joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d7fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef6ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.005de09e
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x5d8068
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x688cc0
push eax
lea ecx, [ebp - 0x1c]
call fcn.005b81a8
push 0x6a1274
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push eax
call fcn.005b682f
push eax
push esi
call fcn.005de5a3
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5d8b27
Capabilities:
Get common file path

Disassembly:
jae 0x5d8aac
jmp 0x5d8aa7
call fcn.005d8aae
jae 0x5d8aa7
add esp, 4
jmp 0x5d8ab3
dec dword [esp]
jno 0x5d8ab8
jns 0x5d8aa3
jp 0x5d8abc
add esp, 4
popf
jmp 0x5d8ac3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8adc
call 0x7560ff21
add eax, ebp
je 0x5d8ae1
jne 0x5d8ae1
call 0x101dbe35
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8afb
jne 0x5d8afa
call 0x83617b82
rol byte [ebx + eax*4], 0xf0
add eax, 0x11e415ff
pop edi
add bl, ch
jno 0x5d8b81
xor eax, 3
add eax, 4
xor eax, 5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x5d8b7d
add esi, dword [ebp + 1]
bnd jl 0x5d8b16
jmp 0x5d8b18
je 0x5d8b13
pushf
push 0xa
jae 0x5d8b25
jmp 0x5d8b20
call 0x5d8b27
jae 0x5d8b20
add esp, 4
jmp 0x5d8b2c
dec dword [esp]
jno 0x5d8b31
jns 0x5d8b1c
jp 0x5d8b35
add esp, 4
popf
jmp 0x5d8b3c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8b55
cmp eax, 0x750374f2
add eax, ebp
je 0x5d8b5a
jne 0x5d8b5a
call 0x101dbeae
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8b74
jne 0x5d8b73
call 0x83617bfb
rol byte [ebx + eax*4], 0xf0
add eax, 0x55ccc35d
xor eax, 3
add eax, 4
xor eax, 5
pop ebp
ret
mov ebp, esp
je 0x5d8b88
jne 0x5d8b88
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 + 0x6a9c66fb]
or dh, byte [ebx + 7]
jl 0x5d8b8d
jmp 0x5d8b8f
je 0x5d8b8a
pushf
push 0xa
jae 0x5d8b9c
jmp 0x5d8b97
call 0x5d8b9e
jae 0x5d8b97
add esp, 4
jmp 0x5d8ba3
dec dword [esp]
jno 0x5d8ba8
jns 0x5d8b93
jp 0x5d8bac
add esp, 4
popf
jmp 0x5d8bb3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8bcc
mov es, word [esp + esi*2 - 0x17fe8afd]
je 0x5d8bd1
jne 0x5d8bd1
call 0x101dbf25
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8beb
jne 0x5d8bea
call 0x83617c72
rol byte [ebx + eax*4], 0xf0
add eax, 0x500c458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x5d8c75
pop ebp
ret
Function at 0x5d8b80
Capabilities:
Get common file path

Disassembly:
jae 0x5d8aac
jmp 0x5d8aa7
call fcn.005d8aae
jae 0x5d8aa7
add esp, 4
jmp 0x5d8ab3
dec dword [esp]
jno 0x5d8ab8
jns 0x5d8aa3
jp 0x5d8abc
add esp, 4
popf
jmp 0x5d8ac3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8adc
call 0x7560ff21
add eax, ebp
je 0x5d8ae1
jne 0x5d8ae1
call 0x101dbe35
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8afb
jne 0x5d8afa
call 0x83617b82
rol byte [ebx + eax*4], 0xf0
add eax, 0x11e415ff
pop edi
add bl, ch
jno 0x5d8b81
xor eax, 3
add eax, 4
xor eax, 5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x5d8b7d
add esi, dword [ebp + 1]
bnd jl 0x5d8b16
jmp 0x5d8b18
je 0x5d8b13
pushf
push 0xa
jae 0x5d8b25
jmp 0x5d8b20
call 0x5d8b27
jae 0x5d8b20
add esp, 4
jmp 0x5d8b2c
dec dword [esp]
jno 0x5d8b31
jns 0x5d8b1c
jp 0x5d8b35
add esp, 4
popf
jmp 0x5d8b3c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8b55
cmp eax, 0x750374f2
add eax, ebp
je 0x5d8b5a
jne 0x5d8b5a
call 0x101dbeae
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8b74
jne 0x5d8b73
call 0x83617bfb
rol byte [ebx + eax*4], 0xf0
add eax, 0x55ccc35d
xor eax, 3
add eax, 4
xor eax, 5
pop ebp
ret
mov ebp, esp
je 0x5d8b88
jne 0x5d8b88
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 + 0x6a9c66fb]
or dh, byte [ebx + 7]
jl 0x5d8b8d
jmp 0x5d8b8f
je 0x5d8b8a
pushf
push 0xa
jae 0x5d8b9c
jmp 0x5d8b97
call 0x5d8b9e
jae 0x5d8b97
add esp, 4
jmp 0x5d8ba3
dec dword [esp]
jno 0x5d8ba8
jns 0x5d8b93
jp 0x5d8bac
add esp, 4
popf
