joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577e85
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
dec eax
rol ebx, 0x16
xchg esi, edx
add esi, dword [0x857812]
mov dword [0x86ebbe], ebx
mov ebx, dword [0x8568bb]
rol ebx, 0xa
shl edx, 0x15
add dword [0x86eb37], edx
or esi, edx
call fcn.007913cb
xor edx, edi
not ebx
dec ecx
jne fcn.00577c39
or dword [0x86e9c3], ecx
call fcn.00526389
inc ecx
xchg ebx, esi
cmp esi, 0x78111ca7
jno 0x577c84
not ebx
dec eax
and ecx, ecx
dec ebx
rol edi, 3
mov ecx, edi
mov eax, 0xc1ccdbc8
and dword [0x86eac7], ebx
sub esi, dword [0x86ef5b]
add dword [0x86e9c8], 0xc10b2729
mov dword [0x86eb29], 0xfeb9825f
sub ebx, dword [0x86ef48]
call fcn.0077720a
ror ecx, 0xc
xor edi, edx
ror ebx, 0x12
call fcn.0062f5b2
add dword [0x86eaba], esi
or dword [0x86ec4e], edi
add dword [0x86e9c8], esi
call fcn.00515219
rol ebx, 0x12
xor edi, edx
rol ecx, 0xc
xor dword [0x86ebfc], 0x7304aae9
or dword [0x86eadc], 0x61a62728
or eax, 0xce1ee86b
or dword [0x86ebb9], eax
or edi, dword [0x86ee15]
xor dword [0x86ea23], 0xc655b108
sub edx, esi
rol esi, 0xd
neg edx
sub esi, dword [0x86ee40]
inc edi
or dword [0x86ebbd], edi
ror edi, 0xe
call fcn.005d1cc1
sub edi, dword [0x86ef12]
xchg edx, esi
inc eax
neg ecx
add ecx, 0x9d8cccf3
rol ebx, 0x10
xor eax, 0x61796c97
not edi
call fcn.0077720a
not edi
xor eax, 0x61796c97
ror ebx, 0x10
sub ecx, 0x9d8cccf3
neg ecx
dec eax
xchg edx, esi
call fcn.005fc5e4
rol edi, 0xe
xor dword [0x86eabb], ecx
dec edi
neg edx
ror esi, 0xd
add edx, esi
and dword [0x86ec57], edi
xor eax, 0xcfdefbeb
sub edx, ecx
mov dword [0x86ebbc], edi
sub edi, ecx
or eax, dword [0x86ed76]
call fcn.005c3810
and dword [0x86ea5d], edx
xor ecx, 0x6e98a1ee
xor ebx, edi
xor dword [0x86ebaf], esi
call fcn.0053e372
inc ecx
xor eax, ecx
dec esi
call fcn.005b0d09
call fcn.005f94cd
inc esi
xor eax, ecx
dec ecx
xor ebx, edi
xor ecx, 0x6e98a1ee
call fcn.004d4c1f
add edi, ecx
xor dword [0x86ec70], edx
add edx, ecx
push eax
sub esi, dword [0x86edae]
add ebx, 0x4f998c26
call fcn.006b5ba1
rol edi, 2
inc edi
neg eax
call fcn.005302df
not ebx
rol ebx, 9
call fcn.0053c887
call fcn.004fede9
call fcn.0068bfad
ror ebx, 9
not ebx
call fcn.004a5c58
neg eax
dec edi
ror edi, 2
sub ebx, 0x4f998c26
mov ebx, 0xf16da
dec eax
xor edi, esi
xor dword [0x86ebe1], 0xf7b23216
call fcn.0043c70d
or eax, dword [0x86ed3f]
sub ebx, dword [0x86edbf]
xor esi, eax
sub ecx, ebp
xor ebx, 0xc6bd5ea8
not edx
xor ebx, 0xdec91a03
and dword [0x86ea4e], esi
xor edx, ebx
inc edx
not edi
rol esi, 0x14
xor eax, edx
and dword [0x86eb2b], ebx
xor eax, edx
ror esi, 0x14
not edi
dec edx
xor edx, ebx
xor ebx, 0xdec91a03
not edx
xor ebx, 0xc6bd5ea8
add ecx, ebp
xor esi, eax
call fcn.00698fbc
sub dword [0x86e9aa], 0xfaf8fe6d
xor edi, esi
inc eax
push ebx
neg eax
call fcn.0077720a
xor edi, 0xbcd2689e
rol ecx, 3
add edx, ebp
not eax
ror edx, 0x16
xchg ecx, esi
add edi, dword [0x86eeed]
add esi, dword [0x86ecf9]
dec edi
and dword [0x86ea40], edx
Function at 0x584001
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056bc3b
and dword [ebp - 4], 0
cmp dword [0x86a8a8], 0
mov ebx, eax
jne 0x5840b2
push 0x7c561c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x584163
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x584163
push eax
call fcn.0056bbc9
mov dword [esp], 0x7c42c4
push edi
mov dword [0x86a8a8], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x86a8ac], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x86a8b0], eax
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a8b8], eax
test eax, eax
je 0x5840b2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a8b4], eax
mov eax, dword [0x86a8b4]
cmp eax, ebx
je 0x58410a
cmp dword [0x86a8b8], ebx
je 0x58410a
push eax
call fcn.0056bc44
push dword [0x86a8b8]
mov esi, eax
call fcn.0056bc44
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x58410a
test edi, edi
je 0x58410a
call esi
test eax, eax
je 0x584101
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x584101
test byte [ebp - 0xc], 1
jne 0x58410a
or dword [ebp + 0x10], 0x200000
jmp 0x584143
mov eax, dword [0x86a8ac]
cmp eax, ebx
je 0x584143
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584143
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x584143
mov eax, dword [0x86a8b0]
cmp eax, ebx
je 0x584143
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584143
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x86a8a8]
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584163
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x584165
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5994ff
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x793ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov esi, dword [esp + 0x450]
mov edi, dword [esp + 0x454]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
push 9
push str.Software_
lea ecx, [esp + 0x28]
mov dword [esp + 0x450], ebx
call fcn.00405920
lea ecx, [esp + 0x20]
cmp dword [edi + 0x14], ebx
jne 0x59950d
push 4
push str.kcsg
call fcn.004021c6
jmp 0x599516
push 0xffffffffffffffff
push ebx
push edi
call fcn.00401e38
mov eax, dword [esp + 0x24]
mov ebp, 0x10
cmp dword [esp + 0x38], ebp
jae 0x599529
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x599572
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x7b32cb
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
cmp dword [esp + 0x38], ebp
jb 0x599601
mov edx, dword [esp + 0x24]
push edx
jmp 0x5995f9
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x7c9998
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x5995d4
cmp dword [esp + 0x1c], ebx
jbe 0x5995d4
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.004062df
cmp dword [esp + 0x38], ebp
jb 0x599601
mov eax, dword [esp + 0x24]
push eax
jmp 0x5995f9
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x7b32cb
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
cmp dword [esp + 0x38], ebp
jb 0x599601
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00564155
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00564b24
add esp, 0x438
ret 8
Function at 0x5ac8d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x795fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov eax, dword [0x86aac8]
push 1
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], ebx
call fcn.00549490
mov byte [esp + 0x60], 1
cmp dword [0x86aad0], ebx
je 0x5aca4b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x86aad8]
cmp eax, 0x1388
jb 0x5aca4b
mov ecx, dword [0x86aad0]
mov edx, dword [ecx + 0x10]
sub edx, dword [ecx + 0xc]
mov esi, dword [0x86aad4]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jae 0x5ac9a9
push esi
call fcn.005a71a0
cmp dword [eax + 0x1c], ebx
je 0x5ac9a9
mov ecx, dword [0x86aad4]
inc ecx
push ecx
mov ecx, dword [0x86aad0]
call fcn.005a71a0
cmp dword [eax + 0x2c], 0x1869f
je 0x5ac9a9
inc dword [0x86aad4]
jmp 0x5ac9af
mov dword [0x86aad4], ebx
call edi
mov dword [0x86aad8], eax
mov eax, dword [0x86aad0]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov esi, dword [0x86aad4]
lea edi, [eax + 0xc]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x5ac9e4
call fcn.00565471
imul esi, esi, 0x34
add esi, dword [edi]
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.00403fb2
lea ecx, [esp + 0x10]
mov byte [esp + 0x60], bl
call fcn.00549420
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push str.CCategoryManager::AdjustServer___Switched_to_server:
push edx
call fcn.00404cfa
push ebx
push eax
mov byte [esp + 0x74], 2
call fcn.005a7050
mov esi, 0x10
add esp, 0x14
cmp dword [esp + 0x34], esi
jb 0x5aca3e
mov eax, dword [esp + 0x20]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0x50], esi
jb 0x5aca6c
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x5aca64
lea ecx, [esp + 0x10]
mov byte [esp + 0x60], bl
call fcn.00549420
cmp dword [esp + 0x50], 0x10
jb 0x5aca6c
mov edx, dword [esp + 0x3c]
push edx
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00564b24
add esp, 0x54
ret
Function at 0x5ad4c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x7960c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ebp, [edi + edi + 2]
cmp ebp, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
jge 0x5ad56a
mov eax, ebp
imul eax, eax, 0x34
mov ecx, dword [eax + ebx + 0x2c]
add eax, ebx
cmp ecx, dword [eax - 8]
jae 0x5ad518
dec ebp
mov esi, ebp
imul edi, edi, 0x34
imul esi, esi, 0x34
push 0xffffffffffffffff
push 0
add esi, ebx
add edi, ebx
push esi
mov ecx, edi
call fcn.00403fb2
mov edx, dword [esi + 0x1c]
mov dword [edi + 0x1c], edx
mov ax, word [esi + 0x20]
mov word [edi + 0x20], ax
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x24], ecx
mov dx, word [esi + 0x28]
mov word [edi + 0x28], dx
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov cl, byte [esi + 0x30]
mov byte [edi + 0x30], cl
mov edi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, dword [esp + 0x34]
jl 0x5ad507
mov eax, dword [esp + 0x34]
cmp ebp, eax
jne 0x5ad5b5
mov esi, edi
imul eax, eax, 0x34
imul esi, esi, 0x34
push 0xffffffffffffffff
lea ebp, [eax + ebx - 0x34]
add esi, ebx
push 0
push ebp
mov ecx, esi
call fcn.00403fb2
mov edx, dword [ebp + 0x1c]
mov dword [esi + 0x1c], edx
mov ax, word [ebp + 0x20]
mov word [esi + 0x20], ax
mov ecx, dword [ebp + 0x24]
mov dword [esi + 0x24], ecx
mov dx, word [ebp + 0x28]
mov word [esi + 0x28], dx
mov eax, dword [ebp + 0x2c]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x2c], eax
mov cl, byte [ebp + 0x30]
mov byte [esi + 0x30], cl
lea edi, [edx - 1]
sub esp, 0x34
mov esi, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x74]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov byte [esi + 4], 0
call fcn.00403fb2
mov ecx, dword [esp + 0x88]
mov dword [esi + 0x1c], ecx
mov dx, word [esp + 0x8c]
mov word [esi + 0x20], dx
mov eax, dword [esp + 0x90]
mov dword [esi + 0x24], eax
mov cx, word [esp + 0x94]
mov word [esi + 0x28], cx
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x98]
push ecx
mov dword [esi + 0x2c], edx
mov al, byte [esp + 0xa0]
push edi
push ebx
mov byte [esi + 0x30], al
call fcn.005aac90
add esp, 0x40
cmp dword [esp + 0x50], 0x10
jb 0x5ad643
mov edx, dword [esp + 0x3c]
push edx
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5b09f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x796558
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [esi + 8]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.00549490
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esi + 0xc]
mov dword [esp + 0x28], 0
call fcn.005b0120
mov dword [eax], edi
lea ecx, [esp + 0x10]
mov dword [eax + 4], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.00549420
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x5b1a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x796750
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x86aac8]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.00549490
cmp dword [0x86aadc], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x5b1aaa
call esi
sub eax, dword [0x86aadc]
cmp eax, 0x493e0
jae 0x5b1aaa
lea ecx, [esp + 0xc]
jmp 0x5b1b27
call esi
lea ecx, [esp + 0xc]
mov dword [0x86aadc], eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00549420
mov ecx, dword [esp + 0x34]
push ecx
call fcn.005b11c0
mov edx, dword [0x86aac8]
add esp, 4
push 1
push edx
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00549490
mov dword [esp + 0x2c], 1
mov dword [0x86aad4], 0
call esi
mov dword [0x86aad8], eax
mov eax, dword [0x86aad0]
test eax, eax
je 0x5b1b1d
mov ecx, dword [0x86aacc]
push 0
push 0xea60
push 0x5b1000
push eax
call fcn.0054df20
mov dword [0x86aad0], edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00549420
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x5b1b60
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x7967c4
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x58]
push ecx
xor ebx, ebx
push 0x202
mov dword [esp + 0x40], eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
je 0x5b1c14
push 0x34
push str.CCategoryManager::Initialize__Failed_to_init_Winsock
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00405920
lea edx, [esp + 0x18]
push 1
push edx
mov dword [esp + 0x1fc], ebx
call fcn.005a7050
add esp, 8
cmp dword [esp + 0x30], 0x10
jb 0x5b1c0d
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
xor al, al
jmp 0x5b1d99
call fcn.005495c0
push 0x1d
mov edi, 0xf
push str.CCategoryManager::SpawnThread
lea ecx, [esp + 0x20]
mov dword [0x86aac8], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00405920
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 0x5b1b50
mov dword [esp + 0x200], 1
call fcn.00549630
add esp, 0xc
cmp dword [esp + 0x30], 0x10
mov esi, eax
mov dword [esp + 0x1f4], 0xffffffff
jb 0x5b1c7e
mov edx, dword [esp + 0x1c]
push edx
call fcn.00564155
add esp, 4
push 1
mov ecx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0054f710
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
push 0x2710
mov ecx, esi
call edx
call fcn.005495c0
mov ecx, dword [esp + 0x10]
push 0x28
mov dword [ecx + 4], eax
call fcn.005645f4
mov esi, eax
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x1f4], 2
cmp esi, ebx
je 0x5b1d08
push 0x10
push str.CCategoryManager
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.00405920
push ebx
push ebx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov byte [esp + 0x200], 3
mov dword [esp + 0x20], 1
call fcn.0054e4d0
jmp 0x5b1d0a
xor eax, eax
or esi, 0xffffffff
test byte [esp + 0x14], 1
mov dword [0x86aacc], eax
mov dword [esp + 0x1f4], esi
je 0x5b1d40
cmp dword [esp + 0x54], 0x10
jb 0x5b1d34
mov eax, dword [esp + 0x40]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
push 0xa8
call fcn.005645f4
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1f4], 5
cmp eax, ebx
je 0x5b1d73
push ebx
push ebx
push ebx
push 3
push ebx
push 0x64
push 5
mov ecx, eax
call fcn.00554420
jmp 0x5b1d75
xor eax, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
push esi
push ebx
mov dword [ecx + 0x8c], eax
push edx
mov ecx, 0x858008
mov dword [esp + 0x200], esi
call fcn.00403fb2
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.00564b24
add esp, 0x1e8
ret 4
Function at 0x5b74d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x5be420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x798c58
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov si, word [esp + 0xa0]
mov eax, dword [esp + 0xac]
mov edi, dword [esp + 0xa4]
mov ebp, dword [esp + 0xa8]
push 0xa
mov word [ecx + 0x14], si
xor ebx, ebx
push str.127.0.0.1:
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], eax
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
movzx ecx, si
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0xa0], ebx
call fcn.005b5aa0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa4], 1
call fcn.00401e38
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x98], bl
jb 0x5be4ea
mov eax, dword [esp + 0x20]
push eax
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.005b5160
mov esi, eax
lea eax, [esp + 0x5c]
push ebp
push eax
mov byte [esp + 0xa8], 2
call fcn.005b5160
mov ebp, eax
lea ecx, [esp + 0x48]
push edi
push ecx
mov byte [esp + 0xb0], 3
call fcn.005b5160
add esp, 0x18
push esi
push ebp
push eax
lea edx, [esp + 0x7c]
push edx
mov byte [esp + 0xa8], 4
call fcn.00617360
mov ecx, eax
call fcn.006173b0
mov esi, 0x10
mov byte [esp + 0x17], al
cmp dword [esp + 0x50], esi
jb 0x5be55e
mov eax, dword [esp + 0x3c]
push eax
call fcn.00564155
add esp, 4
mov edi, 0xf
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x6c], esi
jb 0x5be582
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0x34], esi
jb 0x5be5a1
mov edx, dword [esp + 0x20]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x88], esi
jb 0x5be5c3
mov eax, dword [esp + 0x74]
push eax
call fcn.00564155
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00564b24
add esp, 0x88
ret 0x10
Function at 0x5cbb40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x5cbb6d
push esi
push edi
jmp 0x5cbb50
movzx esi, byte [edx]
movzx esi, byte [esi + 0x7cd3b8]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x5cbb50
pop edi
pop esi
ret
Function at 0x5da660
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [ebx]
mov ebp, dword [edi + 8]
lea esi, [eax + 2]
mov ecx, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
call fcn.005d1770
mov esi, eax
mov eax, edi
mov dword [esp + 0x14], esi
call fcn.005d1720
mov dword [esp + 0x1c], eax
mov eax, edi
call fcn.005d1590
mov eax, ebx
push 0
mov ecx, esi
mov ebx, edi
call fcn.005d9830
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 4]
add esi, eax
push ebp
mov eax, esi
mov edx, 0x37
call fcn.005d7fb0
lea ebx, [esi + 1]
mov esi, dword [esp + 0x34]
push 1
call fcn.005d9560
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push esi
push edx
push eax
push 0x1f
mov eax, ebp
call fcn.005d7f10
mov ebx, dword [esp + 0x44]
mov cl, byte [ebx + 6]
not cl
movzx edx, cl
mov ecx, dword [esp + 0x40]
mov ecx, dword [ecx + 4]
shr edx, 6
and edx, 1
or edx, 0x60
push ebp
mov eax, esi
call fcn.005d7fb0
add esp, 0x20
mov edx, edi
call fcn.005d1740
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, edi
call fcn.005d17a0
mov eax, dword [ebx + 8]
test eax, eax
je 0x5da79f
mov ebx, dword [ebx + 0xc]
lea esi, [ebx + 1]
test ebx, ebx
jne 0x5da739
mov esi, eax
push ebp
mov eax, esi
mov ecx, 0x7a
call fcn.005d7f90
mov edi, eax
or eax, 0xffffffff
push ebp
mov ecx, esi
lea edx, [eax + 0x15]
call fcn.005d7fb0
push ebp
mov eax, 1
call fcn.005d7f70
mov esi, eax
mov eax, edi
mov ecx, ebp
call fcn.005cfe80
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 4]
push ebp
mov ecx, 0x43
call fcn.005d7f90
mov eax, dword [edi + 4]
push ebp
mov ecx, 0x3b
call fcn.005d7f90
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov ecx, ebp
pop ebp
pop ebx
add esp, 0x10
jmp fcn.005cfe80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5f1940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [edi + 0x3c]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor esi, esi
cmp dword [ecx], esi
jne 0x5f1968
mov eax, dword [edi + 0x78]
push edi
call fcn.005cde70
add esp, 4
test eax, eax
jne 0x5f1a5a
mov esi, eax
mov ecx, dword [edi + 0x18]
cmp ecx, dword [edi + 0x24]
jbe 0x5f19a0
mov eax, dword [edi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.005662f0
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x10], edx
push 5
lea edx, [esp + 0x10]
call fcn.005ca2b0
mov eax, dword [edi + 0x18]
add esp, 4
mov dword [edi + 0x24], eax
push ebx
test ebp, ebp
je 0x5f1a57
mov ebx, dword [ebp + 0x14]
cmp ebx, dword [edi + 0x18]
ja 0x5f1a4c
test byte [ebp + 0x18], 0x20
jne 0x5f1a4c
mov eax, dword [edi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.005662f0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp ebx, 1
jne 0x5f19e7
mov esi, ebp
call fcn.005cdd90
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x80]
mov esi, dword [ebp + 4]
push edx
push eax
mov eax, dword [edi + 0x3c]
push ecx
push esi
call fcn.005ca200
add esp, 0x10
mov dword [esp + 0xc], eax
cmp ebx, 1
jne 0x5f1a2b
mov edx, dword [esi + 0x18]
lea eax, [esi + 0x18]
mov dword [edi + 0x64], edx
mov ecx, dword [eax + 4]
mov dword [edi + 0x68], ecx
mov edx, dword [eax + 8]
mov dword [edi + 0x6c], edx
mov eax, dword [eax + 0xc]
mov dword [edi + 0x70], eax
cmp ebx, dword [edi + 0x20]
jbe 0x5f1a33
mov dword [edi + 0x20], ebx
inc dword [edi + 0xa8]
mov ecx, dword [ebp + 4]
mov eax, dword [edi + 0x58]
push ecx
call fcn.005ea090
mov esi, dword [esp + 0x10]
add esp, 4
mov ebp, dword [ebp + 0xc]
test esi, esi
je 0x5f19a1
mov eax, esi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret