joyce8/EMBER2024-capa huggingface dataset:
Function at 0xab209d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push eax
nop
nop
nop
nop
mov eax, dword fs:[0x30]
nop
nop
nop
nop
mov dword [ebp - 4], eax
nop
nop
pop eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
add esi, 0x14
mov edi, dword [esi]
jmp 0xab20db
push dword [ebp + 8]
push dword [edi + 0x28]
call dword [0xae10a4]
test eax, eax
je 0xab20e5
mov edi, dword [edi]
cmp edi, esi
jne 0xab20c9
xor al, al
pop edi
pop esi
leave
ret
mov al, 1
jmp 0xab20e1
Function at 0xab5566
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0xaee078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x33323130
mov dword [ebp - 0xc], 0x37363534
mov word [ebp - 8], 0x3938
mov byte [ebp - 6], 0
mov ecx, edi
mov eax, esi
push ebx
push 0xa
cdq
pop ebx
idiv ebx
inc ecx
test eax, eax
jne 0xab5596
mov byte [ecx], al
pop ebx
mov eax, esi
xor edx, edx
push 0xa
pop esi
div esi
dec ecx
mov dl, byte [ebp + edx - 0x10]
mov esi, eax
mov byte [ecx], dl
test esi, esi
jne 0xab55a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.00acf48c
leave
ret
Function at 0xab748f
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x980
mov eax, dword [0xaee078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
sub esp, 0xc
mov dword [ebp - 0x8d8], eax
lea eax, [ebp + 0xc]
mov esi, esp
call fcn.00ac2d75
lea eax, [ebp - 0x980]
push eax
call fcn.00ab55de
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x944]
rep movsd dword es:[edi], dword [esi]
push 0xae7a5a
lea esi, [ebp - 0x8f8]
call fcn.00ac2d43
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push dword [ebp + 0x18]
call dword [0xcf2104]
push dword [0xcf1dcc]
mov dword [ebp - 0x8dc], eax
push dword [ebp - 0x940]
xor esi, esi
call dword [0xcf21e0]
test eax, eax
jne 0xab7516
inc esi
cmp dword [ebp - 0x8dc], ebx
je 0xab769a
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x92c]
push dword [ebp - 0x934]
push dword [ebp - 0x8dc]
call dword [0xcf2204]
mov dword [ebp - 0x8e8], eax
cmp eax, ebx
je 0xab768e
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0xcf1c18]
push dword [ebp - 0x918]
push 0xae8ab4
push dword [ebp - 0x8e8]
call dword [0xcf2244]
mov edi, eax
mov dword [ebp - 0x8e0], edi
cmp edi, ebx
je 0xab7682
cmp esi, ebx
je 0xab75af
or dword [ebp - 0x8ec], 0x10300
push 4
lea eax, [ebp - 0x8ec]
push eax
push 0x1f
push edi
call dword [0xcf1ffc]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0xcf21cc]
push ebx
mov esi, eax
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x13
push edi
mov dword [ebp - 0x8fc], 0x100
call dword [0xcf225c]
test eax, eax
jne 0xab75f7
push 0xae8ab8
mov esi, dword [ebp - 0x8d8]
call fcn.00ac2d43
jmp 0xab76ab
lea edx, [ebp - 0x104]
call fcn.00ac4359
cmp eax, 0xc8
jne 0xab76d7
cmp esi, ebx
je 0xab7676
mov edi, 0x7cf
jmp 0xab7657
mov eax, dword [ebp - 0x8e4]
cmp eax, ebx
je 0xab7676
mov byte [ebp + eax - 0x8d4], bl
lea eax, [ebp - 0x8d4]
push eax
lea esi, [ebp - 0x908]
lea eax, [ebp - 0x8f8]
call fcn.00ac2e65
lea esi, [ebp - 0x8f8]
call fcn.00ac2de9
mov eax, dword [ebp - 0x908]
call fcn.00ab3510
lea eax, [ebp - 0x8e4]
push eax
push edi
lea eax, [ebp - 0x8d4]
push eax
push dword [ebp - 0x8e0]
call dword [0xcf212c]
test eax, eax
jne 0xab7618
push dword [ebp - 0x8e0]
call dword [0xcf2100]
push dword [ebp - 0x8e8]
call dword [0xcf2100]
push dword [ebp - 0x8dc]
call dword [0xcf2100]
mov esi, dword [ebp - 0x8d8]
lea eax, [ebp - 0x8f8]
call fcn.00ac2d75
mov eax, dword [ebp - 0x8f8]
call fcn.00ab3510
mov eax, dword [ebp + 0xc]
call fcn.00ab3510
mov eax, dword [ebp + 0x18]
call fcn.00ab3510
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00acf48c
leave
ret
push 0xae8ac0
jmp 0xab75e7
Function at 0xab826f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0x40
push 0
push esi
call fcn.00ab880b
add esp, 0x10
test eax, eax
jne 0xab828f
xor eax, eax
inc eax
jmp 0xab8325
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xab8322
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xab8322
push dword [ebp + 8]
lea edi, [esi + 0x40]
push 0xf8
push eax
push edi
call fcn.00ab880b
add esp, 0x10
test eax, eax
je 0xab8287
cmp dword [edi], 0x4550
jne 0xab8322
mov eax, 0x10b
cmp word [esi + 0x58], ax
jne 0xab8322
movzx eax, word [esi + 0x46]
test ax, ax
je 0xab8322
imul eax, eax, 0x28
push eax
mov dword [esi + 0x140], eax
call fcn.00ac43d4
pop ecx
mov dword [esi + 0x138], eax
test eax, eax
jne 0xab82f7
push 3
jmp 0xab8324
push dword [ebp + 8]
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push dword [esi + 0x140]
lea ecx, [ecx + edx + 0x18]
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00ab880b
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0xab8325
push 2
pop eax
pop edi
pop ebp
ret
Function at 0xac1eec
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x3c]
xor ebx, ebx
add esi, eax
mov dword [ebp - 0x14], ebx
xor eax, eax
cmp dword [esi], 0x4550
push edi
jne 0xac1fb2
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00ad6090
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push 4
pop edi
push edi
push 1
push ebx
push ebx
push 0xae7615
push 0xae7754
call dword [0xcf20b0]
test eax, eax
je 0xac1fb0
push edi
push 0x1000
push edi
push ebx
call dword [0xcf216c]
mov ebx, eax
push ebx
