d888
mov edx, dword [eax]
jmp edx
Function at 0x5ba950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x60
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov eax, 0xffffff80
movd xmm1, eax
mov eax, dword [ebp + 0xc]
punpcklbw xmm1, xmm1
pxor xmm0, xmm0
movdqa xmm2, xmm1
punpcklbw xmm2, xmm1
pcmpeqb xmm0, xmm0
pshufd xmm6, xmm2, 0
movdqa xmmword [esp + 0x40], xmm0
lea ebx, [ebx]
movdqa xmm0, xmmword [eax]
movdqa xmm2, xmmword [eax + 0xa0]
movdqa xmm3, xmm0
movdqa xmm1, xmm0
psrldq xmm0, 1
movdqa xmm4, xmm2
pslldq xmm4, 0xe
psrldq xmm3, 2
por xmm3, xmm4
pavgb xmm1, xmm3
movdqa xmm3, xmmword [eax + 0xb0]
pslldq xmm2, 0xf
por xmm0, xmm2
pavgb xmm1, xmm0
movdqa xmm0, xmmword [eax + 0x10]
movdqa xmm4, xmm0
movdqa xmm2, xmm0
psrldq xmm0, 1
movdqa xmm5, xmm3
pslldq xmm5, 0xe
psrldq xmm4, 2
por xmm4, xmm5
pavgb xmm2, xmm4
movdqa xmm4, xmmword [eax + 0xc0]
pslldq xmm3, 0xf
por xmm0, xmm3
pavgb xmm2, xmm0
movdqa xmm0, xmmword [eax + 0x20]
movdqa xmm5, xmm0
movdqa xmm3, xmm0
movdqa xmm7, xmm4
pslldq xmm7, 0xe
psrldq xmm5, 2
por xmm5, xmm7
pavgb xmm3, xmm5
movdqa xmm5, xmmword [eax + 0xd0]
psrldq xmm0, 1
pslldq xmm4, 0xf
por xmm0, xmm4
pavgb xmm3, xmm0
movdqa xmm0, xmmword [eax + 0x30]
movdqa xmm7, xmm0
movdqa xmmword [esp], xmm5
psrldq xmm7, 2
movdqa xmm4, xmm0
pslldq xmm5, 0xe
por xmm7, xmm5
movdqa xmm5, xmmword [esp]
pavgb xmm4, xmm7
psrldq xmm0, 1
pxor xmm1, xmm6
pslldq xmm5, 0xf
por xmm0, xmm5
movdqa xmm5, xmmword [eax + 0x40]
pavgb xmm4, xmm0
movdqa xmm0, xmmword [eax + 0xe0]
movdqa xmmword [esp], xmm0
movdqa xmm0, xmm1
pxor xmm2, xmm6
pxor xmm4, xmm6
pcmpgtb xmm1, xmm4
movdqa xmmword [esp + 0x10], xmm1
pcmpgtb xmm0, xmm2
movdqa xmm1, xmm4
pcmpgtb xmm1, xmm2
movdqa xmm7, xmm1
pandn xmm1, xmmword [esp + 0x10]
pand xmm7, xmm0
movdqa xmmword [esp + 0x20], xmm7
movdqa xmm7, xmm1
movdqa xmm1, xmmword [esp + 0x20]
pxor xmm3, xmm6
pcmpgtb xmm2, xmm3
movdqa xmmword [esp + 0x50], xmm7
pand xmm1, xmm2
movdqa xmmword [esp + 0x30], xmm7
movdqa xmm7, xmmword [esp]
movdqa xmm2, xmm5
movdqa xmm3, xmm5
psrldq xmm2, 2
pslldq xmm7, 0xe
por xmm0, xmmword [esp + 0x10]
pandn xmm0, xmmword [esp + 0x40]
por xmm2, xmm7
pavgb xmm3, xmm2
movdqa xmm2, xmmword [esp]
pslldq xmm2, 0xf
psrldq xmm5, 1
por xmm5, xmm2
pavgb xmm3, xmm5
movdqa xmm5, xmmword [eax + 0x70]
pxor xmm3, xmm6
pcmpgtb xmm4, xmm3
movdqa xmm3, xmmword [esp + 0x30]
pand xmm3, xmm4
movdqa xmm4, xmmword [eax + 0x50]
pand xmm4, xmm0
movdqa xmm0, xmmword [eax + 0x60]
movdqa xmm2, xmm1
pandn xmm2, xmmword [esp + 0x20]
pand xmm0, xmm2
movdqa xmm2, xmmword [eax + 0x80]
pand xmm5, xmm1
movdqa xmm1, xmm3
pandn xmm1, xmmword [esp + 0x50]
pand xmm2, xmm1
movdqa xmm1, xmmword [eax + 0x90]
pand xmm1, xmm3
por xmm0, xmm5
por xmm2, xmm1
por xmm0, xmm2
por xmm0, xmm4
movdqa xmmword [ecx], xmm0
add eax, 0xa0
add ecx, 0x10
sub edx, 1
jne 0x5ba990
mov esp, ebp
pop ebp
ret
Function at 0x5bf1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x621b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005d1400
push 0x4d9ca0
push fcn.004375a0
push 0x18
xor ebx, ebx
mov dword [esi], 0x680440
push 0x20
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x28], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], 1
mov byte [esi + 0x29], bl
call fcn.005faae2
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x330], ebx
mov dword [esi + 0x334], ebx
mov dword [esi + 0x338], ebx
mov dword [esi + 0x33c], ebx
mov dword [esi + 0x340], ebx
mov dword [esi + 0x344], ebx
mov dword [esi + 0x348], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5bf1f7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x621b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005d1400
push 0x4d9ca0
push fcn.004375a0
push 0x18
xor ebx, ebx
mov dword [esi], 0x680440
push 0x20
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x28], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], 1
mov byte [esi + 0x29], bl
call fcn.005faae2
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x330], ebx
mov dword [esi + 0x334], ebx
mov dword [esi + 0x338], ebx
mov dword [esi + 0x33c], ebx
mov dword [esi + 0x340], ebx
mov dword [esi + 0x344], ebx
mov dword [esi + 0x348], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5c06d6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x621b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
mov dword [esi], 0x64b428
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esp + 8], esi
mov dword [esi + 8], ecx
lea edx, [edi + 0xc]
push edx
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], 0
mov dword [esi], 0x680950
call fcn.004e7e60
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x5c1cc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [eax + eax + 1]
mov eax, 0xffff
cdq
idiv esi
mov ecx, dword [ebp + 0xc]
push edi
add eax, 1
cmp byte [0x6b7ef3], 0
mov dword [ebp - 4], eax
je 0x5c1d40
mov eax, dword [ebp + 0x10]
movd mm6, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
punpcklwd mm6, mm6
mov ecx, dword [ebp + 0x18]
punpckldq mm6, mm6
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
movq mm2, qword [edx + ecx*8 - 8]
pxor mm7, mm7
movd mm0, dword [eax + ecx*4 - 4]
movq mm3, mm2
movd mm1, dword [ebx + ecx*4 - 4]
pmulhw mm2, mm6
punpcklbw mm0, mm7
punpcklbw mm1, mm7
paddw mm0, mm3
psubw mm0, mm1
packuswb mm2, mm2
movq qword [edx + ecx*8 - 8], mm0
movd dword [edi + ecx*4 - 4], mm2
dec ecx
jne 0x5c1d00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
movzx edi, word [ecx + 4]
add esi, 4
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [esi]
add esi, 4
mov dword [ebp + 0x14], esi
movzx esi, word [ecx]
mov dword [ebp - 4], esi
movzx esi, word [ecx + 2]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
movzx esi, si
movzx edi, di
imul esi, eax
imul edi, eax
sar edi, 0x10
sar esi, 8
and esi, 0xff00
add esi, edi
movzx edi, word [ebp - 4]
imul edi, eax
and edi, 0xff0000
add esi, edi
mov edi, esi
mov esi, dword [ebp + 8]
mov dword [esi], edi
add esi, 4
mov dword [ebp + 8], esi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov esi, ebx
shr esi, 0x10
and esi, 0xff
sub edi, esi
add edi, dword [ebp - 4]
movzx si, bh
mov word [ecx], di
movzx di, dh
sub di, si
add di, word [ebp - 0xc]
movzx edx, dl
movzx esi, bl
sub edx, esi
add edx, dword [ebp - 0x10]
mov word [ecx + 2], di
mov word [ecx + 4], dx
add ecx, 6
sub dword [ebp + 0x18], 1
jne 0x5c1d40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d3fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x62261b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x18]
mov dword [esp + 4], esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi], fcn.005d3240
call fcn.0051e425
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 0
call fcn.0051e425
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5d6d50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 8
mov cl, byte [esp + 8]
shl eax, cl
mov ecx, dword [esp + 4]
movaps xmm7, xmmword [0x683080]
movaps xmm6, xmmword [0x683070]
movaps xmm1, xmmword [ecx + 0x10]
movaps xmm0, xmmword [ecx]
movaps xmm3, xmm1
movaps xmm2, xmm0
shufps xmm1, xmm1, 0x4e
xorps xmm3, xmmword [0x683080]
shufps xmm0, xmm0, 0x4e
xorps xmm2, xmmword [0x683080]
addps xmm1, xmm3
addps xmm0, xmm2
shufps xmm1, xmm1, 0xb4
