joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54f880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x643e06
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push 0
push dword [ebp + 8]
mov ebx, ecx
push 0
push dword [ebp + 0x10]
call fcn.004b2d70
add eax, 7
push 0
push 8
adc edx, 0
push edx
push eax
call fcn.004b2940
push 0
push dword [ebp + 0xc]
push edx
push eax
call fcn.004b2d70
mov ecx, eax
test edx, edx
jg 0x54f8f5
jl 0x54f8d9
test ecx, ecx
jne 0x54f8f5
mov eax, dword [ebp + 0x18]
pop ebx
mov dword [eax], 0x82030011
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x4bc]
push esi
push edi
mov edi, dword [ebp + 0x18]
sub eax, 1
je 0x54f931
sub eax, 1
je 0x54f921
test edx, edx
jl 0x54f93f
jg 0x54f9a2
cmp ecx, dword [ebx + 0x4b8]
jbe 0x54f93f
jmp 0x54f9a2
test edx, edx
jl 0x54f93f
jg 0x54f9a2
cmp ecx, 0x40000000
jbe 0x54f93f
jmp 0x54f9a2
test edx, edx
jg 0x54f9a2
jl 0x54f93f
cmp ecx, 0x10000
jae 0x54f9a2
push 0x74
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x54f962
mov ecx, eax
call fcn.005ac0e0
mov esi, eax
jmp 0x54f964
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x54f97d
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xc20303e8
jmp 0x54fa57
push dword [ebp + 0x14]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x18]
mov dword [edi], eax
test eax, eax
jns 0x54fa3c
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push 0x98
call fcn.004463f0
add esp, 4
mov dword [ebp + 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x54f9c8
mov ecx, eax
call fcn.005acf40
mov esi, eax
jmp 0x54f9ca
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x54fa51
mov eax, dword [ebx + 0x4a8]
test eax, eax
jne 0x54f9e4
mov eax, 0x649aa0
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x6a79b0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push dword [ebx + 0x4b4]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.005ad3d0
mov dword [edi], eax
test eax, eax
mov eax, dword [esi]
mov ecx, esi
jns 0x54fa1d
push 1
call dword [eax]
jmp 0x54fa57
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x18]
mov dword [edi], eax
test eax, eax
jns 0x54fa3c
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
mov dword [edi], 0xc20303e8
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x54fa70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x643de0
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x54faae
mov dword [ebx], esi
mov eax, dword [ecx]
push ecx
mov dword [ebp - 4], 1
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne byte [ebp - 0xd]
test eax, eax
jne 0x54fae7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
js 0x54fbe3
jne 0x54fad9
xor esi, esi
jmp 0x54fbe3
movzx esi, si
or esi, 0x83ff0000
jmp 0x54fbe3
mov ecx, dword [0x6ef9d8]
mov edx, 0x6ef9c0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x54fb17
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x54fb17
mov eax, dword [eax]
test eax, eax
je 0x54fb17
mov edx, edi
mov dword [ebp - 0x18], edi
mov ecx, eax
mov dword [ebp - 0x14], eax
xor edi, edi
test ecx, ecx
jle 0x54fbe2
mov eax, dword [ebx]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x54fbe2
mov eax, dword [edx + edi*4]
add eax, 0xfffffffe
cmp eax, 0xf
ja case.0x54fb44.4
movzx eax, byte [eax + 0x54fc20]
jmp dword [eax*4 + 0x54fc04]
push 2
mov esi, 0x82030002
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x54fbc0
push 9
mov dword [ebp + 8], 0
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x54fb7a
push 9
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x54fbc0
push dword [ebp + 8]
push eax
push ebx
call fcn.0054f5a0
add esp, 0xc
jmp 0x54fbbe
push ebx
call fcn.00556010
jmp 0x54fbbb
push ebx
call fcn.00556230
jmp 0x54fbbb
push ebx
call fcn.00556730
jmp 0x54fbbb
push ebx
call fcn.00556560
jmp 0x54fbbb
push ebx
call fcn.00556930
add esp, 4
mov esi, eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp dword [ebx], 0
jne 0x54fbd8
inc edi
xor eax, eax
cmp edi, ecx
jl 0x54fb26
jmp 0x54fbe2
cmp edx, dword [ebp + 0xc]
jne 0x54fbe2
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
pop edi
cmp byte [ebp - 0xd], 0
je 0x54fbef
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x556010
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x63ac10
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 0x10
mov ecx, dword [eax]
push ebx
push esi
push edi
mov edi, 0x82030002
test ecx, ecx
je 0x556056
mov dword [eax], 0
mov eax, dword [ecx]
push ecx
mov dword [ebp - 4], 1
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x5561de
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x5560b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x5561e0
jne 0x55609a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
pop edi
movzx eax, ax
pop esi
or eax, 0x83ff0000
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x556077
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0x14], eax
cmp eax, 0x28
ja 0x5560ec
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
mov eax, 0x82030002
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
xor edx, edx
mov dword [ebp - 0x10], edx
lea eax, [ecx + ebx]
mov dword [ebp - 0x18], eax
movzx eax, word [ebx + 0xe]
dec eax
cmp eax, 0x1f
ja case.0x55610a.2
movzx eax, byte [eax + 0x556210]
jmp dword [eax*4 + 0x5561f4]
mov edi, 1
lea edx, [edi + 1]
jmp 0x556145
mov edi, dword [ebx + 0x10]
mov edx, 0x10
sub edi, 2
neg edi
sbb edi, edi
and edi, 0xfffffffb
add edi, 7
jmp 0x556145
mov edi, dword [ebx + 0x10]
mov edx, 0x100
dec edi
neg edi
sbb edi, edi
and edi, 0xfffffffb
add edi, 8
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x10], edx
test eax, eax
je 0x556172
mov edx, eax
mov dword [ebp - 0x10], edx
jmp 0x556172
mov edi, 4
jmp 0x556169
mov edi, 5
jmp 0x556172
mov edi, 6
cmp dword [ebx + 0x10], 3
jne 0x556172
add ecx, 0xc
mov eax, dword [ebp - 0x14]
lea ecx, [ecx + edx*4]
mov esi, dword [ebx + 4]
sub eax, ecx
movzx edx, word [ebx + 0xe]
push 0
push eax
mov eax, esi
imul eax, edx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
push eax
lea eax, [ecx + ebx]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push edi
push dword [ebx + 8]
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0054ef80
mov edi, eax
add esp, 0x28
test edi, edi
js 0x5561d5
mov ecx, dword [esi]
test ecx, ecx
je 0x5561d5
mov edx, dword [ebx + 0x18]
mov dword [ecx + 0x38], edx
mov edx, dword [esi]
mov eax, dword [ebx + 0x1c]
mov dword [edx + 0x3c], eax
mov ecx, dword [esi]
call fcn.00554b00
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x556560
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x643eeb
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [eax]
test ecx, ecx
je 0x55659e
mov dword [eax], 0
mov eax, dword [ecx]
push ecx
mov dword [ebp - 4], 1
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
push 0xe
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x5565bd
mov eax, 0x82030002
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
push 0xe
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
jne 0x556604
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x556714
jne 0x5565ed
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x83ff0000
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
mov ebx, eax
test ebx, ebx
jne 0x556650
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x556713
jne 0x556638
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx eax, ax
pop ebx
or eax, 0x83ff0000
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
test ebx, ebx
je 0x556662
push ebx
call fcn.004463f0
add esp, 4
mov esi, eax
jmp 0x556664
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
test esi, esi
jne 0x55667c
mov ebx, 0xc20303e8
jmp 0x5566fc
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push 0x50
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x5566a5
mov ecx, eax
call fcn.00557560
mov edi, eax
jmp 0x5566a7
xor edi, edi
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edi
test edi, edi
je 0x5566b8
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 5
test edi, edi
jne 0x5566c7
mov ebx, 0xc20303e8
jmp 0x5566ee
mov eax, dword [edi]
push ebx
push esi
push edi
call dword [eax + 0x18]
mov ebx, eax
test ebx, ebx
js 0x5566ee
push 0
push 1
push dword [ebp + 8]
mov ecx, edi
push 0
call fcn.00558210
push 0
mov ecx, edi
call fcn.00558fb0
mov byte [ebp - 4], 8
test edi, edi
je 0x5566fc
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebp - 4], 9
test esi, esi
je 0x556710
push esi
call fcn.00446420
add esp, 4
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x556730
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x643eeb
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [eax]
test ecx, ecx
je 0x55676e
mov dword [eax], 0
mov eax, dword [ecx]
push ecx
mov dword [ebp - 4], 1
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
push 3
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x55678d
mov eax, 0x82030002
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
push 3
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x5567aa
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x5567e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x556912
jne 0x5567cb
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x83ff0000
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push 0
push dword [eax + 0xc]
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov ebx, eax
test ebx, ebx
jne 0x556844
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
js 0x55682a
jne 0x556821
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx esi, si
or esi, 0x83ff0000
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004463f0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
test esi, esi
jne 0x55686e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, 0xc20303e8
jmp 0x5568fa
mov eax, dword [ebp - 0x14]
push esi
push ebx
push dword [eax + 0xc]
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x50
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x5568a3
mov ecx, eax
call fcn.00557560
mov edi, eax
jmp 0x5568a5
xor edi, edi
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edi
test edi, edi
je 0x5568b6
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 5
test edi, edi
jne 0x5568c5
mov ebx, 0xc20303e8
jmp 0x5568ec
mov eax, dword [edi]
push ebx
push esi
push edi
call dword [eax + 0x18]
mov ebx, eax
test ebx, ebx
js 0x5568ec
push 0
push 1
push dword [ebp + 8]
mov ecx, edi
push 0
call fcn.00558210
push 0
mov ecx, edi
call fcn.00558fb0
mov byte [ebp - 4], 8
test edi, edi
je 0x5568fa
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebp - 4], 9
test esi, esi
je 0x55690e
push esi
call fcn.00446420
add esp, 4
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x556930
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x643f13
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x55696f
mov dword [ebx], 0
mov eax, dword [ecx]
push ecx
mov dword [ebp - 4], 1
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
push 6
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x55698f
mov eax, 0x82030002
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push 6
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x5569ac
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp + 8], eax
test eax, eax
jne 0x5569e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x556acd
jne 0x5569ce
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movzx eax, ax
pop esi
or eax, 0x83ff0000
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x556a33
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x556acc
jne 0x556a1a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
pop edi
movzx eax, ax
pop esi
or eax, 0x83ff0000
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x50
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x556a56
mov ecx, eax
call fcn.00557560
mov esi, eax
jmp 0x556a58
xor esi, esi
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], esi
test esi, esi
je 0x556a6c
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov dword [ebp - 4], 4
test esi, esi
jne 0x556a7e
mov edi, 0xc20303e8
jmp 0x556ac1
push dword [ebp + 8]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x18]
mov edi, eax
test edi, edi
jns 0x556a9d
mov ecx, dword [esi]
push esi
mov dword [ebp - 4], 6
call dword [ecx + 8]
jmp 0x556ac1
push 0
push 1
push ebx
push 0
mov ecx, esi
call fcn.00558210
push 0
mov ecx, esi
call fcn.00558fb0
mov eax, dword [esi]
push esi
mov dword [ebp - 4], 7
call dword [eax + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x55e250
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64417f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi], 0x6a7d14
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x38]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 5
mov dword [edi + 4], 1
mov dword [edi + 0x44], 0x400000
mov dword [edi + 0x48], 0x8000000
mov dword [edi + 0x4c], 0
call fcn.0055a9a0
call fcn.00561800
push esi
call fcn.00471c00
push 0x2c
call fcn.004463f0
mov esi, eax
add esp, 8
test esi, esi
je 0x55e39d
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
push 0x57e4b0
mov dword [esi], 0x2c
call fcn.0055e900
test eax, eax
jne 0x55e39d
push esi
mov byte [ebp - 4], 6
call fcn.00446420
add esp, 4
mov byte [ebp - 4], 5
push 0x2c
call fcn.004463f0
mov esi, eax
add esp, 4
test esi, esi
je 0x55e41b
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
push 0x57e570
mov dword [esi], 0x2c
call fcn.0055e900
test eax, eax
jne 0x55e41b
push esi
mov byte [ebp - 4], 7
call fcn.00446420
