joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a9363
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, 2
mov dword [esp + 0x14], 1
je 0x536f55
cmp eax, 1
jne 0x536f68
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x536f65
push eax
call fcn.0058881a
add esp, 4
mov dword [esi + 0x3c], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x536f95
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jle 0x536f80
add ecx, 0xffffffff
cmp ecx, edi
mov dword [eax + 0xc], ecx
jne 0x536f95
mov ecx, dword [0xa47b78]
mov eax, dword [ecx]
mov edx, dword [esi + 0x24]
mov eax, dword [eax + 0x1c0]
push edi
push edx
call eax
mov ecx, dword [esi]
and ecx, 0xffffffef
or ecx, 0x20
mov dword [esi + 0x24], edi
mov dword [esi], ecx
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x536fb2
push eax
call fcn.00588796
add esp, 4
mov ecx, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esp + 0x14], 0xffffffff
call fcn.004d3040
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x537100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a95e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00534010
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov ecx, dword [esi + 0x34]
mov ebx, dword [esi + 0x30]
cmp ebx, ecx
je 0x537172
mov eax, ecx
sub eax, ecx
sar eax, 2
cmp eax, edi
lea edx, [eax*4]
push ebp
lea ebp, [edx + ebx]
jle 0x53716e
push edx
push ecx
push edx
push ebx
call fcn.005894ec
add esp, 0x10
mov dword [esi + 0x34], ebp
pop ebp
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x3c], edi
pop edi
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5408c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5a9c1b
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x2c], 0
jne 0x540987
push 0x200
call fcn.00588cb9
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x54090b
mov ecx, eax
call fcn.0053db20
jmp 0x54090d
xor eax, eax
mov ecx, dword [esp + 0x1c]
push 0x80
push ecx
mov ecx, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x2c], eax
call fcn.0053bd10
fld1
mov edx, dword [esi + 0x2c]
push 1
push ecx
fstp dword [esp]
push 0
mov dword [edx + 4], 1
mov ecx, dword [esi + 0x2c]
push 0
call fcn.0053cec0
test eax, eax
je 0x540981
mov ecx, dword [esi + 0x2c]
push 0
call fcn.0053c910
mov esi, dword [esi + 0x2c]
test esi, esi
je 0x54096c
mov ecx, esi
call fcn.0053dc50
push esi
call fcn.00588796
add esp, 4
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
or dword [esi], 0x40000000
mov ecx, dword [0xa47b78]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c0]
lea edx, [esp + 4]
push edx
push 0
push 0
call eax
mov eax, dword [esp + 4]
sub eax, 0x202
je 0x540a16
sub eax, 0x202
je 0x5409c2
sub eax, 4
je 0x5409c2
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx + 0x2f4]
jmp 0x540a1f
mov eax, dword [esi + 0x40]
mov esi, dword [esi + 0x30]
mov ecx, dword [esi + 0x100]
cmp ecx, dword [eax + 0x130]
jg 0x5409f6
mov edx, dword [eax + 0x2fc]
mov dword [esi + 0x174], edx
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
mov eax, dword [eax + 0x2f8]
mov dword [esi + 0x174], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx + 0x2f8]
mov edx, dword [esi + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [edx + 0x174], eax
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x5412b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a9613
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.00534010
xor eax, eax
lea ecx, [esi + 0x48]