jmp 0x5d8bb3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8bcc
mov es, word [esp + esi*2 - 0x17fe8afd]
je 0x5d8bd1
jne 0x5d8bd1
call 0x101dbf25
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8beb
jne 0x5d8bea
call 0x83617c72
rol byte [ebx + eax*4], 0xf0
add eax, 0x500c458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x5d8c75
pop ebp
ret
Function at 0x5d8b9e
Capabilities:
Get common file path

Disassembly:
jae 0x5d8aac
jmp 0x5d8aa7
call fcn.005d8aae
jae 0x5d8aa7
add esp, 4
jmp 0x5d8ab3
dec dword [esp]
jno 0x5d8ab8
jns 0x5d8aa3
jp 0x5d8abc
add esp, 4
popf
jmp 0x5d8ac3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8adc
call 0x7560ff21
add eax, ebp
je 0x5d8ae1
jne 0x5d8ae1
call 0x101dbe35
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8afb
jne 0x5d8afa
call 0x83617b82
rol byte [ebx + eax*4], 0xf0
add eax, 0x11e415ff
pop edi
add bl, ch
jno 0x5d8b81
xor eax, 3
add eax, 4
xor eax, 5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x5d8b7d
add esi, dword [ebp + 1]
bnd jl 0x5d8b16
jmp 0x5d8b18
je 0x5d8b13
pushf
push 0xa
jae 0x5d8b25
jmp 0x5d8b20
call 0x5d8b27
jae 0x5d8b20
add esp, 4
jmp 0x5d8b2c
dec dword [esp]
jno 0x5d8b31
jns 0x5d8b1c
jp 0x5d8b35
add esp, 4
popf
jmp 0x5d8b3c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8b55
cmp eax, 0x750374f2
add eax, ebp
je 0x5d8b5a
jne 0x5d8b5a
call 0x101dbeae
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8b74
jne 0x5d8b73
call 0x83617bfb
rol byte [ebx + eax*4], 0xf0
add eax, 0x55ccc35d
xor eax, 3
add eax, 4
xor eax, 5
pop ebp
ret
mov ebp, esp
je 0x5d8b88
jne 0x5d8b88
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 + 0x6a9c66fb]
or dh, byte [ebx + 7]
jl 0x5d8b8d
jmp 0x5d8b8f
je 0x5d8b8a
pushf
push 0xa
jae 0x5d8b9c
jmp 0x5d8b97
call 0x5d8b9e
jae 0x5d8b97
add esp, 4
jmp 0x5d8ba3
dec dword [esp]
jno 0x5d8ba8
jns 0x5d8b93
jp 0x5d8bac
add esp, 4
popf
jmp 0x5d8bb3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8bcc
mov es, word [esp + esi*2 - 0x17fe8afd]
je 0x5d8bd1
jne 0x5d8bd1
call 0x101dbf25
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8beb
jne 0x5d8bea
call 0x83617c72
rol byte [ebx + eax*4], 0xf0
add eax, 0x500c458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x5d8c75
pop ebp
ret
Function at 0x5d8cb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
je 0x5d8cb8
jne 0x5d8cb8
sar dword [ebx + eax - 0x15], 1
add edx, ecx
jl 0x5d8cbd
jmp 0x5d8cbf
je 0x5d8cba
pushf
push 0xa
jae 0x5d8ccc
jmp 0x5d8cc7
call 0x5d8cce
jae 0x5d8cc7
add esp, 4
jmp 0x5d8cd3
dec dword [esp]
jno 0x5d8cd8
jns 0x5d8cc3
jp 0x5d8cdc
add esp, 4
popf
jmp 0x5d8ce3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8cfc
scasd eax, dword es:[edi]
sal dword [ebx + eax + 0x75], 1
add eax, ebp
je 0x5d8d01
jne 0x5d8d01
call 0x101dc055
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8d1b
jne 0x5d8d1a
call 0x83617da2
rol byte [ebx + eax*4], 0xf0
add eax, 0x5010458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x5d8da9
pop ebp
ret

Function at 0x5d8cce
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
je 0x5d8cb8
jne 0x5d8cb8
sar dword [ebx + eax - 0x15], 1
add edx, ecx
jl 0x5d8cbd
jmp 0x5d8cbf
je 0x5d8cba
pushf
push 0xa
jae 0x5d8ccc
jmp 0x5d8cc7
call 0x5d8cce
jae 0x5d8cc7
add esp, 4
jmp 0x5d8cd3
dec dword [esp]
jno 0x5d8cd8
jns 0x5d8cc3
jp 0x5d8cdc
add esp, 4
popf
jmp 0x5d8ce3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d8cfc
scasd eax, dword es:[edi]
sal dword [ebx + eax + 0x75], 1
add eax, ebp
je 0x5d8d01
jne 0x5d8d01
call 0x101dc055
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d8d1b
jne 0x5d8d1a
call 0x83617da2
rol byte [ebx + eax*4], 0xf0
add eax, 0x5010458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x5d8da9
pop ebp
ret
Function at 0x5d8e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ef708
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x5d8f51
cmp byte [ebx + 0x45], 0
je 0x5d8f51
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x5d8e6f
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
push esi
mov dword [ebp - 4], 0
push edi
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x5d8edb
dec eax
je 0x5d8edf
sub eax, 2
je 0x5d8f2b
xor bl, bl
jmp 0x5d8f2d
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, edx
sub esi, eax
je 0x5d8f11
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005b0c93
add esp, 0x10
cmp esi, eax
jne 0x5d8ed7
cmp byte [ebx + 0x45], 0
je 0x5d8f2b
test esi, esi
jne 0x5d8ea1
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.005d9800
jmp 0x5d8ea1
mov bl, 1
cmp dword [ebp - 0x14], 0x10
pop edi
pop esi
jb 0x5d8f40
push dword [ebp - 0x28]
call fcn.0058bb90
add esp, 4
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5db1b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.005db350
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x5db274
cmp dword [ebp - 4], 0x50000000
jb 0x5db1f1
cmp dword [ebp - 4], 0x80000000
ja 0x5db1f1
mov dword [ebp - 4], 0x4fff0000
jmp 0x5db1ca
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.005b2e70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x5db217
jmp 0x5db274
cmp dword [ebp - 0x14], 0x10000
jne 0x5db25a
cmp dword [ebp - 0x18], 0x10000
jb 0x5db25a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5db24d
mov eax, dword [ebp - 8]
jmp 0x5db276
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x5db26f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.005db350
add esp, 4
mov dword [ebp - 4], eax
jmp 0x5db1ca
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5db280
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.005db380
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x5db33c
cmp dword [ebp - 4], 0x50000000
jb 0x5db2bc
cmp dword [ebp - 4], 0x80000000
ja 0x5db2bc
mov dword [ebp - 4], 0x80010000
jmp 0x5db295
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.005b2e70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x5db2e2
jmp 0x5db33c
cmp dword [ebp - 0x14], 0x10000
jne 0x5db325
cmp dword [ebp - 0x18], 0x10000
jb 0x5db325
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5db318
mov eax, dword [ebp - 8]
jmp 0x5db33e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x5db337
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.005db380
add esp, 4
mov dword [ebp - 4], eax
jmp 0x5db295
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5dbd00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x826938]
mov dword [ebp - 4], eax
jmp 0x5dbd19
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x5dbd36
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x5dbd10
mov esp, ebp
pop ebp
ret
Function at 0x5dc180
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x826924], eax
je 0x5dc19e
mov eax, 0x10dd
jmp 0x5dc27f
mov eax, dword [0x826934]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5dc21c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x5dc1fa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x5dc1fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.005db820
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0058bb90
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x5dc1a6
mov dword [0x826934], 0
call fcn.005dbb40
mov ecx, dword [0x826930]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5dc269
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0058bb90
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x5dc234
mov dword [0x826930], 0
mov dword [0x826924], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5dc770
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x826928], 0
je 0x5dc789
mov eax, dword [0x826928]
jmp 0x5dc829
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x5dc79b
xor eax, eax
jmp 0x5dc829
push 8
call fcn.0058bd10
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5dc7f1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x5dc7da
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0058bb90
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x826928], eax
mov dword [0x82692c], 0
mov eax, dword [ebp - 8]
jmp 0x5dc829
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x5dc80b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x5dc7bb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x826930]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x826930], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x5dc850
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, 0x80
lea esp, [esp]
xor edx, edx
test bl, 1
cmovne edx, eax
mov eax, ebx
shr eax, 1
test al, 1
je 0x5dc873
or edx, 0x40
shr eax, 1
test al, 1
je 0x5dc87c
or edx, 0x20
shr eax, 1
test al, 1
je 0x5dc885
or edx, 0x10
shr eax, 1
test al, 1
je 0x5dc88e
or edx, 8
shr eax, 1
test al, 1
je 0x5dc897
or edx, 4
shr eax, 1
test al, 1
je 0x5dc8a0
or edx, 2
test al, 2
je 0x5dc8a7
or edx, 1
shl edx, 0x18
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
xor esi, esi
mov dword [edi + ebx*4], edx
lea ecx, [esi + 0x1f]
lea ebx, [ebx]
test dl, 1
je 0x5dc97e
mov eax, 1
shl eax, cl
or esi, eax
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x5dc970
mov dword [edi + ebx*4], esi
mov eax, 0x80
inc ebx
cmp ebx, 0xff
jle 0x5dc860
pop edi
pop esi
pop ebx
ret
Function at 0x5dc9c0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x670d5c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.005af960
add esp, 0xc
test eax, eax
je 0x5dc9f9
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.005b0ddc
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x5dca26
call fcn.005af325
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push esi
push 1
push ebx
call fcn.005b56f6
add esp, 0x10
test eax, eax
je 0x5dca74
mov esi, ebx
test eax, eax
je 0x5dca5f
lea esp, [esp]
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
dec eax
jne 0x5dca40
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push ebx
call fcn.005b56f6
add esp, 0x10
test eax, eax
jne 0x5dca36
push ebx
call fcn.005b0f32
push dword [ebp + 0xc]
call fcn.005af325
not dword [edi]
add esp, 8
mov al, 1
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5dcbb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
je 0x5dcbbb
jne 0x5dcbbb
lcall 0x749a, 0x3eb037c
sti
jl 0x5dcbc0
jmp 0x5dcbc2
je 0x5dcbbd
pushf
push 0xa
jae 0x5dcbcf
jmp 0x5dcbca
call 0x5dcbd1
jae 0x5dcbca
add esp, 4
jmp 0x5dcbd6
dec dword [esp]
jno 0x5dcbdb
jns 0x5dcbc6
jp 0x5dcbdf
add esp, 4
popf
jmp 0x5dcbe6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5dcbff
inc edx
lcall 0x50e8, 0x1750374
je 0x5dcc04
jne 0x5dcc04
call 0x101dff58
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5dcc1e
jne 0x5dcc1d
call 0x8361bca5
rol byte [ebx + eax*4], 0xf0
add eax, 0xf445c7
add byte [eax], al
add byte [eax + 0x11], ch
leave
jl 0x5dcc40
xor eax, 3
add eax, 4
xor eax, 5
mov dword [ebp - 0xc], 0
push 0xd7cc911
lea ecx, [ebp - 0x29]
call fcn.005d1cc0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
clc
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x29]
call fcn.005d8320
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
push 0
call sub.WTSAPI32.dll_WTSSendMessageA
cmp dword [ebp + 0xc], 1
jne 0x5dcca8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
je 0x5dccad
jne 0x5dccad
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 + 0x6a9c66fb]
or dh, byte [ebx + 7]
jl 0x5dccb2
jmp 0x5dccb4
je 0x5dccaf
pushf
push 0xa
jae 0x5dccc1
jmp 0x5dccbc
call 0x5dccc3
jae 0x5dccbc
add esp, 4
jmp 0x5dccc8
dec dword [esp]
jno 0x5dcccd
jns 0x5dccb8
jp 0x5dccd1
add esp, 4
popf
jmp 0x5dccd8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5dccf1
movsd dword es:[edi], dword [esi]
test byte [ebx + eax + 0x75], dh
add eax, ebp
je 0x5dccf6
jne 0x5dccf6
call 0x101e004a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5dcd10
jne 0x5dcd0f
call 0x8361bd97
rol byte [ebx + eax*4], 0xf0
add eax, 0xc35de58b
int3
xor eax, 3
add eax, 4
xor eax, 5
mov esp, ebp
pop ebp
ret