add esp, 4
mov byte [ebp - 4], 5
push 0x2c
call fcn.004463f0
mov esi, eax
add esp, 4
test esi, esi
je 0x55e499
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
push 0x57f050
mov dword [esi], 0x2c
call fcn.0055e900
test eax, eax
jne 0x55e499
push esi
mov byte [ebp - 4], 8
call fcn.00446420
add esp, 4
mov byte [ebp - 4], 5
push 0x2c
call fcn.004463f0
mov esi, eax
add esp, 4
test esi, esi
je 0x55e513
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
push 0x57f0f0
mov dword [esi], 0x2c
call fcn.0055e900
test eax, eax
jne 0x55e513
push esi
mov byte [ebp - 4], 9
call fcn.00446420
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5612d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
and eax, 3
push edi
mov dl, byte [esi]
sub eax, 1
je 0x56142e
sub eax, 1
je 0x5613d0
sub eax, 1
je 0x56135a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x561339
mov eax, dword [esp + 0x20]
mov edi, dword [esi]
mov edx, dword [eax]
sub edx, 1
js 0x561321
lea ecx, [ecx]
mov eax, dword [ecx + edx*4]
xor eax, edi
test eax, 0xffffff
je 0x561321
sub edx, 1
jns 0x561310
cmp edx, 0xffffffff
je 0x56143d
pop edi
mov byte [esi], dl
xor eax, eax
mov byte [esi + 1], dl
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
cmp dl, byte [esi + 1]
jne 0x56143d
cmp dl, byte [esi + 2]
jne 0x56143d
pop edi
mov byte [esi], dl
xor eax, eax
mov byte [esi + 1], dl
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x561339
mov ebx, dword [esp + 0x20]
mov eax, dword [esi]
push 1
push eax
mov ebp, dword [ebx]
push ebp
push edi
mov dword [esp + 0x24], eax
call fcn.005610b0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5613bf
cmp ebp, dword [esp + 0x24]
jae 0x56143d
mov eax, dword [esp + 0x14]
mov byte [edi + ebp*4 + 2], al
mov ecx, dword [ebx]
movzx eax, byte [esi + 1]
mov byte [edi + ecx*4 + 1], al
mov ecx, dword [ebx]
movzx eax, byte [esi + 2]
mov byte [edi + ecx*4], al
mov eax, dword [ebx]
mov byte [edi + eax*4 + 3], 0
mov dl, byte [ebx]
inc dword [ebx]
xor eax, eax
pop edi
mov byte [esi], dl
mov byte [esi + 1], dl
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
mov dl, al
xor eax, eax
pop edi
mov byte [esi], dl
mov byte [esi + 1], dl
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5613fc
mov eax, dword [esp + 0x20]
push dword [esi]
push dword [eax]
push ecx
call fcn.00561110
add esp, 0xc
mov ecx, eax
mov dl, cl
xor eax, eax
mov byte [esi], dl
mov byte [esi + 1], dl
pop edi
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
movzx eax, byte [esi + 1]
imul ecx, eax, 0x259
movzx eax, byte [esi + 2]
imul eax, eax, 0x75
pop edi
add ecx, eax
movzx eax, dl
imul eax, eax, 0x132
add ecx, eax
shr ecx, 0xa
xor eax, eax
mov dl, cl
mov byte [esi], dl
mov byte [esi + 1], dl
mov byte [esi + 2], dl
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
movzx ecx, dl
cmp ecx, dword [eax]
jb 0x56132a
pop edi
pop esi
pop ebp
mov eax, 0x82031002
pop ebx
ret
Function at 0x5981c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
lea eax, [ecx + 0x478]
mov dword [esp + 0x34], 0x54583030
mov dword [esp], eax
lea eax, [ecx + 0x484]
mov dword [esp + 4], eax
lea eax, [ecx + 0x490]
mov dword [esp + 8], eax
lea eax, [ecx + 0x49c]
mov dword [esp + 0xc], eax
lea eax, [ecx + 0x4a8]
mov dword [esp + 0x10], eax
lea eax, [ecx + 0x4b4]
mov dword [esp + 0x14], eax
lea eax, [ecx + 0x4c0]
mov dword [esp + 0x18], eax
lea eax, [ecx + 0x4cc]
mov dword [esp + 0x1c], eax
lea eax, [ecx + 0x4d8]
mov dword [esp + 0x20], eax
lea eax, [ecx + 0x4e4]
mov dword [esp + 0x24], eax
lea eax, [ecx + 0x4fc]
mov dword [esp + 0x28], eax
lea eax, [ecx + 0x4f0]
push edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x30], eax
lea eax, [ecx + 0x508]
mov dword [esp + 0x3c], 0x54583031
mov dword [esp + 0x40], 0x54583032
mov dword [esp + 0x44], 0x54583033
mov dword [esp + 0x48], 0x54583034
mov dword [esp + 0x4c], 0x54583035
mov dword [esp + 0x50], 0x54583036
mov dword [esp + 0x54], 0x54583037
mov dword [esp + 0x58], 0x54583038
mov dword [esp + 0x5c], 0x54583039
mov dword [esp + 0x60], 0x54583041
mov dword [esp + 0x64], 0x54583042
mov dword [esp + 0x68], 0x54584646
mov dword [esp + 0x34], eax
test edi, edi
je 0x5982ec
push esi
xor esi, esi
jmp 0x5982c0
mov eax, dword [esp + esi + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5982e3
mov eax, dword [eax]
test eax, eax
jne 0x5982d6
mov eax, 0x649aa0
push ecx
push eax
push dword [esp + esi + 0x44]
mov ecx, edi
call fcn.00554e30
add esi, 4
cmp esi, 0x34
jb 0x5982c0
pop esi
pop edi
add esp, 0x68
ret 4