joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x485f20
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.0054aa68
test byte [esp + 4], 1
jne 0x485d6f
mov eax, dword [esp]
jmp 0x485f13
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.0054aa7a
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.0054ab52
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x18]
push 0x551440
call fcn.0054ab40
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
test byte [esp + 4], 1
je 0x485def
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0054a6b4
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x485e18
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x485e1e
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.0054ab46
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.00539490
test byte [esp + 0x30], 1
jne 0x485e9a
test byte [esp + 0xc], 1
jne 0x485ead
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x485e7a
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x485ec3
test byte [esp + 0x18], 1
jne 0x485ed6
test byte [esp + 0x44], 1
jne 0x485ee9
xor eax, eax
test byte [esp + 4], 1
jne 0x485efe
jmp 0x485f13
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x485e6d
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x485e75
jmp 0x485e7a
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x485e88
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x485e8f
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor eax, eax
test byte [esp + 4], 1
je 0x485f13
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x485f13
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x491b60
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x6c], eax
mov esi, dword [eax + 0x3c]
mov esi, dword [esi]
movzx esi, word [esi + 0x12]
rol si, 8
mov edi, dword [ebp + 0xc]
cmp si, 8
je 0x491cc2
movzx esi, si
cmp esi, 0xa4
je 0x491c03
mov dword [esp + 0xc], ebx
cmp esi, 0xb7
jne case.0x44e10b.220
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
mov esi, dword [ebp + 0xc]
adc esi, 0xffffffff
xor eax, eax
mov edi, 0xe
cmp edi, ebx
sbb eax, esi
jb case.0x44e10b.220
jmp dword [ebx*4 + 0x55f97c]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, edi
je 0x491d02
mov eax, ecx
xor eax, 0x70000002
or eax, edi
je 0x491d02
mov dword [esp + 0xc], ebx
mov eax, ecx
xor eax, 0x70000001
or eax, edi
mov ecx, esi
je case.0x44e10b.209
mov dword [esp + 0xc], ebx
mov eax, edi
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
adc eax, 0xffffffff
xor esi, esi
mov edi, 0x35
cmp edi, ebx
sbb esi, eax
jb case.0x44e10b.220
jmp dword [ebx*4 + 0x55f8a4]
mov ecx, esi
Function at 0x4c4220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, ecx
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
add ecx, 0x1d0
call fcn.004c3de0
mov edi, eax
xor esi, esi
cmp edx, esi
je 0x4c48eb
inc esi
mov ecx, dword [eax]
or ecx, dword [eax + 4]
lea eax, [eax + 0x10]
jne 0x4c4250
test esi, esi
je 0x4c48f5
shl esi, 4
add edi, 8
mov dword [esp + 0x7c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
nop dword [eax]
mov esi, edx
test esi, esi
jne 0x4c426b
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
jmp 0x4c4913
Function at 0x4c4f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x4c5110
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.0054aad4
test byte [esp + 4], 1
jne 0x4c4f5f
mov eax, dword [esp]
jmp 0x4c5103
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.0054aae6
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.0054ab52
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x18]
push 0x551440
call fcn.0054ab40
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
test byte [esp + 4], 1
je 0x4c4fdf
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0054a6b4
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x4c5008
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x4c500e
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.0054ab46
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.00539490
test byte [esp + 0x30], 1
jne 0x4c508a
test byte [esp + 0xc], 1
jne 0x4c509d
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4c506a
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x4c50b3
test byte [esp + 0x18], 1
jne 0x4c50c6
