joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3ed0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4f403c
cmp byte [esi], 0
je 0x4f403c
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
xor ebx, ebx
xor edi, edi
cmp eax, 5
jle 0x4f3fc3
push esi
call fcn.004cb2d0
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x4f4039
push ebp
call fcn.004cb420
mov esi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x4f3f4e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push eax
call fcn.004cb530
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ebp, [esi + esi*2 + 1]
push ebp
call fcn.0043f000
mov edi, eax
add esp, 4
test edi, edi
je 0x4f3fb0
mov ecx, dword [esp + 0x14]
push 0
push 0
push ebp
push edi
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push 0x2002
mov byte [eax + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f3fa7
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4f3f96
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.0043f020
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.0043f020
mov edi, dword [esp + 0x1c]
add esp, 4
jmp 0x4f4001
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f3fc8
sub eax, edx
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f4039
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4f3ff0
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4f3ff0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x4f4009
test edi, edi
je 0x4f4039
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4f4039
call dword [sym.imp.USER32.dll_EmptyClipboard]
test edi, edi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x4f402a
push edi
push 0xd
call esi
test ebx, ebx
je 0x4f4033
push ebx
push 1
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
pop esi
ret 8

Function at 0x4f4040
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
xor esi, esi
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4f407d
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
test eax, eax
jne 0x4f4071
push 0xd
call edi
test eax, eax
jne 0x4f4071
mov eax, dword [ebx]
push eax
call edi
test eax, eax
je 0x4f4076
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4f6e30
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4f6e55
mov al, byte [esi + 1]
inc esi
cmp al, 0x22
je 0x4f6e52
test al, al
jne 0x4f6e42
cmp al, 0x22
jne 0x4f6e68
inc esi
jmp 0x4f6e68
cmp al, 0x20
jbe 0x4f6e68
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
ja 0x4f6e60
mov al, byte [esi]
test al, al
je 0x4f6e7c
mov edi, edi
cmp al, 0x20
ja 0x4f6e7c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4f6e70
lea eax, [esp + 4]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x30], 1
movzx eax, word [esp + 0x34]
jne 0x4f6ea0
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4f7fa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0043ac20
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0x9f8]
push str.defaultcamera
call fcn.005039d0
mov dword [esp + 0x18], ebx
push 0xa
push ebx
call fcn.004a4fe0
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x81c]
add esp, 8
push esi
call fcn.00517420
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x81c]
push esi
call fcn.00517600
push esi
mov edi, eax
call fcn.0043f020
add esp, 4
test edi, edi
je 0x4f8127
mov ecx, dword [ebp]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0xa0]
mov dword [esp + 0x18], 2
call fcn.00517f50
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4f806e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.0046c660
mov ecx, eax
call fcn.0043b3a0
test al, al
je 0x4f80f4
mov dword [esp + 0x1c], ebx
jmp 0x4f8127
lea ecx, [esp + 0x10]
call fcn.0046c760
mov edi, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f8080
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x4f80a7
mov cl, byte [eax + edi]
movzx edx, cl
mov dl, byte [edx + 0x5da1c8]
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x4f8091
mov eax, dword [0x5e4940]
xor ebx, ebx
test eax, eax
je 0x4f80e3
mov eax, 0x5e4940
mov esi, eax
lea esp, [esp]
mov eax, dword [eax]
push eax
push edi
call fcn.0043a560
add esp, 8
test eax, eax
jne 0x4f80de
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
mov eax, esi
jne 0x4f80c0
jmp 0x4f80e3
mov ebx, 1
push edi
call fcn.0043f020
add esp, 4
test ebx, ebx
je 0x4f8107
mov ebx, dword [esp + 0x18]
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x18], ebx
jl 0x4f7fd8
jmp 0x4f8127
mov ecx, dword [ebp]
mov ecx, dword [ecx + 0x9f8]
lea eax, [esp + 0x10]
push eax
push str.defaultcamera
call fcn.00502ab0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
push 0xa
push eax
call fcn.004a4fe0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5057a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov al, byte [edi]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cmp al, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
je 0x5057f8
nop
movzx esi, al
movzx eax, byte [esi + 0x5da1c8]
xor eax, esi
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
add esi, eax
mov ecx, esi
mov esi, edx
shr esi, 0x1a
shl edx, 6
or esi, edx
add esi, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov edx, esi
jne 0x5057c0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
call fcn.0043f020
add esp, 4
push 0x5e50ec
mov ecx, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.0043a000
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x10]
mov edi, 8
lea esp, [esp]
mov ecx, esi
shr ecx, 0x1c
push ecx
call fcn.00439ad0
add esp, 4
push eax
mov ecx, ebp
call fcn.00439c40
shl esi, 4
dec edi
jne 0x505830
inc ebx
cmp ebx, 2
jl 0x505820
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x517420
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xe8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x20]
call fcn.004a4900
mov eax, dword [esp + 0xfc]
push eax
call fcn.0043a350
mov ebp, eax
mov eax, dword [ebx + 0x2c]
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [esp + 0x1c], ebp
jne 0x5174cb
mov eax, dword [ebx + 0x18]
cmp eax, esi
lea edi, [ebx + 0x18]
je 0x51746d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x10]
push edx
push 0x5ec994
push 1
push esi
push 0x5e5824
mov dword [esp + 0x24], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x5174af
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
push edi
push 0x5e5814
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
call dword [edx + 8]
push esi
push 0x5e4970
call fcn.0043a350
add esp, 4
push eax
mov ecx, ebx
call fcn.00517380
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], esi
mov edi, dword [ebx + 0x20]
cmp edi, dword [ebx + 0x1c]
jge 0x5175d2
mov eax, dword [ebx + 0x2c]
dec eax
cmp ebp, eax
jle 0x5175d2
mov dword [esp + 0x14], edi
inc dword [ebx + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edi
mov ecx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
call fcn.00517380
cmp eax, edi
jne 0x517519
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push ecx
push 0x5ec944
push esi
push esi
push eax
call dword [edx + 0x20]
cmp dword [esp + 0x10], esi
je 0x5175af
mov eax, dword [ebx + 0x28]
cmp eax, esi
lea ebp, [ebx + 0x28]
je 0x517538
lea ecx, [ecx]
mov ebp, dword [ebp]
cmp dword [ebp], esi
jne 0x517530
mov edx, dword [ebx + 0x2c]
push 0xa
push edx
call fcn.004a4fe0
push 0xa8
mov edi, eax
call fcn.0043f000
add esp, 0xc
cmp eax, esi
je 0x517560
push edi
mov ecx, eax
call fcn.004f7840
mov esi, eax
push edi
call fcn.0043f020
push 0x40
call fcn.0043f000
add esp, 8
test eax, eax
je 0x517587
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x24]
push ecx
push esi
push edx
mov ecx, eax
call fcn.00516f30
jmp 0x517589
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp], eax
call fcn.004f8170
mov esi, dword [ebx + 0x2c]
mov eax, dword [esp + 0x10]
inc esi
mov dword [ebx + 0x2c], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
xor esi, esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x5175bd
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebp, dword [ebx + 0x2c]
jl 0x5175d2
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x5174e7
mov ecx, 0x1b
lea esi, [esp + 0x20]
lea edi, [esp + 0x8c]
rep movsd dword es:[edi], dword [esi]
frstor dword [esp + 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe8
ret 4
Function at 0x519500
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], edi
jne 0x519520
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0xc]
push ecx
push 0x20000013
push eax
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x51967b
mov ecx, dword [esi + 0x28]
push ebx
push edi
push edi
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], edi
xor ebx, ebx
call dword [0x636504]
test eax, eax
je 0x519608
push ebp
nop
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x519607
lea edx, [ebx + eax + 1]
push edx
mov dword [esp + 0x1c], edi
call fcn.0043f000
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x519607
cmp ebx, edi
jbe 0x5195b0
mov esi, dword [esi + 0x10]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
lea ecx, [esp + 0x18]
push ecx
push edx
lea edi, [ebx + ebp]
push edi
push eax
call dword [0x636508]
test eax, eax
je 0x5195e1
mov ecx, dword [esp + 0x10]
mov byte [edi + ecx], 0
push ebp
lea ecx, [esi + 0x10]
call fcn.00439b30
add ebx, dword [esp + 0x18]
push ebp
call fcn.0043f020
mov eax, dword [esi + 0x28]
add esp, 4
push 0
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [0x636504]
xor edi, edi
test eax, eax
jne 0x519570
pop ebp
mov eax, dword [esi + 0xc]
cmp eax, 0x197
pop ebx
je 0x519653
cmp eax, 0x191
je 0x519653
cmp eax, 0x12c
jb 0x51963a
cmp eax, 0x190
jae 0x51963f
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
cmp eax, 0x190
jbe 0x51967b
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
mov ecx, dword [esi + 0x28]
push edi
push 7
push 0x2eee
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [0x636510]
xor edx, edx
cmp eax, 0x2f00
sete dl
inc edx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
Function at 0x51a150
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
push esi
add ecx, 0x24
call fcn.0051a660
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
inc esi
mov dword [esp + 8], esi
mov byte [eax], 0
je 0x51a266
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x51a23b
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x51a23b
push ebx
mov byte [eax], 1
mov ebx, dword [ebp + 0x24c]
push edi
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
dec esi
mov eax, esi
xor ecx, ecx
test eax, eax
mov dword [ebp + 0x28c], esi
jle 0x51a1f3
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
inc ecx
add eax, 4
cmp ecx, edx
jl 0x51a1e0
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
test al, al
pop edi
pop ebx
je 0x51a231
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x51a25e
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
pop esi
mov byte [ebp + 0x2a9], 0
pop ebp
pop ecx
ret 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x51a450
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
add ecx, 0x9c
push ecx
call fcn.00519cc0
mov edx, dword [esp + 0x30]
lea ebx, [edi + 8]
add esp, 8
mov dword [edi + 0x28c], 0
mov byte [edi + 0x2a8], 0
mov dword [edi + 0x48], edx
mov esi, ebx
mov ebp, 0x10
mov eax, dword [esp + 0x28]
push eax
call fcn.0043f000
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebp
jne 0x51a492
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x50]
push 0x30000
push edi
push 0x51a430
lea ecx, [esp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x51a52b
xor ebp, ebp
lea esi, [edi + 0x4c]
mov edi, edi
xor ecx, ecx
mov edx, esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx]
mov ecx, dword [esp + 0x28]
push 0x20
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebp
mov edx, dword [edi]
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [edi]
push 0x20
push esi
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
inc ebp
add ebx, 4
add esi, 0x20
cmp ebp, 0x10
jl 0x51a4d0
mov byte [edi + 0x2a9], 1
mov byte [edi + 0x2aa], 0
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0x14
ret 4

Function at 0x51a5c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1c]
test eax, eax
push esi
je 0x51a623
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x51a5f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x51a750
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edi, edi
test ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
je 0x51a78a
mov dword [esi + 0x28], ebx
jmp 0x51a7a2
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x51a710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
je 0x51a7b0
dec eax
jne 0x51a7b9
push 1
jmp 0x51a7b2
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test ebx, ebx
jne 0x51a7c8
test edi, edi
je 0x51a7c8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x51bbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov byte [eax], 0
mov eax, dword [edi]
xor esi, esi
test eax, eax
mov dword [esp + 8], edi
je 0x51bcde
call fcn.0051baa0
mov eax, dword [edi]
test eax, eax
je 0x51bbf1
mov byte [eax + 0x18], 0
mov eax, dword [eax]
test eax, eax
jne 0x51bbe7
push ebx
push ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x51bcdc
lea ecx, [ecx]
mov al, byte [ecx + 0x18]
test al, al
jne 0x51bc2f
test esi, esi
je 0x51bc2d
fild dword [edi + 0x78]
fild dword [ecx + 0x14]
fild dword [ecx + 0x10]
fdiv st(2)
fdivp st(1)
fild dword [esi + 0x14]
fild dword [esi + 0x10]
fdiv st(3)
fdivp st(1)
fcompp
fnstsw ax
fstp st(0)
test ah, 0x41
jne 0x51bc2f
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x51bc00
test esi, esi
je 0x51bcdc
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x51bca2
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ebp, [esi + 0x3c]
push ebp
lea ecx, [esi + 0x38]
push ecx
push edx
push eax
call dword [esi + 4]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x51bc79
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [esi + 0x1a], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp + 0x10]
test ebx, ebx
mov dword [esi + 0x34], ebx
je 0x51bc90
mov ecx, dword [esp + 0x18]
mov byte [ecx], 1
mov edx, dword [edi + 0xa0]
sub dword [ebp], edx
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x51bca2
mov byte [esi + 0x18], 1
xor esi, esi
jmp 0x51bbf3
inc dword [esi + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x51bcc3
mov ecx, dword [edi + 0x74]
movsx ecx, byte [ecx + edi + 0x10]
cmp dword [eax + 0x44], ecx
je 0x51bcc0
mov eax, dword [eax]
test eax, eax
jne 0x51bcb3
jmp 0x51bcc3
dec dword [eax + 0x14]
mov edx, dword [edi + 0x74]
mov al, byte [esi + 0x44]
mov byte [edx + edi + 0x10], al
mov eax, dword [edi + 0x74]
inc eax
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi + 0x74], edx
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x55e710
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [esp + 0x10]
cmp eax, 3
mov ecx, 0x9e3779b9
push edi
mov ebp, eax
mov edi, ecx
mov esi, edx
jb 0x55e7b1
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
add ecx, dword [ebx + 4]
add esi, dword [ebx + 8]
mov eax, dword [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 0xc
sub ebp, 3
dec edx
jne 0x55e737
mov eax, dword [esp + 0x14]
add esi, eax
dec ebp
je 0x55e7bc
dec ebp
jne 0x55e7be
add ecx, dword [ebx + 4]
add edi, dword [ebx]
sub edi, esi
sub edi, ecx
sub ecx, esi
mov edx, esi
shr edx, 0xd
xor edi, edx
sub ecx, edi
mov eax, edi
shl eax, 8
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 0xd
xor esi, edx
sub edi, esi
sub edi, ecx
mov eax, esi
shr eax, 0xc
xor edi, eax
sub ecx, esi
sub ecx, edi
mov edx, edi
shl edx, 0x10
xor ecx, edx
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 5
xor esi, eax
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
mov edx, edi
sub ecx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
pop esi
shr ecx, 0xf
pop ebp
xor eax, ecx
pop ebx
ret
Function at 0x55ece0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x55edfd
push ebx
mov ebx, dword [edi + 0x20]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebx
mov edx, 0x12311998
mov eax, ebp
call fcn.0055e710
and eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + eax*8]
add esp, 4
test esi, esi
je 0x55edfa
xor eax, eax
test ebx, ebx
lea ecx, [esi + 0x14]
jbe 0x55ed31
mov edx, dword [ecx]
add ecx, 4
cmp edx, dword [ebp + eax*4]
jne 0x55ed86
inc eax
cmp eax, ebx
jb 0x55ed21
cmp dword [edi + 0x34], esi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
jne 0x55ed3f
mov dword [edi + 0x34], eax
cmp dword [edi + 0x38], esi
jne 0x55ed47
mov dword [edi + 0x38], ecx
test eax, eax
je 0x55ed4e
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x55ed55
mov dword [ecx + 8], eax
mov eax, dword [esi]
test eax, eax
je 0x55ed61
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x55ed6c
mov edx, dword [esi]
mov dword [eax], edx
mov ecx, dword [edi + 0x18]
test ecx, ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x14]
jne 0x55ed91
push eax
push ebx
call fcn.005586e0
add esp, 8
jmp 0x55edb3
mov esi, dword [esi]
test esi, esi
jne 0x55ed18
pop esi
pop ebp
pop ebx
pop edi
ret
mov cx, word [eax]
movzx edx, word [eax + 4]
neg cx
sbb ecx, ecx
and ecx, 3
inc ecx
imul ecx, edx
movzx edx, word [eax + 2]
movzx eax, word [eax + 6]
imul ecx, edx
lea eax, [ecx + eax*4 + 0x14]
mov ecx, dword [edi + 0x2c]
mov ebp, dword [edi + 4]
mov edx, dword [edi + 0xc]
add ecx, eax
sub ebp, ecx
mov ecx, dword [edi + 0x18]
dec edx
test ecx, ecx
mov dword [edi + 4], ebp
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x10]
push eax
push ebx
jne 0x55ede9
call fcn.005586d0
add esp, 8
push esi
call fcn.0043f020
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret
call fcn.0055e6f0
add esp, 8
push esi
call fcn.0043f020
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret