joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52eec0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5097
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x20
call fcn.00587dd8
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi], vtable.COutStreamWithSha1.0
mov dword [esi + 0xc], 0
push 0x80
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00430d10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
push esi
mov dword [ebp - 0x14], esi
call dword [eax + 4]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], 2
test edi, edi
je 0x52ef4a
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x52ef57
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [ebp + 0x1c]
mov dword [esi + 0xc], edi
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp + 0x20]
test edi, edi
push esi
push dword [ebp + 0x14]
mov dword [esi + 0x18], 0
setne al
push dword [ebp + 0x10]
mov byte [esi + 8], al
push dword [ebp + 0xc]
mov eax, dword [0x5faba0]
push dword [ebp + 8]
mov dword [esi + 0x1c], 0
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
mov ecx, dword [ebp - 0x10]
call fcn.0052e720
mov dword [ebp + 0x18], eax
test edi, edi
je 0x52efd7
mov ecx, dword [esi + 0x10]
mov edx, edi
call fcn.00464230
mov dword [ebp - 4], 3
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x532800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b53b1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
push 4
mov dword [edi + 0x58], 0
call fcn.0058813f
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 3
mov byte [eax], 0
mov dword [ebp - 4], 0
push 4
mov dword [edi + 0x64], 0
call fcn.0058813f
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 3
mov byte [eax], 0
mov byte [ebp - 4], 1
push 4
mov dword [edi + 0x70], 0
call fcn.0058813f
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 3
mov byte [eax], 0
mov byte [ebp - 4], 2
push 4
mov dword [edi + 0x7c], 0
call fcn.0058813f
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 3
mov byte [eax], 0
mov byte [ebp - 4], 3
push 4
mov dword [edi + 0x88], 0
call fcn.0058813f
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 3
mov byte [eax], 0
mov byte [ebp - 4], 4
push 4
mov dword [edi + 0x94], 0
call fcn.0058813f
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 3
mov byte [eax], 0
lea esi, [edi + 0xa8]
mov dword [ebp + 8], esi
mov dword [esi], 0xffffffff
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x10], 0
push 4
call fcn.0058813f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 3
mov byte [eax], 0
lea esi, [edi + 0xc4]
mov dword [ebp + 8], esi
mov dword [esi], 0xffffffff
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 8
push 4
mov dword [esi + 0x10], 0
call fcn.0058813f
mov dword [esi + 0x10], eax
add esp, 0x20
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 3
mov byte [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x533a30
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 1
jne 0x533ab1
mov ebx, dword [ebp + 8]
mov esi, dword [edi]
test ebx, ebx
je 0x533a4f
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x533a5c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 8], ebx
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov eax, dword [0x5faba0]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
mov esi, dword [edi]
jmp 0x533b43
cmp eax, 3
jne 0x533b40
mov ebx, dword [ebp + 8]
mov esi, dword [edi + 4]
test ebx, ebx
je 0x533aca
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x533ad7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 8], ebx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov eax, dword [0x5faba4]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
mov esi, dword [edi + 4]
jmp 0x533b43
mov esi, dword [ebp + 8]
mov edi, dword [edi + 8]
test esi, esi
je 0x533b50
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x533b5d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 8], esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5368c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b585b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x18]