mov dword [esp + 0x10], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [esp + 0x10], 1
mov dword [esi], 0x20000
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
call fcn.00541020
fld1
mov ecx, dword [esp + 8]
fstp dword [esi + 0x28]
mov eax, 0x80
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x551560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a9933
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov ecx, dword [edi + 0x34]
lea esi, [edi + 0x30]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x18], 1
je 0x5515ad
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 8]
push eax
push esi
call fcn.00551370
mov eax, dword [esi + 4]
push eax
call fcn.00588796
add esp, 4
lea ecx, [edi + 0x20]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esp + 0x18], bl
call fcn.00551250
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.004d3040
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5532b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
test ecx, ecx
mov eax, dword [esi]
push edi
je 0x5532c3
mov eax, ecx
test al, 1
je 0x5533dd
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [edi], eax
mov edx, dword [ecx]
cmp edx, dword [esi + 0x58]
jae 0x5533cb
cmp eax, dword [esi + 0x5c]
ja 0x5533cb
mov eax, dword [0xa47b48]
test eax, eax
je 0x5533cb
mov edx, dword [eax + 0x108]
mov eax, dword [eax + 0x10c]
mov dword [esp + 0x10], edx
mov edx, eax
and eax, 0x7fffffff
mov dword [esp + 0x14], eax
fild qword [esp + 0x10]
and edx, 0x80000000
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
fild qword [esp + 0x10]
fchs
faddp st(1)
fmul qword [0x60d1e0]
fld1
fdivrp st(1)
fdivr qword [esi + 8]
rdtsc
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x20]
test eax, eax
fild dword [esp + 0x20]
jge 0x55336d
fadd dword [0x5adefc]
fnstcw word [esp + 0x20]
movzx eax, word [esp + 0x20]
or eax, 0xc00
fmul st(1)
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
test eax, eax
fldcw word [esp + 0x24]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
fldcw word [esp + 0x20]
fild dword [esp + 0x1c]
jge 0x5533a5
fadd dword [0x5adefc]
fnstcw word [esp + 0x20]
movzx eax, word [esp + 0x20]
fmulp st(1)
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov dword [edi], edx
fldcw word [esp + 0x20]
mov eax, dword [ecx]
mov dword [esi + 0x58], eax
mov ecx, dword [edi]
pop edi
mov dword [esi + 0x5c], ecx
pop esi
add esp, 0x10
ret 0xc
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
rdtsc
mov dword [edi], eax
mov dword [esi], edx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x558550
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a9d26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00534010
xor edi, edi
push 0x40
lea ebx, [esi + 0x6c]
push edi
push ebx
mov dword [esp + 0x24], edi
mov dword [esi], edi
call fcn.0058ac30
fld1
fst dword [esi + 0xa8]
mov eax, 1
fst dword [esi + 0x94]
mov dword [esi + 0x68], eax
fst dword [esi + 0x80]
add esp, 0xc
fst dword [ebx]
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov byte [esp + 0x18], al
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
fstp dword [esi + 0x30]
fld dword [0x5ae230]
mov dword [esi + 0x24], edi
fstp dword [esi + 0x34]
mov dword [esi + 0x28], 6
fldz
mov dword [esi + 0x2c], 0x80
fst dword [esi + 0x40]
mov dword [esi + 0x5c], edi
fst dword [esi + 0x3c]
mov dword [esi + 0x60], edi
fst dword [esi + 0x38]
mov dword [esi + 0x64], edi
fst dword [esi + 0x4c]
mov dword [esi + 0xac], edi
fst dword [esi + 0x48]
fst dword [esi + 0x44]
fstp dword [esi + 0x50]
mov ecx, dword [esi + 0xb8]
mov edx, dword [esi + 0xb4]
cmp edx, ecx
je 0x558655
mov eax, ecx
sub eax, ecx
sar eax, 2
cmp eax, edi
push ebp
lea ebp, [eax*4]
lea ebx, [edx + ebp]
jle 0x55864e
push ebp
push ecx
push ebp
push edx
call fcn.005894ec
add esp, 0x10
mov dword [esi + 0xb8], ebx
pop ebp
push 1
mov ecx, esi
call fcn.00553950
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], eax
pop edi
mov dword [esi + 0x54], 0x8000000
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x55a330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x55a4ae
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x55a4ae
mov ecx, dword [esp + 0x28]
and ecx, 0x8000007f
push ebp
push esi
jns 0x55a360
dec ecx
or ecx, 0xffffff80
inc ecx
xor eax, eax
xor esi, esi
xor ebp, ebp
test ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
jle 0x55a3cc
mov eax, ebx
sub eax, edi
mov dword [esp + 0x10], eax
lea ebx, [ebx]
mov bl, byte [edi + esi]
add edi, esi
mov al, bl
and al, 1
movzx eax, al
mov ecx, esi
cdq
and ecx, 0x3f
call fcn.005910b0
mov ecx, dword [esp + 0x38]
or dword [esp + 0x20], edx
mov edx, dword [esp + 0x34]
push ecx
push edx
mov ecx, esi
or ebp, eax
call fcn.0055a2b0
mov ecx, dword [esp + 0x10]
xor al, bl
add esi, 1
cmp esi, dword [esp + 0x14]
mov byte [ecx + edi], al
mov edi, dword [esp + 0x28]
jl 0x55a380
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
xor eax, dword [esp + 0x38]
xor ebp, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
cdq
and edx, 0x7f
add eax, edx
mov dword [esp + 0x14], ebp
sar eax, 7
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x2c], 1
jle 0x55a4a2
mov ecx, ebx
sub ecx, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], eax
jmp 0x55a412
xor ebp, ebp
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
and ecx, 7
mov edx, 1
shl edx, cl
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
lea edi, [esi + eax]
mov dword [esp + 0x34], edx
jmp 0x55a439
mov edx, dword [esp + 0x34]
mov bl, byte [edi]
movzx eax, bl
and eax, edx
mov ecx, ebp
and ecx, 0x3f
xor edx, edx
call fcn.005910b0
mov ecx, dword [esp + 0x18]
or dword [esp + 0x20], edx
mov edx, dword [esp + 0x14]
or dword [esp + 0x1c], eax
push ecx
push edx
mov ecx, esi
call fcn.0055a2b0
mov ecx, dword [esp + 0x10]
xor al, bl
mov byte [edi + ecx], al
add ebp, 1
add esi, 1
add edi, 1
cmp ebp, 0x80
jl 0x55a435
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor dword [esp + 0x14], edx
xor dword [esp + 0x18], ecx
mov eax, 1
add dword [esp + 0x2c], eax
sub dword [esp + 0x30], eax
jne 0x55a410
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x14
ret 0x14
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret 0x14
Function at 0x561b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5aa076
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
call fcn.00534010
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 0x100], ecx
mov dword [esi + 0x104], ecx
mov dword [esi + 0x108], ecx
fldz
mov dword [esi + 0x110], ecx
mov dword [esi + 0x114], ecx
mov dword [esi + 0x118], ecx
fst dword [esi + 0x14]
fst dword [esi + 0x20]
mov dword [esi + 0x10], ecx
fst dword [esi + 0x1c]
mov dword [esi + 4], ecx
fst dword [esi + 0x18]
mov dword [esi + 8], ecx
fst dword [esi + 0x2c]
mov dword [esi + 0xc], ecx
fst dword [esi + 0x28]
mov dword [esi + 0x11c], ecx
fst dword [esi + 0x24]
mov dword [esi + 0x120], ecx
fst dword [esi + 0x38]
fst dword [esi + 0x34]
fstp dword [esi + 0x30]
mov edx, dword [esi + 0x114]
mov ebx, dword [esi + 0x110]
cmp ebx, edx
je 0x561c4a
mov eax, edx
sub eax, edx
push ebp
sar eax, 2
cmp eax, ecx
push edi
lea edi, [eax*4]
lea ebp, [edi + ebx]
jle 0x561c42
push edi
push edx
push edi
push ebx
call fcn.005894ec
add esp, 0x10
pop edi
mov dword [esi + 0x114], ebp
pop ebp
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x561f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aa0cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.00534010
push fcn.005618f0
push fcn.00561b90
push 0x10
push 0x124
lea eax, [esi + 0x34]
push eax
mov dword [esp + 0x28], 0
mov dword [esi], 0
call fcn.00590c28
push 0x124
mov byte [esp + 0x18], 1
mov dword [esi + 8], 2
call fcn.00588cb9
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x561f7b
mov ecx, eax
call fcn.00561b90
jmp 0x561f7d
xor eax, eax
fld dword [0x5ad77c]
mov dword [esi + 0x30], eax
mov dword [esi + 4], 4
mov dword [esi + 0x1274], 0
fst dword [eax + 0x18]
mov ecx, dword [esi + 0x30]
fst dword [ecx + 0x1c]
mov edx, dword [esi + 0x30]
fstp dword [edx + 0x20]
mov eax, dword [esi + 0x30]
fld1
fst dword [eax + 0x24]
mov ecx, dword [esi + 0x30]
fst dword [ecx + 0x28]
mov edx, dword [esi + 0x30]
fstp dword [edx + 0x2c]
mov eax, dword [esi + 0x30]
fld dword [eax + 0x24]
fadd dword [eax + 0x18]
mov ecx, dword [esp + 0xc]
fld dword [0x5ad750]
fmul st(1), st(0)
fxch st(1)
fstp dword [eax + 0x30]
mov eax, dword [esi + 0x30]
fld dword [eax + 0x28]
fadd dword [eax + 0x1c]
fmul st(1)
fstp dword [eax + 0x34]
mov eax, dword [esi + 0x30]
fld dword [eax + 0x2c]
fadd dword [eax + 0x20]
fmulp st(1)
fstp dword [eax + 0x38]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x563600
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0x18]
mov eax, ebx
cdq
and edx, 0xfff
add eax, edx
mov ecx, eax
push edi
mov edi, dword [esp + 0x1c]
lea eax, [ebx + edi - 1]
cdq
and edx, 0xfff
add eax, edx
sar ecx, 0xc
sar eax, 0xc
cmp ecx, eax
jne 0x56367a
cmp ecx, dword [esi + 0x10]
jge 0x56367a
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + ecx*4]
mov edx, ebx
and edx, 0x80000fff
jns 0x56364f
dec edx
or edx, 0xfffff000
inc edx
xor eax, eax
test edi, edi
jle 0x563743
mov ebp, dword [esp + 0x18]
add ecx, edx
nop
mov dl, byte [eax + ebp]
xor dl, byte [esi + 0x18]
add eax, 1
mov byte [ecx + eax - 1], dl
add dword [esi + 0x18], 1
cmp eax, edi
jl 0x563660
jmp 0x563743
xor ebx, ebx
test edi, edi
mov dword [esp + 0x10], ebx
jle 0x563743
mov ecx, dword [esi + 0x18]
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
mov edi, eax
mov ebp, ecx
sar edi, 0xc
and ebp, 0x80000fff
jns 0x5636ad
dec ebp
or ebp, 0xfffff000
inc ebp
mov eax, dword [esi + 0x10]
cmp edi, eax
jl 0x56371b
xor ecx, ecx
add eax, 1
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00588cb9
mov ebx, eax
xor eax, eax
add esp, 4
cmp dword [esi + 0x10], eax
jle 0x5636f1
lea esp, [esp]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + eax*4]
mov dword [ebx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x10]
jl 0x5636e0
mov eax, dword [esi + 0xc]
push eax
call fcn.00588796
push 0x1000
mov dword [esi + 0xc], ebx
call fcn.00588cb9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ebx, dword [esp + 0x18]
add esp, 8
mov dword [edx + ecx*4], eax
add dword [esi + 0x10], 1
mov eax, dword [esp + 0x18]
mov cl, byte [ebx + eax]
xor cl, byte [esi + 0x18]
mov edx, dword [esi + 0xc]
mov eax, dword [edx + edi*4]
add ebx, 1
mov byte [eax + ebp], cl
add dword [esi + 0x18], 1
cmp ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
jl 0x563688
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x14], eax
jge 0x56374e
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x5639b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
mov edx, dword [esp + 4]
jne 0x5639d2
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 8]
push eax
push ecx
push 1
push edx
call fcn.0058b709
add esp, 0x10
ret 8
cmp eax, 5
mov ecx, dword [ecx + 4]
je 0x5639e7
mov eax, dword [esp + 8]
push eax
call fcn.0052cc00
ret 8
push esi
mov esi, dword [esp + 0xc]
push esi
push edx
call fcn.00563600
mov eax, esi
pop esi
ret 8

Function at 0x563a00
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x563a22
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push 1
push edx
call fcn.0058ba27
add esp, 0x10
ret 8
cmp eax, 5
je 0x563a3b
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [ecx + 4]
push eax
call fcn.0052c960
ret 8
mov ecx, dword [ecx + 4]
jmp fcn.00563760
Function at 0x568f30
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5aa1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ec
mov eax, dword [esp + 0x208]
push ebx
push ebp
mov ebp, dword [esp + 0x208]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
mov bl, dl
mov dword [esp + 0x18], esi
mov dword [ebp], edi
jne 0x568f78
mov dword [esp + 0x14], 0xffffffff
jmp 0x568f7e
mov eax, dword [eax]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], edi
call fcn.00563850
mov dword [esp + 0x204], edi
mov dword [0xa49568], edi
mov edi, dword [esp + 0x214]
cmp edi, 0xffffffff
jne 0x568ffc
push 2
push 0x63a82c
push esi
call fcn.00589c37
add esp, 0xc
test eax, eax
je 0x568fce
push 0x5bc870
push esi
call fcn.0058b491
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jne 0x568ffc
push 0
push esi
lea ecx, [esp + 0x28]
call fcn.00564080
cmp dword [esp + 0x24], 0
jne 0x568ffc
lea ecx, [esp + 0x20]
mov dword [esp + 0x204], 0xffffffff
call fcn.00563e80
xor al, al
jmp 0x569181
add bl, 0x25
cmp bl, 3
jae 0x569006
mov bl, 3
movzx esi, byte [esp + 0x20c]
movzx ebx, bl
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], eax
jmp 0x569037
mov edi, dword [esp + 0x214]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x56905b
push eax
push 0x180
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.0058ba27
add esp, 0x10
mov edi, eax
jmp 0x5690aa
cmp dword [esp + 0x24], 0
je 0x56907c
push 0x180
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0x28]
call fcn.00563a00
mov edi, eax
jmp 0x5690aa
cmp edi, 0x180
jbe 0x569089
mov edi, 0x180
mov eax, dword [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.0058d090
add dword [esp + 0x24], edi
add esp, 0xc
sub dword [esp + 0x214], edi
mov eax, dword [0xa49568]
mov edx, dword [esp + 0x14]
lea ecx, [eax + edi]
cmp ecx, edx
jbe 0x569101
cmp eax, edx
jb 0x569101
xor eax, eax
test edi, edi
jle 0x56912d
movsx ecx, byte [esp + eax + 0x7c]
imul ecx, esi
add dword [ebp], ecx
add esi, 1
cmp esi, ebx
jle 0x5690d8
sub esi, ebx
mov ecx, dword [0xa49568]
add ecx, eax
cmp ecx, edx
jne 0x5690f8
mov ecx, dword [esp + 0x218]
test ecx, ecx
je 0x5690f8
mov edx, dword [ebp]
mov dword [ecx], edx
mov edx, dword [esp + 0x14]
add eax, 1
cmp eax, edi
jl 0x5690c4
jmp 0x56912d
xor eax, eax
test edi, edi
jle 0x56912d
mov ecx, dword [ebp]
lea ebx, [ebx]
movsx edx, byte [esp + eax + 0x7c]
imul edx, esi
add esi, 1
add ecx, edx
cmp esi, ebx
jle 0x569123
sub esi, ebx
add eax, 1
cmp eax, edi
jl 0x569110
mov dword [ebp], ecx
mov eax, dword [esp + 0x1c]
add eax, esi
cdq
idiv ebx
add dword [0xa49568], edi
test edi, edi
mov esi, edx
jne 0x569030
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x569159
lea ecx, [esp + 0x20]
call fcn.00563940
jmp 0x569162
push eax
call fcn.0058b205
add esp, 4
mov ecx, dword [ebp]
mov dword [0x677608], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x204], 0xffffffff
call fcn.00563e80
mov al, 1
mov ecx, dword [esp + 0x1fc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1f8
ret 0x10
Function at 0x5691a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x800
push esi
push edi
push 0x5bc870
push ecx
mov edi, edx
call fcn.0058b491
mov esi, eax
add esp, 8
test esi, esi
je 0x569239
push 0x5bc86c
push edi
call fcn.0058b491
add esp, 8
mov edi, eax
test edi, edi
push esi
je 0x569231
push 0x800
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0058ba27
add esp, 0x10
test eax, eax
jle 0x569217
jmp 0x5691f0
push edi
push eax
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.0058b709
push esi
push 0x800
lea edx, [esp + 0x20]
push 1
push edx
call fcn.0058ba27
add esp, 0x20
test eax, eax
jg 0x5691f0
push esi
call fcn.0058b205
push edi
call fcn.0058b205
add esp, 8
pop edi
mov al, 1
pop esi
add esp, 0x800
ret
call fcn.0058b205
add esp, 4
pop edi
xor al, al
pop esi
add esp, 0x800
ret

Function at 0x56a050
Capabilities:
Suspend thread

Disassembly:
mov ecx, dword [ecx]
jmp 0x571510
sub esp, 0xc
push edi
mov edi, ecx
cmp dword [edi + 4], 0
mov al, 1
mov byte [esp + 7], al
je 0x571577
lea ecx, [edi + 0x1c]
mov dword [esp + 0xc], ecx
call fcn.005712e0
cmp byte [eax], 0
mov dword [esp + 8], eax
jne 0x57156a
push ebx
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_SuspendThread]
push esi
xor esi, esi
mov eax, dword [edi + 4]
push eax
add esi, 1
call ebp
cmp eax, 0xffffffff
je 0x57155a
test eax, eax
ja 0x57157c
push esi
call ebx
cmp esi, 0x32
jl 0x571548
pop esi
pop ebp
mov byte [esp + 0xb], 0
pop ebx
mov ecx, dword [esp + 0xc]
call fcn.00408470
mov al, byte [esp + 7]
pop edi
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
pop esi
pop ebp
mov byte [ecx], 1
mov ecx, dword [esp + 0x10]
pop ebx
call fcn.00408470
mov al, byte [esp + 7]
pop edi
add esp, 0xc
ret

Function at 0x56ae00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 8], eax
push ebx
mov dword [ecx + 0xc], edx
lea eax, [esp + 8]
push eax
add ecx, 0x10
push ecx
mov ecx, dword [esp + 0x20]
push ecx
mov bl, 1
mov dword [esp + 0x14], 0x10
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
je 0x56ae44
xor al, al
pop ebx
ret 0x14
mov al, bl
pop ebx
ret 0x14

Function at 0x56ae50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov esi, ecx
push esi
push edi
mov bl, 1
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ws2_32.dll_getpeername]
test eax, eax
je 0x56ae77
xor bl, bl
lea ecx, [esp + 0xc]
push ecx
add esi, 0x10
push esi
push edi
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
je 0x56ae94
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
pop edi
pop esi
mov al, bl
pop ebx
pop ecx
ret 4

Function at 0x56aec0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [ecx]
mov edx, dword [eax + 0x70]
call edx
push 0
push 1
push 2
call dword [sym.imp.ws2_32.dll_socket]
ret