movaps xmm2, xmm0
xorps xmm1, xmmword [0x683070]
addps xmm0, xmm1
movaps xmmword [ecx], xmm0
subps xmm2, xmm1
movaps xmmword [ecx + 0x10], xmm2
add ecx, 0x20
sub eax, 0x20
jne 0x5d6d6d
ret

Function at 0x5d6dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
and esp, 0xfffffff0
mov dword [esp + 0x54], ebp
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
shl eax, 2
mov dword [esp + 0x50], eax
mov cl, byte [ebp + 0xc]
mov eax, 8
shl eax, cl
mov dword [esp + 0x44], eax
mov cl, byte [ebp + 0x10]
mov eax, 4
shl eax, cl
mov dword [esp + 0x40], eax
mov ebx, dword [ebp + 8]
add eax, ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
movaps xmm7, xmmword [0x683070]
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x40]
lea ebx, [eax + ebp]
lea ecx, [ebx + ebp]
lea edx, [ecx + ebp]
jmp 0x5d6e20
movaps xmm4, xmmword [0x6830a0]
movhps xmm4, qword [edi]
movlps xmm5, qword [edi + 8]
movaps xmm6, xmmword [0x683090]
movhps xmm5, qword [edi + 0x10]
movaps xmm2, xmm4
shufps xmm4, xmm4, 0xf5
movlps xmm0, qword [eax]
add edi, dword [esp + 0x50]
shufps xmm2, xmm2, 0xa0
movhps xmm0, qword [ecx]
movlps xmm1, qword [ebx]
movaps xmm3, xmm5
movhps xmm1, qword [edx]
add ebx, 8
xorps xmm4, xmm6
add ecx, 8
add edx, 8
shufps xmm5, xmm5, 0xf5
add eax, 8
xorps xmm5, xmm6
shufps xmm3, xmm3, 0xa0
movaps xmmword [esp], xmm2
movaps xmmword [esp + 0x10], xmm3
movaps xmm2, xmm0
mulps xmm0, xmm4
movaps xmm3, xmm1
mulps xmm1, xmm5
shufps xmm1, xmm1, 0xb1
mulps xmm2, xmmword [esp]
shufps xmm0, xmm0, 0xb1
addps xmm0, xmm2
mulps xmm3, xmmword [esp + 0x10]
addps xmm1, xmm3
movaps xmm2, xmm0
addps xmm0, xmm1
subps xmm2, xmm1
movaps xmm3, xmm0
movlhps xmm0, xmm2
shufps xmm3, xmm2, 0xbe
xorps xmm3, xmm7
movaps xmm2, xmm0
cmp eax, dword [esp + 0x48]
addps xmm0, xmm3
movlps qword [eax - 8], xmm0
movhps qword [ebx - 8], xmm0
subps xmm2, xmm3
movlps qword [ecx - 8], xmm2
movhps qword [edx - 8], xmm2
jne 0x5d6e20
mov eax, dword [esp + 0x54]
lea esp, [eax - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5d6ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x78
and esp, 0xfffffff0
mov dword [esp + 0x74], ebp
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
shl eax, 2
mov dword [esp + 0x70], eax
mov cl, byte [ebp + 0xc]
mov eax, 8
shl eax, cl
mov dword [esp + 0x64], eax
mov cl, byte [ebp + 0x10]
mov eax, 4
shl eax, cl
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add eax, ebx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ebx
movaps xmm7, xmmword [0x6830b0]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x60]
lea ebx, [eax + ebp]
lea ecx, [ebx + ebp]
lea edx, [ecx + ebp]
shl ebp, 2
mov esi, dword [esp + 0x64]
movaps xmm6, xmmword [0x683090]
movlps xmm0, qword [edi]
movlps xmm1, qword [edi + 8]
movlps xmm2, qword [edi + 0x10]
add edi, dword [esp + 0x70]
movhps xmm0, qword [edi]
movhps xmm1, qword [edi + 8]
movhps xmm2, qword [edi + 0x10]
add edi, dword [esp + 0x70]
movaps xmm3, xmm0
shufps xmm0, xmm0, 0xa0
shufps xmm3, xmm3, 0xf5
movaps xmmword [esp], xmm0
xorps xmm3, xmm6
movaps xmmword [esp + 0x10], xmm3
movaps xmm4, xmm1
shufps xmm1, xmm1, 0xa0
shufps xmm4, xmm4, 0xf5
movaps xmmword [esp + 0x20], xmm1
xorps xmm4, xmm6
movaps xmmword [esp + 0x30], xmm4
movaps xmm5, xmm2
shufps xmm2, xmm2, 0xa0
shufps xmm5, xmm5, 0xf5
movaps xmmword [esp + 0x40], xmm2
xorps xmm5, xmm6
movaps xmmword [esp + 0x50], xmm5
movaps xmm0, xmmword [eax]
movaps xmm1, xmmword [ecx]
movaps xmm2, xmmword [ebx]
movaps xmm3, xmmword [edx]
movaps xmm4, xmm1
movaps xmm5, xmm2
movaps xmm6, xmm3
mulps xmm1, xmmword [esp]
mulps xmm4, xmmword [esp + 0x10]
shufps xmm4, xmm4, 0xb1
mulps xmm2, xmmword [esp + 0x20]
mulps xmm5, xmmword [esp + 0x30]
shufps xmm5, xmm5, 0xb1
mulps xmm3, xmmword [esp + 0x40]
mulps xmm6, xmmword [esp + 0x50]
shufps xmm6, xmm6, 0xb1
addps xmm1, xmm4
addps xmm2, xmm5
addps xmm3, xmm6
movaps xmm4, xmm0
addps xmm0, xmm2
subps xmm4, xmm2
movaps xmm5, xmm1
addps xmm1, xmm3
subps xmm5, xmm3
shufps xmm5, xmm5, 0xb1
xorps xmm5, xmm7
movaps xmm2, xmm0
addps xmm0, xmm1
subps xmm2, xmm1
movaps xmmword [eax], xmm0
movaps xmmword [ecx], xmm2
add eax, ebp
add ecx, ebp
movaps xmm3, xmm4
addps xmm4, xmm5
subps xmm3, xmm5
movaps xmmword [ebx], xmm4
add ebx, ebp
movaps xmmword [edx], xmm3
add edx, ebp
sub esi, ebp
jne 0x5d6fc1
mov eax, dword [esp + 0x6c]
add eax, 0x10
cmp eax, dword [esp + 0x68]
mov dword [esp + 0x6c], eax
jne 0x5d6f41
mov eax, dword [esp + 0x74]
lea esp, [eax - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e2b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x622bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push esi
lea ecx, [esp + 4]
lea eax, [esp + 0xc0]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0x68474c
mov dword [esp + 0xc], 0x1a0
mov dword [esp + 0x10], str.attempting_to_open_video_codec_with_FOURCC__.4s
mov dword [esp + 0x14], eax
call fcn.004f98b0
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x30]
push str.A_video_codec_with_FOURCC__.4S
push eax
mov edx, 0x40
mov dword [esp + 0xc0], 0
call fcn.005a3920
push 0x1a3
push 0x68474c
call fcn.0051e419
mov ecx, dword [esp + 0xd8]
mov edx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd0]
add esp, 0x14
push ecx
push edx
push eax
call sub.MSVFW32.dll_ICOpen
push 0x1a3
lea ecx, [esp + 0x30]
push 0x68474c
push ecx
mov esi, eax
call fcn.0051e419
mov edx, dword [esp + 0x24]
push edx
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0x24], 0x627c10
call dword [0x6affb8]
mov ecx, dword [esp + 0xbc]
add esp, 0x10
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xb4
ret
Function at 0x5e3980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x622c7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], esi
mov dword [esi], 0x6848cc
mov dword [esi + 4], 0
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
call fcn.00612d50
mov dword [esi + 0x10], eax
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
mov ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
push ebx
push edi
mov dword [esp + 0x2c], 0
call eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x5f1d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x622f68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ecx
mov cl, byte [esp + 0x2c]
push edi
lea edx, [esp + 0x20]
push edx
mov byte [esi + 0x44], al
mov byte [esi + 0x45], cl
mov eax, dword [ebx + 0x84]
push 0xd33
call eax
fild dword [esp + 0x20]
fld1
mov ecx, dword [esp + 0x20]
fld st(0)
mov edi, 1
fdivrp st(2)
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x24]
cmp ecx, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
fxch st(1)
fstp qword [esi + 0x10]
jle 0x5f1dfe
mov edx, dword [esp + 0x2c]
lea eax, [edx + edx]
cmp eax, ecx
mov dword [esp + 0x2c], eax
jl 0x5f1def
mov eax, dword [esp + 0x28]
cmp eax, edi
jle 0x5f1e14
mov edx, dword [esp + 0x30]
add edx, edx
cmp edx, eax
mov dword [esp + 0x30], edx
jl 0x5f1e06
fild dword [esp + 0x2c]
push ebp
lea ebp, [esi + 0x30]
push ebp
fdivr st(1)
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
push edi
fstp qword [esi + 0x20]
fidiv dword [esp + 0x3c]
fstp qword [esi + 0x28]
mov eax, dword [ebx + 0x94]
call eax
mov edi, dword [esp + 0x34]
imul edi, dword [esp + 0x30]
add edi, edi
add edi, edi
push edi
call fcn.005f79ac
mov dword [esp + 0x14], eax
push edi
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.005f7e70
mov ecx, dword [ebx + 0xac]
add esp, 0x10
push 4
push 0xcf5
call ecx
mov edx, dword [ebx + 0xac]
push 0
push 0xcf2
call edx
mov eax, dword [ebp]
mov ecx, dword [ebx + 0x20]
push eax
push 0xde1
call ecx
cmp byte [esi + 0x45], 0
pop ebp
je 0x5f1ebf
mov edx, dword [ebx + 0xe4]
push 0x812f
push 0x2802
push 0xde1
call edx
mov eax, dword [ebx + 0xe4]
push 0x812f
push 0x2803
jmp 0x5f1efd
mov ecx, dword [ebx + 0xe4]
push 0x2900
push 0x2802
push 0xde1
call ecx
mov edx, dword [ebx + 0xe4]
push 0x2900
push 0x2803
push 0xde1
call edx
mov eax, dword [ebx + 0xe0]
push 0x6713c0
push 0x1004
push 0xde1
call eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [ebx + 0xdc]
push 0
push 0x1401
push 0x80e1
push 0
push ecx
push edx
push 0x8051
push 0
push 0xde1
call eax
fild dword [esp + 0x2c]
fld1
mov ecx, dword [esp + 0x24]
fld st(0)
mov edx, dword [esp + 0x28]
fdivrp st(2)
mov dword [esi + 0x3c], ecx
mov ecx, esi
mov dword [esi + 0x40], edx
fxch st(1)
fstp dword [esi + 0x34]
fidiv dword [esp + 0x30]
fstp dword [esi + 0x38]
call fcn.005f16a0
mov eax, dword [esp + 0xc]
push eax
call fcn.005f7a6f
mov ecx, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x5f6480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x623057
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 4], 0x63ead0
push edi
lea edi, [esi + 4]
mov dword [esp + 0xc], esi
mov dword [esi], 0x68ca08
mov dword [edi], 0x68ca04
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], ebx
call fcn.00510850
mov dword [esi + 0x30], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x50]
call fcn.005f6b40
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push edi
mov byte [esp + 0x1c], 4
call edx
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5fc4bf
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x6ab3e8
call fcn.00600334
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x5fc32a
push 0x12
call fcn.005fc27a
pop ecx
jmp 0x5fc4b4
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x5fc348
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x5fc4b4
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x5fc37a
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x6d2eb4], esi
mov dword [0x6d2ebc], eax
mov dword [0x6d2ec0], ecx
mov dword [0x6d2ec4], edx
mov dword [0x6d2eb8], edi
call fcn.005fc29e
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.00600581
pop ecx
test eax, eax
jne 0x5fc3c2
push 0x1c
call fcn.005fc27a
pop ecx
call fcn.005ff34c
test eax, eax
jne 0x5fc3d3
push 0x10
call fcn.005fc27a
pop ecx
call fcn.00609078
mov dword [ebp - 4], ebx
call fcn.006030c6
test eax, eax
jge 0x5fc3ec
push 0x1b
call fcn.006005db
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6d4b00], eax
call fcn.00608f43
mov dword [0x6d2d30], eax
call fcn.00608e8a
test eax, eax
jge 0x5fc412
push 8
call fcn.006005db
pop ecx
call fcn.00608c17
test eax, eax
jge 0x5fc423
push 9
call fcn.006005db
pop ecx
push ebx
call fcn.006006f7
pop ecx
test eax, eax
je 0x5fc435
push eax
call fcn.006005db
pop ecx
call fcn.00608bba
test byte [ebp - 0x44], bl
je 0x5fc445
movzx ecx, word [ebp - 0x40]
jmp 0x5fc448
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x5fc465
push eax
call fcn.0060086b
call fcn.0060088d
jmp 0x5fc49a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x5fc4b9
mov eax, 0xff
call fcn.00600379
ret
call fcn.0054ddf9
jmp 0x5fc2df

Function at 0x5fd271
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6b174c]
jne 0x5fd27b
repz ret
jmp fcn.00609c4f