test byte [esp + 0x44], 1
jne 0x4c50d9
xor eax, eax
test byte [esp + 4], 1
jne 0x4c50ee
jmp 0x4c5103
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x4c505d
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4c5065
jmp 0x4c506a
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x4c5078
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x4c507f
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor eax, eax
test byte [esp + 4], 1
je 0x4c5103
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x4c5103
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d1530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x6c], eax
mov esi, dword [eax + 0x3c]
mov esi, dword [esi]
movzx esi, word [esi + 0x12]
mov edi, dword [ebp + 0xc]
cmp esi, 8
je 0x4d168a
cmp esi, 0xa4
je 0x4d15cb
mov dword [esp + 0xc], ebx
cmp esi, 0xb7
jne case.0x4c4336.47
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
mov esi, dword [ebp + 0xc]
adc esi, 0xffffffff
xor eax, eax
mov edi, 0xe
cmp edi, ebx
sbb eax, esi
jb case.0x4c4336.47
jmp dword [ebx*4 + 0x55fd4c]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, edi
je 0x4d16ca
mov eax, ecx
xor eax, 0x70000002
or eax, edi
je 0x4d16ca
mov dword [esp + 0xc], ebx
mov eax, ecx
xor eax, 0x70000001
or eax, edi
mov ecx, esi
je case.0x4c4336.36
mov dword [esp + 0xc], ebx
mov eax, edi
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
adc eax, 0xffffffff
xor esi, esi
mov edi, 0x35
cmp edi, ebx
sbb esi, eax
jb case.0x4c4336.47
jmp dword [ebx*4 + 0x55fc74]
mov ecx, esi
Function at 0x4d26b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, ecx
cmp byte [edx + 0x40], 0
je 0x4d26f0
mov ecx, edx
call fcn.004cd490
test edx, edx
je 0x4d26fa
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov ebp, edx
mov ebx, dword [edi + 8]
sub ebp, ecx
jbe 0x4d2753
and byte [esi + 8], 0xfe
lea ecx, [edi + ebx*8]
lea eax, [ecx + eax*4]
add eax, 0x10
mov dword [esi], eax
mov dword [esi + 4], ebp
jmp 0x4d274b
mov dword [esp + 0x20], str.no_dynamic_symbol_table_found
jmp 0x4d2702
mov dword [esp + 0x20], str.the_dynamic_symbol_table_is_empty
mov word [esp + 0x30], 0x103
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.0054a58e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x20]
mov dword [esp], eax
mov ecx, edi
call fcn.0054a3a8
sub esp, 0xc
or byte [esi + 8], 1
mov dword [esi], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x4d277d
lea edi, [edi + ebx*8]
add edi, 0x10
shl eax, 2
xor ebx, ebx
nop word cs:[eax + eax]
cmp dword [edi + ebx], 0
jne 0x4d2790
add ebx, 4
cmp eax, ebx
jne 0x4d2770
and byte [esi + 8], 0xfe
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x4d274b
mov dword [esp + 0x3c], str.the_first_hashed_symbol_index__
mov dword [esp + 0x44], ecx
mov word [esp + 0x4c], 0x903
lea eax, [esp + 0x3c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], str.__is_greater_than_or_equal_to_the_number_of_dynamic_symbols__
mov word [esp + 0x60], 0x302
lea eax, [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
mov word [esp + 0x1c], 0x902
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x5514e0
mov word [esp + 0x30], 0x302
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.0054a58e
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 3
movsd xmm0, qword [esp + 0x34]
jmp 0x4d272e
Function at 0x502ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, ecx
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
add ecx, 0x1d0
call fcn.005026a0
mov edi, eax
xor esi, esi
cmp edx, esi
je 0x50324b
inc esi
mov ecx, dword [eax]
or ecx, dword [eax + 4]
lea eax, [eax + 0x10]
jne 0x502b10
test esi, esi
je 0x503255
add edi, 8
shl esi, 4
mov dword [esp + 0x7c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
nop dword [eax]
mov esi, edx
test esi, esi
jne 0x502b2b
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
jmp 0x503273
Function at 0x503870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x503a80
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.0054aa8c
test byte [esp + 4], 1
jne 0x5038cf
mov eax, dword [esp]
jmp 0x503a73
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.0054aa9e
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.0054ab52
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x18]
push 0x551440
call fcn.0054ab40
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
test byte [esp + 4], 1
je 0x50394f
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0054a6b4
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x503978
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x50397e
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.0054ab46
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.00539490
test byte [esp + 0x30], 1
jne 0x5039fa
test byte [esp + 0xc], 1
jne 0x503a0d
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x5039da
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x503a23
test byte [esp + 0x18], 1
jne 0x503a36
test byte [esp + 0x44], 1
jne 0x503a49
xor eax, eax
test byte [esp + 4], 1
jne 0x503a5e
jmp 0x503a73
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x5039cd
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5039d5
jmp 0x5039da
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x5039e8
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x5039ef
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor eax, eax
test byte [esp + 4], 1
je 0x503a73
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x503a73
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5100c0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x6c], eax
mov esi, dword [eax + 0x3c]
mov esi, dword [esi]
movzx esi, word [esi + 0x12]
rol si, 8
mov edi, dword [ebp + 0xc]
cmp si, 8
je 0x510222
movzx esi, si
cmp esi, 0xa4
je 0x510163
mov dword [esp + 0xc], ebx
cmp esi, 0xb7
jne case.0x502c00.47
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
mov esi, dword [ebp + 0xc]
adc esi, 0xffffffff
xor eax, eax
mov edi, 0xe
cmp edi, ebx
sbb eax, esi
jb case.0x502c00.47
jmp dword [ebx*4 + 0x56011c]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, edi
je 0x510262
mov eax, ecx
xor eax, 0x70000002
or eax, edi
je 0x510262
mov dword [esp + 0xc], ebx
mov eax, ecx
xor eax, 0x70000001
or eax, edi
mov ecx, esi
je case.0x502c00.36
mov dword [esp + 0xc], ebx
mov eax, edi
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
adc eax, 0xffffffff
xor esi, esi
mov edi, 0x35
cmp edi, ebx
sbb esi, eax
jb case.0x502c00.47
jmp dword [ebx*4 + 0x560044]
mov ecx, esi
Function at 0x52e560
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
call fcn.0054a552
mov ecx, eax
call fcn.0052c910
call fcn.0054a53a
mov ecx, dword [0x5722b8]
mov edx, dword [0x5722bc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
movsd xmm0, qword [esp + 0x10]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0xc], 0
call fcn.0054a6c6
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0052e9a0
mov dword [esp], 0x563105
mov ecx, eax
call fcn.0043cb80
sub esp, 4
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x537ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 8], eax
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0xc], xmm0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
xor edi, edi
or ecx, eax
je 0x537d1e
mov ebx, esp
nop dword [eax + eax]
inc edi
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
jne 0x537d00
test edi, edi
je 0x537dc3
cmp edi, 0x15555556
jae 0x537dcd
lea ebp, [esp + 0x2c]
shl edi, 2
lea ebx, [edi + edi*2]
push ebx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov dword [esi], eax
mov dword [esi + 4], eax
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
movsd xmm0, qword [ebp]
movsd qword [esp], xmm0
lea eax, [esp + 0x38]
movsd xmm0, qword [eax]
movsd qword [esp + 0xc], xmm0
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
je 0x537dc0
mov ebx, esp
nop dword [eax]
mov eax, dword [esp + 8]
mov dword [edi + 8], eax
movsd xmm0, qword [esp]
movsd qword [edi], xmm0
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
add edi, 0xc
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
jne 0x537d90
mov dword [esi + 4], edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov ecx, esi
call fcn.00537f20
int3
Function at 0x5394b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x53967c
mov esi, dword [ebp + 0x10]
cmp ebx, esi
jae 0x539570
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], str.offset__0x
lea eax, [esp + 0x30]
mov dword [esp + 0x48], eax
mov word [esp + 0x50], 0xf03
lea eax, [esp + 0x40]
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], str.__is_past_the_end_of_the_contents__size_0x
mov word [esp + 0x64], 0x302
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x54]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x70], eax
mov word [esp + 0x78], 0xf02
lea eax, [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x565946
mov word [esp + 0x24], 0x302
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x539686
mov edx, dword [eax]
lea esi, [esp + 0x14]
lea ecx, [esp + 0x3c]
push esi
push eax
call dword [edx + 0x18]
jmp 0x53967c
jl 0x53967c
lea eax, [ebp + 8]
mov eax, dword [eax]
add ebx, eax
mov dword [esp + 0x10], eax
add esi, eax
mov dword [esp + 8], ebx
jmp 0x5395a3
mov edi, 1
mov esi, dword [esp + 0xc]
add esi, edi
cmp esi, ebx
ja 0x53967c
mov eax, ebx
sub eax, esi
push eax
push esi
call fcn.00549a90
add esp, 8
test eax, eax
mov dword [esp + 0xc], esi
je 0x539590
mov edi, eax
mov ebx, dword [esp + 4]
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
sub esi, dword [esp + 0x10]
mov dword [esp + 0x18], str.__6tx_
mov dword [esp + 0x14], 0x54c330
mov dword [esp + 0x1c], esi
mov ecx, eax
lea eax, [esp + 0x14]
push eax
call fcn.0054a3ea
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
mov ebx, eax
xor esi, esi
jmp 0x53960d
lea edx, [ecx + 1]
mov dword [ebx + 0x10], edx
mov byte [ecx], al
inc esi
cmp edi, esi
je 0x53963c
mov eax, dword [esp + 0xc]
movzx eax, byte [eax + esi]
mov ecx, eax
add cl, 0xe0
cmp cl, 0x5f
jb 0x539624
mov eax, 0x2e
mov ecx, dword [ebx + 0x10]
cmp ecx, dword [ebx + 0xc]
jb 0x539600
movzx eax, al
mov ecx, ebx
push eax
call fcn.0054a3c6
inc esi
cmp edi, esi
jne 0x53960d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
mov ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0xc]
jae 0x539660
lea edx, [ecx + 1]
mov dword [eax + 0x10], edx
mov byte [ecx], 0xa
jmp 0x539669
mov ecx, eax
push 0xa
call fcn.0054a3c6
mov ebx, dword [esp + 8]
inc edi
mov esi, dword [esp + 0xc]
add esi, edi
cmp esi, ebx
jbe 0x5395a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.0043e2e0
int3
Function at 0x549df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x549e01
jmp dword [eax*4 + 0x569460]
cmp dword [0x572118], 0
je 0x549f10
push 0x57211c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x572134]
test edi, edi
je 0x549f05
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x549e4b
mov edi, dword [edi + 8]
test edi, edi
je 0x549f05
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x549e40
test esi, esi
je 0x549e40
mov ecx, dword [edi + 4]
call dword [0x56952c]
push esi
call ecx
add esp, 4
jmp 0x549e40
call fcn.00549480
jmp case.default.0x549e01
cmp dword [0x572118], 0
je case.default.0x549e01
push 0x57211c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x572134]
test edi, edi
je 0x549ef8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x549eb7
mov edi, dword [edi + 8]
test edi, edi
je 0x549ef8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x549eb0
test esi, esi
je 0x549eb0
mov ecx, dword [edi + 4]
call dword [0x56952c]
push esi
call ecx
add esp, 4
jmp 0x549eb0
cmp dword [0x572118], 0
jne 0x549eec
push 0x57211c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x572118], 1
jmp case.default.0x549e01
push 0x57211c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x549e01
push 0x57211c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x572118]
cmp eax, 1
jne case.default.0x549e01
mov eax, dword [0x572134]
test eax, eax
je 0x549f42
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x549f30
mov dword [0x572134], 0
mov dword [0x572118], 0
push 0x57211c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x54a0a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x54b004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x54a106
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x54a106
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x54a106
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x54a106
mov edx, dword [esp + 0xc]
sub edx, dword [0x54b004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x54a0f6
add esi, 0x28
dec ecx
je 0x54a106
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x54a0f0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x54a0f0
mov eax, esi
pop esi
pop edi
ret