joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
cmp byte [0x5b4543], 0
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x28], eax
jne 0x4d1750
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x20
mov esi, dword [0x5b39cc]
lea edi, [esp + 0x30]
mov eax, dword [esi + 0x2c]
shr eax, 0x1f
add eax, dword [esi + 0x2c]
sar eax, 1
add ax, word [esi + 0x14]
sub ecx, eax
movsx ecx, cx
mov dword [esp + 4], ecx
mov ecx, dword [esi + 0x28]
mov eax, ecx
shr eax, 0x1f
add eax, ecx
mov ecx, edi
sar eax, 1
add ax, word [esi + 0x10]
sub edx, eax
movsx edx, dx
mov dword [esp], edx
call fcn.00548690
sub esp, 8
mov dword [esp + 8], 0xc8
lea ecx, [esp + 0x38]
mov dword [esp + 4], 0xc8
mov dword [esp], edi
call fcn.00548620
sub esp, 0xc
cmp byte [0x5b4546], 0
jne 0x4d17c4
mov dword [esp + 0x3c], 0
cmp dword [esp + 0x38], 0x4f
jg 0x4d17d3
mov dword [esp + 0x38], 0x50
movsx eax, word [esp + 0x28]
mov dword [esp + 0x14], 0
mov ecx, ebx
mov dword [esp + 0x10], eax
movsx eax, byte [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
movsx eax, bp
mov dword [esp + 4], eax
movsx eax, byte [esp + 0x20]
mov dword [esp], eax
call fcn.004d1380
sub esp, 0x18
test eax, eax
je 0x4d173e
movzx edi, word [esp + 0x2c]
cmp word [eax + 0xc], di
jne 0x4d173e
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ecx, dword [ebx + 4]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
movsx eax, word [eax + 0x18]
mov dword [esp], eax
call fcn.004d0560
sub esp, 0xc
jmp 0x4d173e

Function at 0x4d3b40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov eax, ecx
push edi
push esi
push ebx
sub esp, 4
mov edx, dword [ecx + 0xc]
mov ebp, dword [ecx + 0x10]
movsx ecx, word [ecx + 0xa]
sub ebp, edx
add ebp, ecx
movzx ecx, word [eax + 6]
test ebp, ebp
jle 0x4d3b9b
movsx edi, word [eax + 8]
movsx esi, word [eax + 2]
movsx ebx, cx
mov dword [esp], edi
mov edi, dword [eax + 0x18]
mov ecx, esi
add edi, dword [eax + 0x14]
mov eax, edi
mov edi, dword [esp]
sub eax, edx
mov edx, ebx
sub edx, esi
add edx, 1
sub edx, edi
imul eax, edx
cdq
idiv ebp
lea edx, [esi + edi - 1]
add eax, edx
cmp ebx, eax
cmovg ebx, eax
cmp esi, eax
cmovle ecx, ebx
add esp, 4
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4e8290
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
lea esi, [ebx + 0x59]
sub esp, 0x20
mov dword [esp], str.SKCONFIG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4e82f0
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edx, 0x5c
mov word [esi + eax], dx
mov dword [esp], esi
mov ecx, 0x5ba360
call fcn.0049a130
sub esp, 4
test eax, eax
je 0x4e8320
add esp, 0x20
mov eax, 1
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x5a67d1
mov dword [esp], 0x5a67d6
call sub.SDL2.dll_SDL_GetPrefPath
mov dword [esp], esi
mov dword [esp + 4], eax
mov edi, eax
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.SDL2.dll_SDL_free
jmp 0x4e82c8
mov dword [esp], ebx
mov dword [esp + 4], str.Unable_to_determine_a_location_for_storing_the_game_configuration
mov dword [esp + 0x1c], eax
call fcn.004e8200
mov byte [ebx + 0x59], 0
mov eax, dword [esp + 0x1c]
add esp, 0x20
pop ebx
pop esi
pop edi
ret

Function at 0x4e8350
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], ecx
mov dword [esp], eax
mov dword [ebp - 0x34], esp
mov dword [ebp - 0x44], 0x595d20
mov dword [ebp - 0x40], 0x598750
mov dword [ebp - 0x3c], ebp
mov dword [ebp - 0x38], 0x4e849d
call fcn.0057d6b0
mov dword [esp], str.IMAGEHALLFAME.ICN
mov ecx, 0x5ba360
mov dword [ebp - 0x58], 0xffffffff
call fcn.0049a070
sub esp, 4
test eax, eax
je 0x4e83b8
mov dword [ebp - 0x60], 1
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0057d740
mov eax, dword [ebp - 0x60]
leave
ret
mov dword [esp], str.SKDATA
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4e8490
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__chdir]
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x60], eax
call eax
mov dword [esp], str.IMAGEHALLFAME.ICN
mov ecx, 0x5ba360
call fcn.0049a070
sub esp, 4
test eax, eax
jne 0x4e839e
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x60]
mov byte [ebp - 0x18], 0
mov dword [esp], str._usr_local_share_7kaa
mov dword [ebp - 0x58], 1
call eax
mov dword [esp], str.IMAGEHALLFAME.ICN
mov ecx, 0x5ba360
mov dword [ebp - 0x58], 1
call fcn.0049a070
mov dword [ebp - 0x60], eax
sub esp, 4
test eax, eax
je 0x4e8478
mov dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
cmp eax, edx
je 0x4e83a5
mov edx, dword [ebp - 0x18]
mov dword [esp], eax
add edx, 1
mov dword [esp + 4], edx
call fcn.005950e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0057d740
mov eax, dword [ebp - 0x60]
leave
ret
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.Unable_to_locate_the_game_resources
mov dword [esp], eax
call fcn.004e8200
jmp 0x4e8445
mov eax, dword [sym.imp.msvcrt.dll__chdir]
mov dword [ebp - 0x60], eax
jmp 0x4e83f8
Function at 0x4e9dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
mov ebx, ecx
mov ecx, 0x5b77e0
sub esp, 0x34
lea esi, [esp + 0x27]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x2b], 0x302d4c4c
mov dword [esp + 0x27], 0x4f524353
mov byte [esp + 0x2f], 0
mov byte [esp + 0x2e], 0x42
call fcn.00492600
movzx edx, byte [ebx + 9]
sub esp, 0x10
lea eax, [edx - 1]
cmp al, 7
jbe 0x4e9e98
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x4e9e2e
cmp word [0x5b511d], 0
jne 0x4e9e80
xor ebx, ebx
mov edx, 7
mov eax, 8
jmp 0x4e9e4e
movsx eax, word [ebx + 0x5a6a7c]
movsx edx, word [ebx + 0x5a6a8c]
lea ecx, [eax + 0xf]
mov dword [esp + 0x10], 0xfffffff8
add ebx, 2
mov dword [esp + 0xc], ecx
lea ecx, [edx + 0x39]
mov dword [esp + 8], ecx
mov ecx, 0x5b9d7c
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00548080
sub esp, 0x14
cmp ebx, 0xe
jne 0x4e9e40
cmp word [0x5b50a7], 0
je 0x4e9ee0
add esp, 0x34
pop ebx
pop esi
ret 4
add edx, 0x30
movsx eax, al
mov dword [esp + 8], esi
mov ecx, 0x5b77e0
mov byte [esp + 0x2e], dl
movsx edx, word [eax + eax + 0x5a6a9c]
movsx eax, word [eax + eax + 0x5a6aac]
mov dword [esp + 0xc], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00492600
sub esp, 0x10
jmp 0x4e9e1c
mov dword [esp + 0x10], 0xfffffff8
mov ecx, 0x5b9d7c
mov dword [esp + 0xc], 0x2c
mov dword [esp + 8], 0x102
mov dword [esp + 4], 0x1d
mov dword [esp], 0xc9
call fcn.00548080
sub esp, 0x14
add esp, 0x34
pop ebx
pop esi
ret 4
Function at 0x5185f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
fld dword [ecx + 0x58]
mov edi, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fldz
fcompi st(1)
fstp st(0)
jae 0x5186f0
cmp byte [ecx + 0x3b], 0xd
mov ebx, ecx
je 0x5186f0
cmp byte [ecx + 9], 8
je 0x5186f0
test al, al
je 0x518700
cmp byte [ebx + 0x42], 0xf
je 0x518758
movzx esi, word [esp + 0x50]
movzx ebp, word [esp + 0x54]
xor edx, edx
mov byte [ebx + 0x42], 0xf
mov word [ebx + 0x43], dx
mov word [ebx + 0x45], si
mov word [ebx + 0x47], bp
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0
call dword [eax + 0x78]
mov ecx, 0x5ba360
sub esp, 4
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
movzx eax, word [ebx + 0x1c]
sar ax, 5
cwde
mov dword [esp + 4], eax
movzx eax, word [ebx + 0x1a]
sar ax, 5
cwde
mov dword [esp], eax
call fcn.00499d60
sub esp, 0x10
cmp eax, 3
jg 0x5187b0
xor eax, eax
mov byte [ebx + 0x3b], 0xf
mov word [ebx + 0x3c], ax
mov eax, edi
mov byte [ebx + 0xad], al
movzx eax, word [ebx + 0x1a]
mov word [ebx + 0x3e], si
sar ax, 5
mov word [ebx + 0x40], bp
mov word [ebx + 0xae], ax
movzx eax, word [ebx + 0x1c]
mov word [ebx + 0xb2], si
sar ax, 5
mov word [ebx + 0xb4], bp
mov word [ebx + 0xb0], ax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ecx, 0x5b8ac0
call fcn.004ba5f0
test eax, eax
je 0x518634
mov dword [esp + 4], 8
mov ecx, 0x5b8ac0
mov dword [esp], 0x25fd
call fcn.004ba910
movzx edx, word [ebx + 6]
sub esp, 8
mov word [eax], dx
movzx edx, word [esp + 0x50]
mov word [eax + 2], dx
movzx edx, word [esp + 0x54]
mov word [eax + 4], dx
mov edx, edi
movsx di, dl
mov word [eax + 6], di
jmp 0x5186f0
cmp word [ebx + 0x43], 0
jne 0x51863e
movsx eax, word [ebx + 0x45]
cmp dword [esp + 0x50], eax
jne 0x51863e
movsx eax, word [ebx + 0x47]
cmp dword [esp + 0x54], eax
jne 0x51863e
mov eax, edi
cmp al, byte [ebx + 0xad]
jne 0x51863e
cmp byte [ebx + 9], 1
jne 0x5186f0
movzx esi, word [esp + 0x50]
movzx ebp, word [esp + 0x54]
jmp 0x51865a
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], 0
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp], eax
call fcn.0052d7d0
sub esp, 0x20
jmp 0x5186aa
Function at 0x51dcf0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov eax, dword [0x59ad30]
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
imul eax, ebx
mov esi, dword [esp + 0x20]
add eax, edx
imul eax, eax, 0xe
add eax, dword [0x5b39d0]
movzx eax, word [eax]
and ax, 0xf00
cmp ax, 0x400
je 0x51dd30
cmp ax, 0x300
je 0x51dd50
pop ebx
pop esi
pop edi
ret 0x14
movsx esi, si
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
pop ebx
pop esi
pop edi
jmp fcn.0051d6d0
movsx esi, si
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
pop ebx
pop esi
pop edi
jmp fcn.0051da50
Function at 0x51f7e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp byte [ecx + 0x9e], 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
je 0x51f820
cmp byte [ecx + 0x71], 0
je 0x51f820
cwde
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp fcn.0051ec90
mov dword [esp], 2
call fcn.0052c430
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret 0x10
Function at 0x52c9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x3c
movzx eax, word [ebx + 0x1c]
movzx edi, word [ebx + 0x1a]
mov edx, dword [0x59ad30]
mov esi, dword [esp + 0x54]
sar ax, 5
sar di, 5
mov ecx, dword [0x5b39d0]
cwde
movsx edi, di
imul eax, edx
imul edx, esi
add edx, dword [esp + 0x50]
imul edx, edx, 0xe
add eax, edi
imul eax, eax, 0xe
movzx edx, byte [ecx + edx + 0xc]
cmp byte [ecx + eax + 0xc], dl
je 0x52ca70
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [esp + 0x50]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp], esi
call dword [eax + 0x7c]
sub esp, 0x20
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
fld dword [ebx + 0x58]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fldz
fcompi st(1)
fstp st(0)
jae 0x52ca5f
movzx eax, byte [ebx + 0x3b]
cmp al, 0xd
je 0x52ca5f
movzx edx, byte [ebx + 9]
cmp dl, 8
je 0x52ca5f
cmp byte [ebx + 0x42], 0xe
jne 0x52caa2
cmp al, 0xe
je 0x52cb70
mov ecx, dword [esp + 0x50]
xor edi, edi
test ecx, ecx
cmovns edi, dword [esp + 0x50]
cmp dword [esp + 0x58], 1
jg 0x52cac8
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x58]
lea edi, [eax + 1]
xor eax, eax
test edi, edi
cmovs edi, eax
xor ebp, ebp
test esi, esi
cmovns ebp, esi
cmp dword [esp + 0x5c], 1
jg 0x52cae4
sub esi, dword [esp + 0x5c]
xor eax, eax
lea ebp, [esi + 1]
test ebp, ebp
cmovs ebp, eax
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0
call dword [eax + 0x78]
mov ecx, ebx
sub esp, 4
mov dword [esp + 4], ebp
mov dword [esp], edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 4
mov dword [esp + 8], 4
call fcn.00516ad0
xor eax, eax
xor edx, edx
mov byte [ebx + 0x42], 0xe
mov word [ebx + 0x43], ax
movzx eax, word [ebx + 0x52]
sub esp, 0x20
mov byte [ebx + 0x3b], 0xe
mov word [ebx + 0x45], ax
mov word [ebx + 0x3e], ax
movzx eax, word [ebx + 0x54]
mov word [ebx + 0x3c], dx
mov word [ebx + 0x47], ax
mov word [ebx + 0x40], ax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
movsx ecx, word [ebx + 0x45]
mov eax, ecx
cmp ecx, dword [esp + 0x50]
jne 0x52caa2
movsx edi, word [ebx + 0x47]
cmp edi, esi
jne 0x52caa2
mov word [ebx + 0x3e], ax
mov word [ebx + 0x40], di
cmp dl, 1
je 0x52caa2
cmp dword [ebx + 0x77], 0
jne 0x52ca5f
movzx eax, byte [ebx + 0xa]
mov byte [ebx + 0xe], 0
mov byte [ebx + 9], 1
mov byte [ebx + 0xd], al
jmp 0x52ca5f
Function at 0x52cdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
movzx eax, word [ecx + 0x1c]
movzx edi, word [ecx + 0x1a]
mov edx, dword [0x59ad30]
mov esi, dword [esp + 0x54]
sar ax, 5
sar di, 5
mov ebx, dword [0x5b39d0]
cwde
movsx edi, di
imul eax, edx
imul edx, esi
add edx, dword [esp + 0x50]
imul edx, edx, 0xe
add eax, edi
imul eax, eax, 0xe
movzx edx, byte [ebx + edx + 0xc]
cmp byte [ebx + eax + 0xc], dl
je 0x52ce48
mov eax, dword [ecx]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp], esi
call dword [eax + 0x7c]
sub esp, 0x20
add esp, 0x40
pop ebx
pop esi
pop edi
ret 0x18
fld dword [ecx + 0x58]
fstp dword [esp + 0x3c]
fld dword [esp + 0x3c]
fldz
fcompi st(1)
fstp st(0)
jae 0x52ce3a
movzx eax, byte [ecx + 0x3b]
cmp al, 0xd
je 0x52ce3a
movzx edx, byte [ecx + 9]
cmp dl, 8
je 0x52ce3a
cmp byte [ecx + 0x42], 0xe
jne 0x52ce7a
cmp al, 0xe
je 0x52cf80
mov edi, dword [esp + 0x50]
xor ebx, ebx
test edi, edi
cmovns ebx, dword [esp + 0x50]
cmp dword [esp + 0x58], 1
jg 0x52cea0
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x58]
lea ebx, [eax + 1]
xor eax, eax
test ebx, ebx
cmovs ebx, eax
xor edi, edi
test esi, esi
cmovns edi, esi
cmp dword [esp + 0x5c], 1
jg 0x52cebc
sub esi, dword [esp + 0x5c]
xor eax, eax
lea edi, [esi + 1]
test edi, edi
cmovs edi, eax
mov esi, dword [esp + 0x60]
test esi, esi
jle 0x52cfcb
mov eax, dword [0x5b5310]
cmp dword [esp + 0x60], eax
jg 0x52cfcb
mov eax, dword [esp + 0x60]
mov edx, dword [0x5b531d]
mov dword [esp + 0x2c], ecx
sub eax, 1
imul eax, dword [0x5b5314]
mov eax, dword [edx + eax]
mov esi, dword [eax + 0x1e]
mov eax, dword [ecx]
mov dword [esp], 0
call dword [eax + 0x78]
sub esp, 4
mov dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
movsx eax, word [esi + 0x10]
mov dword [esp + 0xc], eax
movsx eax, word [esi + 0xe]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00516ad0
xor eax, eax
xor edx, edx
sub esp, 0x20
mov ecx, dword [esp + 0x2c]
mov word [ecx + 0x43], ax
movzx eax, word [ecx + 0x52]
mov byte [ecx + 0x42], 0xe
mov word [ecx + 0x45], ax
mov word [ecx + 0x3e], ax
movzx eax, word [ecx + 0x54]
mov byte [ecx + 0x3b], 0xe
mov word [ecx + 0x3c], dx
mov word [ecx + 0x47], ax
mov word [ecx + 0x40], ax
jmp 0x52ce3a
movsx ebx, word [ecx + 0x45]
mov eax, ebx
cmp ebx, dword [esp + 0x50]
jne 0x52ce7a
movsx edi, word [ecx + 0x47]
cmp edi, esi
jne 0x52ce7a
mov word [ecx + 0x3e], ax
mov word [ecx + 0x40], di
cmp dl, 1
je 0x52ce7a
cmp dword [ecx + 0x77], 0
jne 0x52ce3a
movzx eax, byte [ecx + 0xa]
mov byte [ecx + 0xe], 0
mov byte [ecx + 9], 1
mov byte [ecx + 0xd], al
jmp 0x52ce3a
mov eax, dword [0x1e]
ud2
Function at 0x52e0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x50]
movzx eax, word [edx]
mov ebx, eax
and bx, 0xf00
cmp bx, 0x300
je 0x52e190
mov ebx, eax
and bx, 0xe00
cmp bx, 0x400
je 0x52e190
movzx esi, word [ecx + 0x1a]
mov edi, esi
sar di, 5
cmp di, word [ecx + 0x52]
je 0x52e1f8
movzx ebx, byte [ecx + 8]
cmp bl, 0x4c
je 0x52e288
cmp bl, 0x53
je 0x52e270
cmp bl, 0x41
je 0x52e238
movzx eax, word [ecx + 0x1c]
mov word [ecx + 0x16], si
mov word [ecx + 0x52], di
mov word [ecx + 0x18], ax
sar ax, 5
mov word [ecx + 0x54], ax
mov eax, dword [ecx + 0x77]
mov byte [ecx + 0xb], 1
test eax, eax
je 0x52e15f
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.00565f80
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 0x77], 0
movzx eax, byte [ecx + 0xa]
mov dword [ecx + 0x7b], 0
mov dword [ecx + 0x7f], 0
mov byte [ecx + 0xd], al
mov byte [ecx + 0xe], 0
mov byte [ecx + 9], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ecx + 0x77]
test eax, eax
je 0x52e1ae
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.00565f80
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 0x77], 0
mov dword [ecx + 0x7b], 0
mov dword [ecx + 0x7f], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
movsx eax, word [ecx + 0x54]
mov dword [esp + 4], eax
movsx eax, word [ecx + 0x52]
mov dword [esp], eax
call fcn.00526320
sub esp, 0x14
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 4
movzx ebx, word [ecx + 0x1c]
mov ebp, ebx
sar bp, 5
cmp bp, word [ecx + 0x54]
jne 0x52e106
cmp byte [ecx + 0x35], 0
jne 0x52e106
mov eax, dword [ecx + 0x77]
mov word [ecx + 0x16], si
mov word [ecx + 0x18], bx
mov byte [ecx + 0xb], 1
test eax, eax
jne 0x52e148
jmp 0x52e15f
mov byte [ecx + 0x34], 1
movsx eax, word [edx + 6]
test eax, eax
jle 0x52e290
cmp eax, dword [0x5b5310]
jg 0x52e290
sub eax, 1
imul eax, dword [0x5b5314]
mov edx, dword [0x5b531d]
mov eax, dword [edx + eax]
mov dword [esp + 0x50], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00526cd0
and eax, 2
test eax, eax
je 0x52e125
mov byte [ecx + 0x34], 1
movsx eax, word [edx + 4]
jmp 0x52e240
and eax, 1
jmp 0x52e273
xor eax, eax
mov dword [esp + 0x50], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00526cd0
Function at 0x55bf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ebp, [esp + 0x48]
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x34], eax
mov dword [esp], ebp
call eax
sub esp, 4
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov dword [esp + 0x28], 0
mov edx, eax
xor eax, eax
add esi, eax
adc edi, edx
mov eax, edi
or eax, esi
je 0x55bff0
mov eax, esi
mov dword [esp + 0x2c], 0
add eax, edi
mov dword [esp + 8], 0xf4240
adc eax, 0
mov dword [esp + 0xc], 0
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
mov eax, edx
and edx, 0xfffffffc
shr eax, 2
add eax, edx
mov edx, edi
sub ecx, eax
mov eax, esi
mov dword [esp + 0x28], ecx
sub eax, dword [esp + 0x28]
sbb edx, dword [esp + 0x2c]
mov esi, eax
imul ecx, edx, 0xcccccccd
imul edx, eax, 0xcccccccc
mov eax, 0xcccccccd
add ecx, edx
mul esi
add edx, ecx
lea ecx, [esp + 0x38]
shrd eax, edx, 1
shr edx, 1
mov dword [esp + 0x10], ecx
add eax, 0xb779c000
adc edx, 0xffd6a169
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0057d170
xor eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
nop
call sub.msvcrt.dll__getpid
xor edi, edi
shl eax, 0x10
xor eax, dword [esp + 0x28]
xor eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov dword [esp], ebp
mov eax, dword [esp + 0x34]
call eax
sub esp, 4
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, eax
xor eax, eax
add eax, esi
adc edx, edi
mov edi, eax
mov eax, edx
mov ebp, edx
or eax, edi
je 0x55c0ca
mov esi, edi
mov ecx, 0xcccccccd
mov dword [esp + 0x2c], 0
add esi, edx
mov dword [esp + 8], 0xf4240
adc esi, 0
mov dword [esp + 0xc], 0
mov eax, esi
mul ecx
mov eax, edx
and edx, 0xfffffffc
shr eax, 2
add edx, eax
mov eax, edi
sub esi, edx
mov edx, ebp
mov dword [esp + 0x28], esi
sub eax, dword [esp + 0x28]
sbb edx, dword [esp + 0x2c]
imul esi, edx, 0xcccccccd
imul edx, eax, 0xcccccccc
add esi, edx
mul ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], ecx
add edx, esi
shrd eax, edx, 1
shr edx, 1
add eax, 0xb779c000
adc edx, 0xffd6a169
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0057d170
xor eax, dword [esp + 0x38]
mov esi, eax
and esi, 0x1f
je 0x55c0ca
lea esi, [esi]
call sub.msvcrt.dll_rand
sub esi, 1
jne 0x55c0c0
mov esi, dword [esp + 0x74]
mov eax, dword [esp + 0x74]
add esi, ebx
test eax, eax
jle 0x55c0f2
lea esi, [esi]
nop
call sub.msvcrt.dll_rand
add ebx, 1
sar eax, 7
xor byte [ebx - 1], al
cmp ebx, esi
jne 0x55c0e0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x563430
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push ebx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
test ecx, ecx
jle 0x563551
movzx eax, byte [ebx]
lea edx, [ebx + 1]
cmp ecx, 1
je 0x5634de
add ebx, ecx
lea esi, [esi]
shl eax, 8
add edx, 1
mov ecx, eax
movzx eax, byte [edx - 1]
or eax, ecx
mov esi, eax
xor esi, 0xa580
and ch, 0x80
cmovne eax, esi
mov ecx, eax
xor ecx, 0x52c0
test ah, 0x40
cmovne eax, ecx
mov ecx, eax
xor ecx, 0x2960
test ah, 0x20
cmovne eax, ecx
mov ecx, eax
xor ecx, 0x14b0
test ah, 0x10
cmovne eax, ecx
mov ecx, eax
xor ecx, 0xa58
test ah, 8
cmovne eax, ecx
mov ecx, eax
xor ecx, 0x52c
test ah, 4
cmovne eax, ecx
mov ecx, eax
xor ecx, 0x296
test ah, 2
cmovne eax, ecx
mov ecx, eax
xor ecx, 0x14b
test ah, 1
cmovne eax, ecx
cmp edx, ebx
jne 0x563458
shl eax, 8
mov edx, eax
xor edx, 0xa580
test ah, 0x80
cmovne eax, edx
mov edx, eax
xor edx, 0x52c0
test ah, 0x40
cmovne eax, edx
mov edx, eax
xor edx, 0x2960
test ah, 0x20
cmovne eax, edx
mov edx, eax
xor edx, 0x14b0
test ah, 0x10
cmovne eax, edx
mov edx, eax
xor edx, 0xa58
test ah, 8
cmovne eax, edx
mov edx, eax
xor edx, 0x52c
test ah, 4
cmovne eax, edx
mov edx, eax
xor edx, 0x296
test ah, 2
cmovne eax, edx
mov edx, eax
xor edx, 0x14b
test ah, 1
cmovne eax, edx
pop ebx
pop esi
ret