joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f318b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x4f31b1
call fcn.004e998c
jmp 0x4f31dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e8e68
mov eax, dword [esi + 0x180]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4f31dd
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc

Function at 0x4f6ec7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x4f6f28
sub eax, 1
je 0x4f6f0a
sub eax, 3
je 0x4f6f0a
test dword [edi + 0x370], 0x2000
je 0x4f6f43
push esi
call fcn.0053a814
pop ecx
test eax, eax
jne 0x4f6f43
cmp esi, 0x2d
je 0x4f6f43
cmp esi, 0x2e
je 0x4f6f43
cmp esi, 0x2c
je 0x4f6f43
jmp 0x4f6f5e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4f6f43
test dword [edi + 0x370], 0x1000
jmp 0x4f6f41
test byte [edi + 0x374], 0x80
jne 0x4f6f43
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4f6f5e
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f71cb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x2c]
push edi
push esi
call fcn.004e5aa9
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x2c], 0x59df18
mov dword [ebp - 0x24], 0x59f98c
mov byte [ebp - 4], bl
mov dword [ebp - 0xc], edi
call dword [eax + 0x94]
cmp byte [ebp - 4], bl
jne 0x4f7234
cmp edi, 0xd
jne 0x4f7239
test dword [esi + 0x370], 0x1000
jne 0x4f7239
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4f7239
mov dword [esi + 0x10], ebx
jmp 0x4f7253
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f92da
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00530990
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x4f9335
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x4f9349
cmp byte [ebp - 6], 1
jne 0x4f9349
cmp dword [ebp - 0x11c], 6
jne 0x4f9349
xor eax, eax
inc eax
jmp 0x4f934b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a0111
mov esp, ebp
pop ebp
ret

Function at 0x4fc3fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x58fb74
push dword [ebp + 8]
call fcn.00538b63
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4fc457
push ebx
push edi
push esi
call fcn.00537c7d
push eax
call fcn.0054c9fd
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x4fc436
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x4fc44c
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.00538641
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.00537917
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x500ba2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
xor eax, eax
cmp ax, bx
jge 0x500c48
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
inc edx
mov eax, dword [edi]
push 0
push ecx
push edx
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x500c10
mov ecx, edi
call fcn.00501f2b
mov ecx, dword [ebp - 4]
inc esi
push 1
pop edx
cmp si, bx
jl 0x500beb
cmp si, bx
jge 0x500c48
push dword [ebp + 0x14]
or eax, 0xffffffff
mov ecx, ebx
push dword [ebp + 0x10]
sub ecx, esi
cmp word [ebp + 0xc], 0
push 1
pop edx
cmovg eax, edx
movsx ecx, cx
cwde
imul ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.004e8ff0
test bx, bx
je 0x500c87
mov ecx, edi
call fcn.004e6e22
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5049a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x5049ad
xor eax, eax
jmp 0x5049db
push dword [ecx + 4]
call fcn.004fff21
pop ecx
test eax, eax
je 0x5049c8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x5049a9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4

Function at 0x504ac9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.005049a0
test eax, eax
je 0x504afe
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.00504535
xor eax, eax
inc eax
jmp 0x504bfb
push esi
push dword [ebx + 4]
call fcn.004fff21
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x504ba8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x504ba8
cmp edi, 0x25
je 0x504b38
cmp edi, 0x27
je 0x504b46
cmp edi, 0x26
je 0x504b38
cmp edi, 0x28
jne 0x504ba8
cmp edi, 0x27
je 0x504b46
cmp edi, 0x28
je 0x504b46
push 2
jmp 0x504b48
push 3
pop edi
jmp 0x504b56
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x504b92
push edi
mov ecx, esi
call fcn.004e7651
mov esi, eax
test esi, esi
jne 0x504b4b
mov ecx, dword [ebp - 4]
cmp edi, 3
setne al
push eax
call fcn.004e7346
mov ecx, eax
jmp 0x504b85
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x504b92
push edi
mov ecx, esi
call fcn.004e7651
mov esi, eax
test esi, esi
jne 0x504b77
jmp 0x504ba3
push 1
mov ecx, esi
call fcn.004e7585
push eax
mov ecx, ebx
call fcn.00504e4e
xor eax, eax
inc eax
jmp 0x504bfa
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.00506a7d
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.00504c4f
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call fcn.00401b00
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50accb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x50acee
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x50ad8b
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.0050a8e1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x50ad11
push ebx
call fcn.00537917
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x50ad67
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x5d42b4]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x50ad3c
call fcn.00537917
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x50ad67
push esi
push 1
push eax
call fcn.00538641
push ebx
mov esi, eax
call fcn.00537917
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x50ad70
push dword [ebp - 4]
call dword [0x5d42b8]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x50ad8a
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0050ac76
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5121c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5121e2
xor eax, eax
jmp 0x512241
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x5121de
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5121de
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x5121de
push edi
mov ecx, ebx
call fcn.00511d17
push dword [ebp + 0x10]
lea ecx, [ebx + 4]
push dword [ebp + 8]
call fcn.00511cf9
mov ecx, ebx
mov dword [ebx], esi
call fcn.0051229d
test eax, eax
jne 0x512240
xor ecx, ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], ecx
or dword [ebx], 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5124d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0xc
pop edi
mov eax, dword [esi]
sub eax, edi
mov dword [ebp - 4], ebx
push eax
call fcn.004a0398
mov dword [ebp + 0xc], eax
pop ecx
test eax, eax
je 0x51254d
cmp dword [esi], edi
jbe 0x512537
movzx eax, word [ebx + 0x18]
mov ecx, dword [ebp - 4]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr ebx, 8
xor bl, byte [eax + edi]
mov byte [ebp - 8], bl
push dword [ebp - 8]
call fcn.0051266a
mov eax, dword [ebp + 0xc]
mov byte [eax + edi - 0xc], bl
inc edi
mov ebx, dword [ebp - 4]
cmp edi, dword [esi]
jb 0x512500
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.004a0163
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
xor eax, eax
add dword [esi], 0xfffffff4
inc eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x512598
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5d406c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xc
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
jae 0x5125b9
xor eax, eax
jmp 0x512601
push edi
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
xor esi, esi
push ebx
movzx eax, word [ecx + 0x18]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
shr ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov byte [ebp - 0x14], bl
push dword [ebp - 0x14]
call fcn.0051266a
mov ecx, dword [ebp - 0x18]
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xc
jl 0x5125c4
mov ecx, dword [ebp + 0x10]
xor eax, eax
shr ecx, 0x18
cmp byte [ebp - 5], cl
pop ebx
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a0111
mov esp, ebp
pop ebp
ret 0xc

Function at 0x51266a
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x10]
xor eax, edx
mov esi, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
movzx eax, al
shr edx, 8
mov eax, dword [esi + eax*4]
xor eax, edx
mov dword [edi + 0x10], eax
movzx eax, al
add eax, dword [edi + 0x14]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 0x14], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [esi + eax*4]
mov dword [edi + 0x18], ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x5134e7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [0x79ab78], 0x40
jae 0x5135cc
mov ecx, dword [ebp + 8]
mov edx, 0xfff80000
push esi
mov esi, dword [ebp + 0xc]
add esi, ecx
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 4]
cmovb edi, eax
cmp edi, esi
jae 0x5135ca
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [0x58ee64]
test eax, eax
je 0x5135a5
cmp dword [ebp - 0x10], 0x10000
jne 0x513599
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x51359c
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x51359c
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [0x58ee5c]
mov ebx, eax
test ebx, ebx
jne 0x5135a9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x51354e
test ebx, ebx
je 0x5135ca
xor eax, eax
cmp dword [eax*4 + 0x79aa78], 0
je 0x5135bd
inc eax
cmp eax, 0x40
jb 0x5135ab
jmp 0x5135ca
inc dword [0x79ab78]
mov dword [eax*4 + 0x79aa78], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522a8f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x248
mov eax, 0x58b94c
call fcn.004a0767
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00530990
add esp, 0xc
cmp dword [ebp + 8], 0xffffffff
je 0x522acd
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x254]
call fcn.004052a0
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041a8d0
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x522af8
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
push 1
lea ecx, [ebp - 0x248]
call fcn.00405c70
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004053a0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0057cb0e
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00405350
push esi
push 1
lea ecx, [ebp - 0x248]
call fcn.00405c70
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x249]
cmovae ecx, dword [ebp - 0x230]
push edx
lea edx, [ebp - 0x24a]
mov byte [ebp - 0x249], 0x5c
push edx
lea eax, [ecx + eax*2]
mov byte [ebp - 0x24a], 0x2f
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push eax
push ecx
call fcn.0051f5ef
add esp, 0x10
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
push 1
lea ecx, [ebp - 0x230]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.00405c70
mov al, bl
call fcn.004a0711
ret 8

Function at 0x52ce3d
Capabilities:
Create thread

Disassembly:
push esi
push 0x79aec8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
push eax
push eax
push eax
push 0x52d0c0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x79aec4], eax
mov eax, esi
pop esi
ret

Function at 0x552369
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055202c

Function at 0x552374
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005521ad

Function at 0x556a56
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00556716
Function at 0x55d95b
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x58d200
call fcn.004a0767
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x55da78
cmp byte [ebx + 0x3e], 0
je 0x55da78
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004a080f
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x55d9a7
xor al, al
jmp 0x55da7a
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004132f0
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x55d9d7
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004a080f
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x55da0c
sub eax, 1
je 0x55da10
dec eax
sub eax, 1
je 0x55da66
xor bl, bl
jmp 0x55da68
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x55da20
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x55da48
cmp eax, 0x10
jae 0x55da2f
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00537edb
add esp, 0x10
cmp esi, eax
jne 0x55da08
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x55da66
test esi, esi
jne 0x55d9cb
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413e70
jmp 0x55d9c5
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00406120
mov al, bl
jmp 0x55da7a
mov al, 1
call fcn.004a0711
ret
Function at 0x55dbe9
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x58d22d
call fcn.004a0767
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x55dc0e
xor eax, eax
jmp 0x55dd87
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x55dc3a
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x55dc3a
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x55dd87
cmp dword [esi + 0x4c], 0
je 0x55dd84
mov ecx, esi
call fcn.0055dafe
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x55dc6d
push dword [esi + 0x4c]
push edi
call fcn.0055d7dd
pop ecx
pop ecx
test al, al
je 0x55dd84
movzx ebx, di
jmp 0x55dd84
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004132f0
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x55dca5
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.004a080f
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x55dd78
cmp eax, 1
jg 0x55dd53
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x55dcee
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x55dd1b
cmp eax, 0x10
jae 0x55dcfd
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00537edb
add esp, 0x10
cmp edi, eax
jne 0x55dd4e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x55dd1e
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x55dd48
test edi, edi
jne 0x55dc99
cmp dword [ebp - 0x18], 0x20
jae 0x55dd72
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413e70
jmp 0x55dc93
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x55dd72
cmp eax, 3
jne 0x55dd78
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.0055d7dd
pop ecx
pop ecx
test al, al
je 0x55dd72
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00406120
mov ax, bx
call fcn.004a0711
ret 4
Function at 0x5607be
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5607cb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005607d7

Function at 0x5620bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
push esi
push edi
sub eax, 0
je 0x562139
sub eax, 1
je 0x56212a
sub eax, 1
je 0x56211b
sub eax, 1
je 0x562103
sub eax, 1
je 0x5620f6
sub eax, 1
jne 0x56214f
cmp byte [ecx], 0
mov eax, str.true
mov edx, str.false
cmove eax, edx
push eax
jmp 0x56213e
cmp dword [ecx], 0
mov eax, 0x5bd6e4
cmovne eax, dword [ecx]
jmp 0x5620f3
movsd xmm0, qword [ecx]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp + 8]
call fcn.00563f18
add esp, 0xc
jmp 0x562146
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.0056401a
jmp 0x562116
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.00563faf
jmp 0x562116
push 0x5bd6e4
mov ecx, dword [ebp + 8]
call fcn.00405560
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4
push 8
pop ecx
mov esi, 0x5b3b10
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
call fcn.005332d8
int3

Function at 0x562189
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x5621a5
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x56219c
sub esi, ecx
mov eax, accept
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.0053aced
mov edi, eax
pop ecx
test edi, edi
je 0x5621da
push esi
push dword [ebp + 8]
push edi
call fcn.0052ff50
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
push 9
pop ecx
mov esi, str.Failed_to_allocate_string_value_buffer
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.005332d8
int3