joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529e8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x529ebf
movzx eax, byte [ebx]
mov edx, dword [0x5811dc]
cmp al, byte [edx]
jne 0x529ebf
cmp dword [ebp + 8], 0x38
je 0x529ec9
mov eax, 0xfffffffa
jmp 0x52a08f
lea eax, [esi + 0x18]
call fcn.004053d4
cmp dword [esi + 0x20], 0
jne 0x529ee3
mov dword [esi + 0x20], 0x529d9c
xor eax, eax
mov dword [esi + 0x28], eax
cmp dword [esi + 0x24], 0
jne 0x529ef0
mov dword [esi + 0x24], 0x529d94
cmp dword [ebp - 4], 0xffffffff
jne 0x529efd
mov dword [ebp - 4], 6
test edi, edi
jge 0x529f0a
mov dword [ebp - 0xc], 1
neg edi
cmp dword [ebp + 0x14], 1
jl 0x529f3e
cmp dword [ebp + 0x14], 9
jg 0x529f3e
cmp dword [ebp - 8], 8
jne 0x529f3e
cmp edi, 8
jl 0x529f3e
cmp edi, 0xf
jg 0x529f3e
cmp dword [ebp - 4], 0
jl 0x529f3e
cmp dword [ebp - 4], 9
jg 0x529f3e
cmp dword [ebp + 0x10], 0
jl 0x529f3e
cmp dword [ebp + 0x10], 2
jle 0x529f48
mov eax, 0xfffffffe
jmp 0x52a08f
mov eax, esi
mov ecx, 0x16bc
mov edx, 1
call fcn.00529da8
mov ebx, eax
test ebx, ebx
jne 0x529f69
mov eax, 0xfffffffc
jmp 0x52a08f
mov dword [esi + 0x1c], ebx
mov dword [ebx], esi
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov eax, edi
mov dword [ebx + 0x28], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x24], edx
dec edx
mov dword [ebx + 0x2c], edx
mov eax, dword [ebp + 0x14]
add eax, 7
mov dword [ebx + 0x48], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x44], edx
dec edx
mov dword [ebx + 0x4c], edx
mov eax, dword [ebx + 0x48]
add eax, 3
dec eax
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebx + 0x50], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.00529da8
mov dword [ebx + 0x30], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.00529da8
mov dword [ebx + 0x38], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x44]
call fcn.00529da8
mov dword [ebx + 0x3c], eax
mov ecx, dword [ebp + 0x14]
add ecx, 6
mov edi, 1
shl edi, cl
mov dword [ebx + 0x1690], edi
mov eax, esi
mov ecx, 4
mov edx, edi
call fcn.00529da8
mov dword [ebx + 8], eax
mov edx, dword [ebx + 0x1690]
add edx, edx
add edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0x30], 0
je 0x52a034
cmp dword [ebx + 0x38], 0
je 0x52a034
cmp dword [ebx + 0x3c], 0
je 0x52a034
cmp dword [ebx + 8], 0
jne 0x52a04f
lea eax, [esi + 0x18]
mov edx, 0x581264
call fcn.00405638
mov eax, esi
call fcn.0052a43c
mov eax, 0xfffffffc
jmp 0x52a08f
mov edx, dword [ebx + 0x1690]
shr edx, 1
lea eax, [eax + edx*2]
mov dword [ebx + 0x1698], eax
mov eax, dword [ebx + 0x1690]
lea eax, [eax + eax*2]
mov edx, dword [ebx + 8]
lea eax, [edx + eax]
mov dword [ebx + 0x168c], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x78], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x7c], eax
movzx eax, byte [ebp - 8]
mov byte [ebx + 0x1d], al
mov eax, esi
call fcn.0052a0c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x52a740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x52a769
cmp dword [ebx + 0x64], 0
jne 0x52a769
cmp dword [ebx + 0x6c], 0
jne 0x52a769
mov esi, edi
jmp 0x52a7f5
cmp esi, 0xffffffff
jne 0x52a774
dec esi
jmp 0x52a7f5
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x52a7f5
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ecx, edi
call fcn.00529d84
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x52a7bd
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x52a7c2
mov word [edx], 0
dec eax
test eax, eax
jne 0x52a7a3
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x52a7e9
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x52a7ee
mov word [edx], 0
dec eax
test eax, eax
jne 0x52a7cf
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x52a853
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.0052a4b8
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x52a83e
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x52a853
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x52a749
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x52f234
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5a66a0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x52f256
shr eax, 1
xor eax, 0xedb88320
jmp 0x52f258
shr eax, 1
dec edx
jne 0x52f244
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x52f23d
mov byte [0x5a6aa0], 1
pop esi
pop ebx
ret

Function at 0x52f274
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5a6aa0], 0
jne 0x52f28b
call fcn.0052f234
mov eax, edi
dec eax
test eax, eax
jl 0x52f2b3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a66a0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x52f295
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x531720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5317ba.0
jmp dword [ecx*4 + 0x531753]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x531785
sub dl, 8
je 0x531794
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5313cc
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x531424
jmp case.0x5317ba.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5317ba.0
movzx ecx, byte [ecx + 0x5317c1]
jmp dword [ecx*4 + 0x5317d2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5314d0
jmp case.0x5317ba.0
cmp dl, 3
jne 0x5317ff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x531524
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5314e0
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x531568
jmp case.0x5317ba.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x53182a
sub dl, 8
je 0x531836
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x531594
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x531600
jmp case.0x5317ba.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x531855
sub dl, 8
je 0x531861
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5316bc
jmp case.0x5317ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5316e4
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x531905
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00530960
test eax, eax
je 0x531905
mov eax, ebx
call fcn.00531910
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x53189e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x531910
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x531941
dec al
je 0x53197c
dec al
je 0x5319c1
dec al
je 0x531a2a
jmp 0x531ab4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x531ab4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x531951
jmp 0x531ab4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x531ab4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x53198c
jmp 0x531ab4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x531ab4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5319f0
xor ebp, ebp
jmp 0x531a00
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x531a09
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5319d1
jmp 0x531ab4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x531ab4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x531a83
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0052f2bc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x531a3e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53ca10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x53ca25
add esp, 0xfffffff0
call fcn.004046f4
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x53cb00
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00536720
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041b2b0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041b2b0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041b2b0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041b2b0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041b2d8
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53cb07
lea eax, [ebp - 4]
call fcn.004053d4
ret
Function at 0x542bac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x542d23
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x542d3c
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00405428
push 0xffffffffffffffff
mov ecx, 0x542d4c
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x542d68
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x34], eax
mov ecx, 0x542d88
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00557c68
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x542da4
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00557b54
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x542db8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00557b54
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x542dd0
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00557b54
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x542dec
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00557c68
mov byte [ebx + 0x48], al
mov ecx, 0x542e00
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0053626c
mov byte [ebx + 0x49], al
push 0xffffffffffffffff
mov ecx, 0x542e14
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x4c], eax
push 0xffffffffffffffff
mov ecx, 0x542e34
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x50], eax
push 0
mov ecx, 0x542e58
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x54], eax
push 0
mov ecx, 0x542e74
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x58], eax
push 0xff
mov ecx, 0x542e90
mov edx, dword [ebx + 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542d2a
lea eax, [ebp - 4]
call fcn.004053d4
ret
Function at 0x55cd80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x55cda4
cmp eax, 0
jbe 0x55cead
jmp 0x55cdaa
jle 0x55cead
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.00403b70
mov eax, dword [ebp + 8]
lea edx, [eax - 0x13c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x55cead
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x55cead
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x55cead
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x55cead
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x55cead
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x55cead
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x55cead
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x55cead
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x55d4fc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf6]
test ax, ax
jbe 0x55d5dc
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x55d5da
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x55d572
test eax, 0x40000000
je 0x55d55e
test eax, 0x80000000
je 0x55d559
or edx, 0x40
jmp 0x55d599
or edx, 0x20
jmp 0x55d599
test eax, 0x80000000
je 0x55d56d
or edx, 0x80
jmp 0x55d599
or edx, 0x10
jmp 0x55d599
test eax, 0x40000000
je 0x55d58a
test eax, 0x80000000
je 0x55d585
or edx, 4
jmp 0x55d599
or edx, 2
jmp 0x55d599
test eax, 0x80000000
je 0x55d596
or edx, 8
jmp 0x55d599
or edx, 1
test eax, 0x4000000
je 0x55d5a6
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call sub.kernel32.dll_VirtualProtect
inc ebx
dec dword [ebp - 4]
jne 0x55d52c
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x55efb8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b70
ret

Function at 0x560f14
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x560f8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b2b4
mov eax, dword [ebp - 8]
call fcn.00405864
push eax
call sub.IMAGEHLP.DLL_MakeSureDirectoryPathExists
push 0
mov eax, dword [ebp - 4]
call fcn.00405864
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00405864
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560f96
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053f8
ret
Function at 0x566ec0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x56700a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x566fe2
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040b690
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x566fcb
mov edx, dword [eax + 0xc]
test edx, edx
je 0x566fc5
mov ebx, dword [edx]
test ebx, ebx
je 0x566fbf
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x567024
call fcn.0040c09c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00405428
mov byte [ebp - 5], 1
jmp 0x566fcf
mov byte [ebp - 5], 0
jmp 0x566fcf
mov byte [ebp - 5], 0
jmp 0x566fcf
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566fe9
call sub.wsock32.dll_WSACleanup
ret

Function at 0x568258
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x599f38]
mov eax, dword [eax]
call fcn.00405864
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x3cc], esi
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x3d0], edi
test edi, edi
je 0x5682ad
mov eax, ebx
call fcn.0046051c
mov edx, dword [ebx + 0x3d0]
mov dword [edx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x568850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x5688f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00408858
mov word [ebp - 0x18], 5
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0040b2b4
mov eax, dword [ebp - 0x5c]
call fcn.00405864
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405864
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x5688d7
mov ebx, dword [ebp - 0x50]
jmp 0x5688da
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5688ff
lea eax, [ebp - 0x5c]
call fcn.004053d4
lea eax, [ebp - 4]
call fcn.004053d4
ret