mov dword [ebx], 0x10007
push dword [ebp - 0x20]
call dword [0xae10c4]
test eax, eax
je 0xac1fb0
push 0
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x24]
call dword [0xae1194]
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x24]
call dword [0xae10d0]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0xac1fb7
push dword [ebp - 0x20]
call dword [0xcf2220]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [0xae10d4]
push 0
push dword [esi + 0x54]
push dword [ebp + 8]
push eax
push dword [ebp - 0x24]
call edi
and dword [ebp - 0xc], 0
xor eax, eax
cmp ax, word [esi + 6]
jae 0xac2011
and dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 8]
push 0
lea eax, [eax + ecx + 0xf8]
push dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x10]
add edx, ecx
push edx
push eax
push dword [ebp - 0x24]
call edi
movzx eax, word [esi + 6]
inc dword [ebp - 0xc]
add dword [ebp - 8], 0x28
cmp dword [ebp - 0xc], eax
jl 0xac1fda
push 0
push 4
lea eax, [esi + 0x34]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x24]
call edi
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x10]
push ebx
mov dword [ebx + 0xb0], eax
push dword [ebp - 0x20]
call dword [0xae10c8]
push dword [ebp - 0x20]
call dword [0xcf2220]
mov eax, dword [ebp - 0x1c]
jmp 0xac1fb2
Function at 0xaca979
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0xacc9d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ebx, eax
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0xacc9fe
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.00ad6090
mov eax, ebx
movzx ecx, word [eax*8 + 0xae71b2]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax*8 + 0xae71b0]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax*8 + 0xae71b4]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax*8 + 0xae71b6]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ebx, 2
jg 0xacca61
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0xacca6d
cmp ebx, 8
jl 0xacca6d
mov eax, dword [ebp + 8]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0xaccad2
cmp eax, 0xffffffff
je 0xaccad2
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0xaccaad
call fcn.00accc28
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0xaccab5
jmp 0xaccae2
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xaccd39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0xaccf37
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0xaccdb3
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0xaccdf6
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0xaccdf6
mov ecx, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], ecx
jbe 0xaccddd
mov dword [esi + 0x6afa0], ecx
push dword [ebp - 4]
mov edx, esi
call fcn.00accae7
mov ebx, eax
mov eax, dword [esi + 0x6af90]
pop ecx
cmp ebx, eax
jbe 0xaccdf6
mov ebx, eax
cmp ebx, 3
jb 0xacceb7
mov edx, dword [esi + 0x6af84]
sub edx, dword [esi + 0x6af88]
lea ecx, [ebx - 3]
mov eax, esi
call fcn.00acc46e
sub dword [esi + 0x6af90], ebx
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x6af90]
cmp ebx, dword [esi + 0x6af98]
ja 0xacce84
cmp eax, 3
jb 0xacce84
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0xacce32
jmp 0xacced7
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [esi + 0x6af7c], edx
jmp 0xaccedd
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
xor edx, edx
mov eax, esi
call fcn.00acc46e
dec dword [esi + 0x6af90]
mov dword [ebp - 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp - 8], 0
je 0xaccf18
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0xaccef6
lea edx, [ecx + esi + 0x1af70]
jmp 0xaccef8
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push edx
mov ecx, esi
call fcn.00acc2f1
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0xaccf29
call fcn.00accc28
cmp dword [esi + 0x6af90], 0
jne 0xaccd63
pop edi
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0xaccf4a
lea edx, [ecx + esi + 0x1af70]
jmp 0xaccf4c
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push edx
mov ecx, esi
call fcn.00acc2f1
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0xacdaf4
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0xacdaff
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0xacdbb3
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0xae7200]
add ecx, 8
sub edi, 8
dec esi
jne 0xacdb16
pop ebx
test edi, edi
je 0xacdbcc
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0xae7200]
inc ecx
dec edi
jne 0xacdbb7
pop esi
not eax
pop edi
ret

Function at 0xacdbd1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0xae7200]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0xae7200]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0xacdd73
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0xaee078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x38]
mov edi, ecx
push eax
mov esi, edx
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x50], esi
call dword [0xae112c]
test eax, eax
jne 0xacddbb
mov eax, 0x200
jmp 0xacdf3f
mov ecx, dword [ebp - 0x38]
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x40], ecx
and dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
je 0xacddd1
mov dword [ebp - 0x3c], eax
test cl, 2
je 0xacddda
or dword [ebp - 0x3c], 2
test cl, 4
je 0xacdde3
or dword [ebp - 0x3c], 4
mov eax, ecx
and eax, 0x10
je 0xacddee
or dword [ebp - 0x3c], 0x10
test cl, 0x20
je 0xacddf7
or dword [ebp - 0x3c], 0x20
cmp eax, ebx
je 0xacde04
or dword [ebp - 0x3c], 0x40000000
jmp 0xacde0b
or dword [ebp - 0x3c], 0x80000000
or dword [ebp - 0x3c], 0x1000000
cmp dword [ebp - 0x40], ebx
jne 0xacde1e
or dword [ebp - 0x3c], 0x800000
push ebx
push edi
call dword [0xae10bc]
mov dword [ebp - 0x48], eax
cmp eax, 0x28
jbe 0xacdec2
mov esi, dword [0xae110c]
push ebx
push ebx
push ebx
push edi
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push edi
mov edi, dword [0xae1078]
call edi
push ebx
push ebx
push 0x24
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 4
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x44]
call edi
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0xacdebf
mov eax, dword [ebp - 0x64]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x48], ecx
jbe 0xacdebf
push ebx
push ebx
push eax
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x44]
call edi
mov eax, dword [ebp - 0x58]
cmp eax, 0x5a4d
je 0xacdeb8
cmp eax, 0x454e
je 0xacdeb8
cmp eax, 0x454c
je 0xacdeb8
cmp eax, 0x4550
jne 0xacdebf
or dword [ebp - 0x3c], 0x400000
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0xacdece
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0xacdeda
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
cmp esi, ebx
je 0xacdf13
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00acdce8
push dword [ebp - 0x20]
mov dword [esi], eax
push dword [ebp - 0x24]
mov dword [esi + 4], edx
call fcn.00acdce8
push dword [ebp - 0x30]
mov dword [esi + 8], eax
push dword [ebp - 0x34]
mov dword [esi + 0xc], edx
call fcn.00acdce8
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
cmp dword [ebp - 0x4c], ebx
je 0xacdf3d
push dword [ebp - 0x20]
lea edi, [ebp - 0x3c]
push dword [ebp - 0x24]
lea esi, [ebp - 0x40]
call fcn.00acdd0c
movzx eax, word [ebp - 0x40]
pop ecx
pop ecx
movzx ecx, word [ebp - 0x3c]
shl eax, 0x10
or eax, ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00acf48c
leave
ret
Function at 0x5d8a8c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5d8b2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5d8b2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5d8b2a
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5d8b2a
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d2b7c]
pop edi
test eax, eax
jne 0x5d8b1d
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d2b7c]
pop edi
test eax, eax
je 0x5d8b2a
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5d8baf
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d8c5b
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5d8bf0
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d2b7c]
pop edi
pop ecx
test eax, eax
je 0x5d8c4e
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5d8c2e
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5d8c43
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d8bd7
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5d8c62
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5d8e7c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d8ef6
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005d8e21
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x1245a646]
pop edi
test eax, eax
jne 0x5d8eec
pop ecx
jmp 0x5d8efd
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d8ea5
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5d90a3
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5d91f7
cmp dword [ebp + 0xc], 0
jne 0x5d91f7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5d90ea
sub eax, dword [ebp + 0x10]
js 0x5d91f7
je 0x5d91f7
cmp eax, dword [ebp + 0x14]
jl 0x5d91f7
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5d91f7
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5d91f7
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d2b7c]
pop edi
test eax, eax
je 0x5d91f7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x1249d45a]
push eax
call fcn.005d810b
pop edi
test eax, eax
je 0x5d91f7
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x1249d45e]
push eax
call fcn.005d810b
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5d91ea
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5d91f7
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5d91d7
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5d91a5
push dword [ebp + 8]
call fcn.005d9f99
jmp 0x5d91fe
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5d9589
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5d9678
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5d9678
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5d9624
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5d9678
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x1249d5ba]
pop edi
pop ecx
test eax, eax
jne 0x5d95dd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5d962a
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5d9678
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5d9678
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5d9678
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5d9678
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005d94d2
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8