mov dword [edi + 0x14], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00478560
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 0
call fcn.004787d0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 4
mov byte [esi + 0x64], 1
mov dword [ebp - 4], 1
mov dword [edi], vtable.NArchive::NXz::CHandler.4.0
mov dword [edi + 4], vtable.NArchive::NXz::CHandler.0
mov dword [edi + 8], vtable.NArchive::NXz::CHandler.3.0
mov dword [edi + 0xc], vtable.NArchive::NXz::CHandler.2.0
mov dword [edi + 0x10], vtable.NArchive::NXz::CHandler.1.0
push 4
mov dword [edi + 0x110], 0
call fcn.0058813f
mov dword [edi + 0x110], eax
add esp, 4
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 3
mov byte [eax], 0
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov dword [edi + 0x138], 0
mov dword [edi + 0x13c], 0
mov dword [edi + 0x11c], 0
mov dword [edi + 0x120], 0
mov dword [edi + 0x124], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53d140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5d65
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.NArchive::NZip::CHandler.1.0
mov dword [ebx + 4], vtable.NArchive::NZip::CHandler.0
mov dword [ebx + 8], vtable.NArchive::NZip::CHandler.2.0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea edi, [ebx + 0x20]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov byte [edi + 0x21], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0xffffffff
mov word [edi + 0x6c], 0
mov byte [edi + 0x6e], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
lea esi, [edi + 0x90]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 4
push 8
mov dword [esi + 0x28], 0
call fcn.0058813f
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 3
mov word [eax], cx
mov byte [ebp - 4], 5
push 8
mov dword [esi + 0x34], ecx
call fcn.0058813f
xor ecx, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 3
mov word [eax], cx
push 0x30
mov dword [esi + 0x40], ecx
add esi, 0x48
push ecx
push esi
call fcn.0058ad30
mov byte [esi], 0
add esp, 0x14
mov word [edi + 0x110], 0
mov byte [edi + 0x112], 0
lea esi, [ebx + 0x138]
mov byte [ebp - 4], 6
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.00478560
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 7
call fcn.004787d0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 4
mov byte [esi + 0x64], 1
mov byte [ebp - 4], 8
mov ecx, ebx
mov dword [ebx + 0x1a8], 1
mov word [ebx + 0x1ac], 0
mov dword [ebx + 0x1b0], 0xffffffff
call fcn.0053cfd0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54dfd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b655b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, 0x63
mov dword [esi + 0x1c], 0
mov word [esi + 2], ax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 7
mov dword [ebp - 0x14], 0
call fcn.0058813f
mov ecx, eax
mov dword [ebp - 0x14], 7
mov eax, dword [ebp + 8]
lea edi, [esi + 0x30]
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x9901
mov byte [ecx + 5], al
shr eax, 8
mov dword [ecx], 0x45410002
mov byte [ecx + 4], bl
mov byte [ecx + 6], al
mov ecx, edi
call fcn.00439780
push 0xc
call fcn.00587dd8
mov esi, eax
mov dword [ebp + 8], esi
mov byte [ebp - 4], 1
mov dword [esi], 0x9901
push 7
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0058813f
mov ebx, dword [ebp - 0x18]
add esp, 8
mov dword [esi + 4], eax
mov ecx, dword [ebx]
mov dword [eax], ecx
movzx ecx, word [ebx + 4]
mov word [eax + 4], cx
movzx ecx, byte [ebx + 6]
mov byte [eax + 6], cl
mov dword [esi + 8], 7
mov byte [ebp - 4], 0
mov ecx, dword [edi + 4]
lea eax, [ecx + 1]
mov dword [edi + 4], eax
mov eax, dword [edi]
mov edi, dword [ebp - 0x10]
mov dword [eax + ecx*4], esi
lea ecx, [edi + 0x50]
call fcn.00439780
push 0xc
call fcn.00587dd8
mov esi, eax
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
mov dword [esi], 0x9901
push 7
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0058813f
mov dword [esi + 4], eax
mov ecx, dword [ebx]
push ebx
mov dword [eax], ecx
movzx ecx, word [ebx + 4]
mov word [eax + 4], cx
movzx ecx, byte [ebx + 6]
mov byte [eax + 6], cl
mov dword [esi + 8], 7
mov ecx, dword [edi + 0x54]
lea eax, [ecx + 1]
mov dword [edi + 0x54], eax
mov eax, dword [edi + 0x50]
mov dword [eax + ecx*4], esi
call fcn.00588148
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54e140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.0046cb10
lea eax, [edi + 0x2c]
lea ecx, [esi + 0x8c]
cmp eax, ecx
je 0x54e169
push dword [eax + 4]
push dword [eax]
call fcn.00439460
lea eax, [edi + 0x34]
lea ecx, [esi + 0x60]
cmp eax, ecx
je 0x54e17d
push dword [eax + 4]
push dword [eax]
call fcn.00439460
movzx ecx, word [esi]
mov eax, ecx
or ecx, 0x800
and eax, 0xf7ff
movzx ecx, cx
cmp byte [edi + 5], 0
movzx eax, ax
cmove ecx, eax
mov word [esi], cx
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ecx
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x48]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ecx
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x50]
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], ecx
movzx eax, byte [edi + 4]
mov byte [esi + 0x89], al
movzx eax, byte [edi + 3]
pop edi
mov byte [esi + 0x88], al
pop esi
ret
Function at 0x559270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x559289
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x55929a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
test eax, eax
je 0x5592ad
xor ecx, ecx
jmp 0x5592b6
call ebx
test eax, eax
mov ecx, esi
cmovne ecx, eax
test ecx, ecx
je 0x5592c3
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
test eax, eax
je 0x5592d3
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x5592e4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
test eax, eax
je 0x5592ec
xor ecx, ecx
jmp 0x5592f5
call ebx
test eax, eax
mov ecx, esi
cmovne ecx, eax
test ecx, ecx
jne 0x5592ba
mov byte [edi + 0x10], cl
cmp dword [edi + 0xc], ecx
je 0x55930a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x559220
push 0
push 0
call fcn.005934c4
add esp, 0x18
mov dword [edi + 0xc], eax
test eax, eax
je 0x559334
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ebx
test eax, eax
pop edi
cmovne esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, ecx
push ebx
push esi
push edi
mov ebx, dword [eax + 0x34]
cmp ebx, 0xa
jae 0x55b9e1
nop dword [eax]
mov esi, dword [eax]
cmp esi, 8
jae 0x55b9bb
mov edi, dword [eax + 8]
cmp edi, dword [eax + 0xc]
je 0x55baa6
movzx edx, byte [edi]
mov ecx, 0x18
sub ecx, esi
shl edx, cl
lea ecx, [edi + 1]
or dword [eax + 4], edx
add esi, 8
mov dword [eax + 8], ecx
mov edx, dword [eax + 4]
mov ecx, edx
shl ecx, 8
mov dword [eax + 4], ecx
lea ecx, [esi - 8]
shr edx, 0x18
mov dword [eax], ecx
mov byte [ebx + eax + 0x7a96], dl
mov ebx, dword [eax + 0x34]
inc ebx
mov dword [eax + 0x34], ebx
cmp ebx, 0xa
jb 0x55b990
movzx edx, byte [eax + 0x7a9c]
movzx ecx, byte [eax + 0x7a9d]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x7a9e]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x7a9f]
shl edx, 8
or edx, ecx
mov dword [eax + 0x7aa0], edx
mov cl, byte [eax + 0x7a96]
cmp cl, 0x31
jne 0x55baac
cmp byte [eax + 0x7a97], 0x41
jne 0x55bb42
cmp byte [eax + 0x7a98], 0x59
jne 0x55bb42
cmp byte [eax + 0x7a99], 0x26
jne 0x55bb42
cmp byte [eax + 0x7a9a], 0x53
jne 0x55bb42
cmp byte [eax + 0x7a9b], 0x59
jne 0x55bb42
cmp byte [eax + 0x7aa8], 0
jne 0x55ba79
add dword [eax + 0x7ab0], 1
adc dword [eax + 0x7ab4], 0
add dword [eax + 0x7ab8], 1
mov byte [eax + 0x7aa8], 1
mov ecx, dword [eax + 0x7aa4]
adc dword [eax + 0x7abc], 0
ror ecx, 0x1f
xor ecx, edx
mov dword [eax + 0x7aa4], ecx
mov dword [eax + 0x30], 2
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp cl, 0x17
jne 0x55bb42
cmp byte [eax + 0x7a97], 0x72
jne 0x55bb42
cmp byte [eax + 0x7a98], 0x45
jne 0x55bb42
cmp byte [eax + 0x7a99], 0x38
jne 0x55bb42
cmp byte [eax + 0x7a9a], 0x50
jne 0x55bb42
cmp byte [eax + 0x7a9b], 0x90
jne 0x55bb42
cmp byte [eax + 0x7aa8], 0
jne 0x55bafd
add dword [eax + 0x7ab0], 1
adc dword [eax + 0x7ab4], 0
mov esi, dword [eax + 4]
mov byte [eax + 0x7aa8], 1
test esi, esi
je 0x55bb12
mov byte [eax + 0x7aaa], 1
mov edx, dword [eax]
mov ecx, edx
and ecx, 7
mov dword [eax + 0x30], 0xb
sub edx, ecx
shl esi, cl
mov ecx, dword [eax + 0x7aa0]
mov dword [eax], edx
mov dword [eax + 4], esi
cmp ecx, dword [eax + 0x7aa4]
je 0x55baa6
mov byte [eax + 0x7aa9], 1
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x55d6f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x55d70b
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x55d71f
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xb8], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x55d72d
xor ecx, ecx
jmp 0x55d739
call edi
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
jne 0x55d7ab
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x55d750
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x55d764
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xbc], eax
test eax, eax
je 0x55d76c
xor ecx, ecx
jmp 0x55d778
call edi
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
jne 0x55d7ab
lea eax, [ebp - 4]
push eax
push ecx
push esi
push 0x55d6d0
push ecx
push ecx
call fcn.005934c4
add esp, 0x18
mov dword [esi + 0xb4], eax
test eax, eax
je 0x55d79f
xor ecx, ecx
jmp 0x55d7ab
call edi
test eax, eax
mov ecx, 1
cmovne ecx, eax
pop edi
pop esi
test ecx, ecx
jg 0x55d7b7
mov eax, ecx
mov esp, ebp
pop ebp
ret
movzx eax, cx
or eax, 0x80070000
mov esp, ebp
pop ebp
ret

Function at 0x55e430
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x8ce4], eax
test eax, eax
jne 0x55e46d
call ebx
test eax, eax
mov esi, 1
cmovne esi, eax
test esi, esi
jne 0x55e529
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x8ce8], eax
test eax, eax
jne 0x55e499
call ebx
test eax, eax
mov esi, 1
cmovne esi, eax
test esi, esi
jne 0x55e529
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x8cec], eax
test eax, eax
jne 0x55e4c1
call ebx
test eax, eax
mov esi, 1
cmovne esi, eax
test esi, esi
jne 0x55e529
mov eax, dword [edi + 0x8cdc]
mov edx, dword [eax + 0x178]
mov ecx, dword [eax + 0x17c]
mov eax, edx
or eax, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0xc]
push eax
je 0x55e534
push 4
push edi
push 0x55e420
push 0
push 0
call fcn.005934c4
add esp, 0x18
mov dword [ebp - 8], eax
mov dword [edi + 0x8ce0], eax
test eax, eax
je 0x55e51b
push dword [ebp - 4]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x55e527
call ebx
test eax, eax
mov esi, 1
cmovne esi, eax
test esi, esi
jg 0x55e556
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
push 0x55e420
push 0
push 0
call fcn.005934c4
add esp, 0x18
mov dword [edi + 0x8ce0], eax
test eax, eax
je 0x55e51b
xor esi, esi
jmp 0x55e527
pop edi
movzx eax, si
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55e860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6d8c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], 0
mov dword [esi], vtable.NCompress::NBZip2::CEncoder.2.0
mov dword [esi + 4], vtable.NCompress::NBZip2::CEncoder.1.0
mov dword [esi + 8], vtable.NCompress::NBZip2::CEncoder.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x15c], 0
mov dword [esi + 0x168], 0
mov dword [esi + 0x170], 0xffffffff
mov dword [esi + 0x174], 0xffffffff
mov dword [esi + 0x178], 0
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x188], 0
lea ecx, [esi + 0x18c]
mov byte [ebp - 4], 2
call fcn.00465530
mov dword [esi + 0x1b4], 0
mov eax, dword [esi + 0x174]
cmp eax, 0xffffffff
je 0x55e985
cmp eax, 1
jb 0x55e985
cmp eax, 0xa
jbe 0x55e98f
mov dword [esi + 0x174], 0xa
jmp 0x55e98f
mov dword [esi + 0x174], 1
mov eax, dword [esi + 0x170]
cmp eax, 0xffffffff
je 0x55e9b0
cmp eax, 1
jae 0x55e9ab
mov dword [esi + 0x170], 1
jmp 0x55e9ba
cmp eax, 9
jbe 0x55e9ba
mov dword [esi + 0x170], 9
mov dword [esi + 0x184], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1a4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret