joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533802
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x53380d
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x5338bf
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x5bdc10]
inc ecx
sub edi, 8
dec esi
jne 0x533824
pop ebx
test edi, edi
je 0x5338d8
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x5bdc10]
inc ecx
dec edi
jne 0x5338c3
pop esi
not eax
pop edi
ret
Function at 0x53ddc7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1980
push 0x5846a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [0x5b1138]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x53de4d
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x53de25
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x53de53
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x53de1d
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x53de1d
mov al, 1
jmp 0x53de1f
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53e54d
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x53e571
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x53e574
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x53e587
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x53e58e
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x61ea24]
mov ecx, dword [0x61ea20]
test eax, eax
jne 0x53e5a8
test ecx, ecx
je 0x53e5bd
mov eax, ecx
mov dword [0x61ea24], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x53e5bd
cmp edx, dword [ebp + 8]
jb 0x53e5bd
cmp edx, dword [ebp - 4]
jbe 0x53e716
mov eax, ecx
test ecx, ecx
mov dword [0x61ea24], eax
je 0x53e5ed
test eax, eax
je 0x53e5e1
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x53e5e1
cmp ecx, dword [ebp + 8]
jb 0x53e5e1
cmp ecx, dword [ebp - 4]
jbe 0x53e716
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x61ea24], eax
jne 0x53e5cc
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x53e655
cmp edi, 0x70000000
jb 0x53e612
cmp edi, 0x80000000
ja 0x53e612
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [0x5b1138]
test eax, eax
je 0x53e655
cmp dword [ebp - 0x10], ebx
jne 0x53e62d
cmp dword [ebp - 0x14], ebx
jae 0x53e63d
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x53e5fd
jmp 0x53e655
push 0x40
push 0x3000
push ebx
push edi
call dword [0x5b1254]
test eax, eax
mov dword [0x61ea24], eax
jne 0x53e6cc
cmp esi, dword [ebp - 4]
jae 0x53e73d
cmp esi, 0x70000000
jb 0x53e673
cmp esi, 0x80000000
ja 0x53e673
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [0x5b1138]
test eax, eax
je 0x53e73d
cmp dword [ebp - 0x10], ebx
jne 0x53e6c1
cmp dword [ebp - 0x14], ebx
jb 0x53e6c1
mov ecx, esi
and ecx, 0xffff
je 0x53e6a9
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [0x5b1254]
test eax, eax
mov dword [0x61ea24], eax
jne 0x53e6cc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x53e655
mov dword [eax], 0x52727464
mov eax, dword [0x61ea24]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x61ea24]
mov edx, dword [0x61ea20]
mov dword [eax + 4], edx
mov eax, dword [0x61ea24]
mov dword [0x61ea20], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x53e6fe
mov eax, dword [0x61ea24]
mov dword [eax + 8], ecx
mov eax, dword [0x61ea24]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x53e73d
cmp esi, dword [ebp - 4]
ja 0x53e73d
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.005847c0
add esp, 0xc
mov eax, esi
jmp 0x53e73f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53e744
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1990
push 0x5846a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [0x5b1138]
test eax, eax
je 0x53e7b9
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x53e7b5
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x53e7b5
cmp word [eax + 0x14], 0
jne 0x53e7aa
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x53e7bb
mov eax, ecx
jmp 0x53e7a4
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5406a6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x5406cf
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x5b3770]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x5406af
pop esi
ret
Function at 0x54bcdd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x54bdf5
test esi, esi
je 0x54bdf5
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x54bd99
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x54bd99
xor cl, dl
test cl, 0x10
jne 0x54bd99
mov al, byte [edi]
cmp al, byte [esi]
jne 0x54bd99
push dword [esi + 8]
push dword [edi + 8]
call fcn.0054bcdd
pop ecx
pop ecx
test eax, eax
jne 0x54bd99
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.0054bcdd
pop ecx
pop ecx
test eax, eax
jne 0x54bd99
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.00544e1a
test eax, eax
jne 0x54bd99
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x54bd99
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x54bd99
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x54bd9e
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x54bd99
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x54bdc8
push 2
pop eax
jmp 0x54be00
cmp byte [edi], 0x98
je 0x54bdc8
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x54bdc8
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x54bd99
mov edx, dword [esi + 4]
test edx, edx
je 0x54bd99
call fcn.0053fb28
test eax, eax
jne 0x54bd99
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x54bde4
xor eax, eax
inc eax
jmp 0x54be00
test cx, cx
je 0x54bdf1
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x54bd99
xor eax, eax
jmp 0x54be00
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
ret
Function at 0x54d3c1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebx]
lea esi, [edi + 2]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
call fcn.00544ecb
mov esi, eax
mov eax, ecx
call fcn.00544e7c
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
call fcn.00544df7
push 0
push eax
mov ecx, esi
mov eax, ebx
call fcn.0054bbf2
mov ecx, dword [ebp - 4]
add edi, esi
push edi
push dword [ebx + 8]
push 0x35
pop eax
call fcn.0054a6fe
mov eax, dword [ebp + 8]
inc edi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
inc ebx
call fcn.0054ba78
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push edi
push esi
push 0x1e
pop eax
call fcn.0054a669
push dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
push dword [ebx + 8]
mov ecx, dword [ebp - 4]
push 0x46
pop eax
call fcn.0054a6fe
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add esp, 0x28
call fcn.00544e97
mov ecx, esi
call fcn.00544eef
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x54d4cf
mov eax, dword [eax + 0x34]
lea edi, [eax + 1]
test eax, eax
jne 0x54d476
mov edi, ecx
mov esi, dword [ebp - 4]
push edi
push 0x73
pop eax
mov ecx, esi
call fcn.0054a6ed
push 0xffffffffffffffff
push edi
mov dword [ebp + 8], eax
push 0x14
pop eax
mov ecx, esi
call fcn.0054a6fe
push 1
mov ecx, esi
call fcn.0054a6db
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.00543eaf
push dword [ebx + 8]
mov ecx, esi
push 0x3f
pop eax
call fcn.0054a6ed
push dword [ebx + 8]
mov ecx, esi
push 0x39
pop eax
call fcn.0054a6ed
add esp, 0x18
mov eax, edi
mov ecx, esi
call fcn.00543eaf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x54d4d4
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x34]
test eax, eax
je 0x54d51e
cmp dword [esp + 8], 0
je 0x54d51e
push 0xffffffffffffffff
push eax
push 0x14
pop eax
mov ecx, edi
call fcn.0054a6fe
push dword [esi + 0x34]
mov ecx, edi
push 0x72
pop eax
call fcn.0054a6ed
push dword [esp + 0x14]
mov esi, eax
xor eax, eax
push 0
inc eax
mov ecx, edi
call fcn.0054a6fe
add esp, 0x14
mov eax, esi
mov ecx, edi
pop esi
jmp fcn.00543eaf
pop esi
ret
Function at 0x550c57
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
cmp dword [ebx + 0x30], 0
push esi
mov esi, ecx
jne 0x550da1
mov eax, esi
call fcn.00544df7
cmp dword [ebx + 0x28], 0
je 0x550da1
inc dword [esi + 0x48]
mov eax, dword [esi + 0x48]
push edi
mov edi, esi
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
call fcn.00550c2e
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x550da0
mov edx, dword [ebx + 0x28]
lea eax, [ebp - 8]
push eax
push edx
call fcn.00544b76
pop ecx
pop ecx
test eax, eax
je 0x550cef
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 8]
push 7
pop eax
call fcn.0054a6fe
cmp dword [ebp - 8], 0
pop ecx
pop ecx
jne 0x550cdd
push dword [ebp + 8]
xor eax, eax
push 0
inc eax
mov ecx, edi
call fcn.0054a6fe
pop ecx
pop ecx
jmp 0x550d1b
fild dword [ebp - 8]
fcom qword [ebx + 0x48]
fnstsw ax
test ah, 5
jp 0x550d19
fstp qword [ebx + 0x48]
jmp 0x550d1b
mov edi, dword [ebp - 4]
mov eax, edx
call fcn.0054bb24
mov ecx, dword [ebp - 0xc]
push edi
push 0x15
pop eax
call fcn.0054a6ed
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
push edi
push 0x73
pop eax
call fcn.0054a6fe
add esp, 0xc
jmp 0x550d1b
fstp st(0)
cmp dword [ebx + 0x2c], 0
je 0x550da0
inc dword [esi + 0x48]
mov edi, dword [esi + 0x48]
mov dword [ebx + 0x34], edi
inc dword [esi + 0x48]
mov eax, dword [ebx + 0x2c]
call fcn.0054bb24
mov esi, dword [ebp - 0xc]
push edi
push 0x15
pop eax
mov ecx, esi
call fcn.0054a6ed
push edi
push 0x71
pop eax
mov ecx, esi
call fcn.0054a6ed
push edi
push 0
mov ebx, eax
push 7
pop eax
mov ecx, esi
call fcn.0054a6fe
mov eax, ebx
mov ecx, esi
call fcn.00543eaf
lea ebx, [edi + 1]
push ebx
push edi
push dword [ebp - 4]
mov ecx, esi
push 0x56
pop eax
call fcn.0054a669
push dword [ebp - 4]
mov ecx, esi
push 0x71
pop eax
call fcn.0054a6ed
push ebx
push 0xffffffffffffffff
mov edi, eax
push 7
pop eax
mov ecx, esi
call fcn.0054a6fe
add esp, 0x28
mov eax, edi
mov ecx, esi
call fcn.00543eaf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x553169
Capabilities:
Terminate process

Disassembly:
call fcn.00550c2e
mov ecx, eax
test ecx, ecx
je 0x55317c
push 0x64
pop eax
jmp fcn.0054a6ed
ret

Function at 0x55421d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ebx, dword [esi + 0xc]
push edi
mov edi, dword [esi + 0x1a0]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x55436e
jmp 0x554243
mov esi, eax
mov edx, dword [edi + 8]
mov eax, dword [ebp - 0x10]
shl edx, 4
add edx, dword [eax + 8]
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.00544e7c
push 0x27
push dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
push 0
push esi
mov esi, dword [eax + 0x48]
call fcn.00554019
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov dword [ebp - 8], eax
push 0x4a
pop eax
mov ecx, ebx
call fcn.0054a6ed
push 0x41
mov ecx, ebx
mov dword [ebp - 0x1c], eax
call fcn.0054a6db
push dword [ebp - 4]
xor esi, esi
push esi
push esi
mov dword [ebp - 0x18], eax
push 0x1c
pop eax
mov ecx, ebx
call fcn.0054a669
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
dec eax
push esi
push eax
mov dword [ebp - 0x20], eax
push 0x4c
pop eax
mov ecx, ebx
call fcn.0054a669
push dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push esi
push 0x43
pop eax
mov ecx, ebx
call fcn.0054a6fe
mov eax, dword [ebp - 0x18]
mov ecx, ebx
call fcn.00543eaf
push dword [ebp - 8]
mov ecx, ebx
push esi
push 0x36
pop eax
call fcn.0054a6fe
add esp, 0x40
push 1
mov ecx, ebx
call fcn.0054a6db
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00543eaf
push dword [ebp - 8]
mov ecx, ebx
push esi
push 0x3d
pop eax
call fcn.0054a6fe
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00543eaf
mov eax, dword [ebp - 0x18]
mov ecx, ebx
call fcn.00543eaf
push dword [ebp - 4]
mov ecx, ebx
push 2
push dword [ebp - 0x20]
push 0x1e
pop eax
call fcn.0054a669
push dword [ebp - 8]
mov ecx, ebx
push dword [ebp - 4]
push esi
push 0x37
pop eax
call fcn.0054a669
mov dl, 8
mov ecx, ebx
call fcn.00543e9d
push 0x2b
mov ecx, ebx
call fcn.0054a6db
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add esp, 0x28
call fcn.00544e97
mov edi, dword [edi]
cmp edi, esi
jne 0x554241
pop edi
pop esi
pop ebx
leave
ret
Function at 0x556fea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push 0x24
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.005847c0
mov eax, dword [ebp + 0x14]
add esp, 0xc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
call fcn.00556fa3
test eax, eax
jne 0x5570f9
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x2c]
call fcn.00556fa3
test eax, eax
jne 0x5570f9
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.00556fa3
test eax, eax
jne 0x5570f9
cmp esi, ebx
je 0x557072
cmp byte [esi], 0x5e
jne 0x557058
mov eax, dword [esi + 4]
jmp 0x55705a
xor eax, eax
push ebx
push ebx
push eax
push dword [ebp + 0xc]
mov eax, edi
call fcn.0054c27a
add esp, 0x10
test eax, eax
jne 0x5570fc
call fcn.00550c2e
push 4
pop esi
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.00544ecb
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov edi, ebx
mov esi, ecx
call fcn.0054bb24
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 1]
call fcn.0054bb24
mov eax, dword [ebp + 0x1c]
lea edi, [ebx + 2]
call fcn.0054bb24
mov edi, dword [ebp - 8]
test edi, edi
je 0x5570fc
mov esi, dword [ebp + 0x10]
lea eax, [ebx + 3]
push eax
movsx eax, word [esi]
sub ebx, eax
add ebx, 3
push ebx
push 0
push 0x12
pop eax
mov ecx, edi
call fcn.0054a669
mov dl, byte [esi]
mov ecx, edi
call fcn.00543e9d
push 0xfffffffffffffffb
push esi
push edi
or eax, 0xffffffff
call fcn.0054a947
xor eax, eax
cmp dword [ebp + 0xc], 0x18
mov ecx, edi
sete al
push eax
push 0x7a
pop eax
call fcn.0054a6ed
add esp, 0x1c
jmp 0x5570fc
inc dword [edi + 0x40]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.0054b769
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0054b769
push dword [ebp + 0x1c]
push dword [ebp - 4]
call fcn.0054b769
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x558f5c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x1c], 0
jne 0x558fd5
mov ecx, dword [edi + 0xc]
push esi
mov esi, eax
imul esi, esi, 0x18
lea eax, [ebp - 4]
push eax
add ecx, esi
movzx eax, byte [ecx + 0x16]
push eax
mov eax, ebx
call fcn.005427cc
mov eax, dword [eax + 8]
mov eax, dword [eax + 0xc]
movzx eax, byte [eax + 0x4d]
push eax
push dword [ecx + 4]
mov eax, ebx
call fcn.005427cc
push eax
call fcn.0055572d
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x558fb6
push 0xfffffffffffffff8
push dword [ebp - 4]
or eax, 0xffffffff
push ebx
call fcn.0054a947
add esp, 0xc
cmp dword [ebp + 8], 0
jl 0x558fd4
mov eax, dword [edi + 0xc]
cmp byte [esi + eax + 0x16], 0x65
jne 0x558fd4
push dword [ebp + 8]
mov ecx, ebx
push 0x16
pop eax
call fcn.0054a6ed
pop ecx
pop esi
leave
ret
Function at 0x55bce6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, eax
mov eax, dword [ebx + 0x10]
mov ecx, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 4], eax
inc eax
mov dword [ebp - 8], eax
inc eax
mov dword [edi + 0x44], eax
mov esi, dword [ebx + 0x24]
call fcn.00545baa
mov esi, eax
mov eax, dword [edi]
mov eax, dword [eax + 8]
mov ecx, esi
shl ecx, 4
push dword [ecx + eax]
mov eax, edi
push 0
push dword [ebx]
push 0x1b
call fcn.0054c27a
add esp, 0x10
test eax, eax
jne 0x55be81
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ebx, dword [eax + 0x14]
push 1
push esi
mov eax, edi
call fcn.0054c2f1
add esp, 0xc
call fcn.00550c2e
mov ebx, eax
test ebx, ebx
je 0x55be81
mov eax, dword [ebp + 0xc]
test eax, eax
jl 0x55bd69
mov dword [ebp - 0xc], eax
jmp 0x55bd80
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push esi
push eax
mov dword [ebp - 0xc], eax
push 0x60
pop eax
mov ecx, ebx
call fcn.0054a6fe
pop ecx
pop ecx
push dword [ebp + 8]
push edi
call fcn.0055736d
push 0xfffffffffffffff0
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
push 0x27
pop eax
call fcn.0054eede
add esp, 0x20
cmp dword [ebp + 0xc], 0
jl 0x55bdae
mov dl, 1
mov ecx, ebx
call fcn.00543e9d
push 0x26
push esi
push dword [ebp - 4]
mov esi, dword [ebp - 0x10]
push edi
call fcn.00554019
push 0
push dword [ebp - 4]
mov ecx, ebx
push 0x41
pop eax
call fcn.0054a6fe
mov dword [ebp - 0xc], eax
mov eax, edi
call fcn.00544e7c
mov esi, dword [ebp + 8]
push 1
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
push esi
push edi
call fcn.0055ad6a
add esp, 0x2c
cmp byte [esi + 0x18], 0
je 0x55be24
mov ecx, dword [esi + 4]
push 0xfffffffffffffff2
push eax
add ecx, eax
push ecx
mov eax, ebx
call fcn.00543e46
inc eax
inc eax
push eax
push dword [ebp - 8]
push ebx
push 0x33
pop eax
call fcn.0054eede
push 0xfffffffffffffffe
push 0x5b7f98
push 2
mov eax, edi
call fcn.0055367e
add esp, 0x24
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 8]
push 0x46
pop eax
call fcn.0054a6fe
mov dl, 0x10
mov ecx, ebx
call fcn.00543e9d
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00544e97
mov esi, dword [ebp - 0xc]
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
mov ecx, ebx
push 0x43
pop eax
call fcn.0054a6fe
mov eax, esi
mov ecx, ebx
call fcn.00543eaf
push dword [ebp - 4]
mov ecx, ebx
push 0x2b
pop eax
call fcn.0054a6ed
push dword [ebp - 8]
mov ecx, ebx
push 0x2b
pop eax
call fcn.0054a6ed
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x561221
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
mov eax, dword [edi + 0x3c]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax], ebx
jne 0x56124e
push eax
mov eax, dword [edi + 0x78]
mov ecx, edi
call fcn.00542608
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x561316
mov ecx, dword [edi + 0x18]
cmp ecx, dword [edi + 0x24]
jbe 0x561282
mov eax, dword [edi + 0x80]
push ebx
cdq
push ecx
push edx
push eax
call fcn.00585060
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi + 0x3c]
push 5
mov dword [ebp - 0xc], edx
call fcn.0053f2b2
mov eax, dword [edi + 0x18]
pop ecx
pop ecx
mov dword [edi + 0x24], eax
test esi, esi
je 0x561316
mov ebx, dword [esi + 0xc]
cmp ebx, dword [edi + 0x18]
ja 0x561309
test byte [esi + 0x14], 0x20
jne 0x561309
mov eax, dword [edi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.00585060
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp ebx, 1
jne 0x5612bc
call fcn.00542573
push dword [ebp - 0xc]
mov eax, dword [esi]
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [edi + 0x80]
push eax
mov eax, dword [edi + 0x3c]
call fcn.0053f245
add esp, 0x10
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x5612f6
mov eax, dword [ebp - 8]
add eax, 0x18
push 0x10
push eax
lea eax, [edi + 0x64]
push eax
call fcn.00584840
add esp, 0xc
cmp ebx, dword [edi + 0x20]
jbe 0x5612fe
mov dword [edi + 0x20], ebx
push dword [esi]
mov eax, dword [edi + 0x58]
call fcn.0056098d
pop ecx
cmp dword [ebp - 4], 0
mov esi, dword [esi + 8]
je 0x561282
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret