joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x4c5150
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.0054f938
test byte [esp + 4], 1
jne 0x4c4f9f
mov eax, dword [esp]
jmp 0x4c5143
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.0054f94a
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.0054f9b6
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x18]
push 0x556440
call fcn.0054f9a4
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
test byte [esp + 4], 1
je 0x4c501f
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0054f518
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x4c5048
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x4c504e
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.0054f9aa
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.005394d0
test byte [esp + 0x30], 1
jne 0x4c50ca
test byte [esp + 0xc], 1
jne 0x4c50dd
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4c50aa
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x4c50f3
test byte [esp + 0x18], 1
jne 0x4c5106
test byte [esp + 0x44], 1
jne 0x4c5119
xor eax, eax
test byte [esp + 4], 1
jne 0x4c512e
jmp 0x4c5143
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x4c509d
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4c50a5
jmp 0x4c50aa
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x4c50b8
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x4c50bf
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor eax, eax
test byte [esp + 4], 1
je 0x4c5143
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x4c5143
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d1570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x6c], eax
mov esi, dword [eax + 0x3c]
mov esi, dword [esi]
movzx esi, word [esi + 0x12]
mov edi, dword [ebp + 0xc]
cmp esi, 8
je 0x4d16ca
cmp esi, 0xa4
je 0x4d160b
mov dword [esp + 0xc], ebx
cmp esi, 0xb7
jne case.0x4c4376.47
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
mov esi, dword [ebp + 0xc]
adc esi, 0xffffffff
xor eax, eax
mov edi, 0xe
cmp edi, ebx
sbb eax, esi
jb case.0x4c4376.47
jmp dword [ebx*4 + 0x564d4c]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, edi
je 0x4d170a
mov eax, ecx
xor eax, 0x70000002
or eax, edi
je 0x4d170a
mov dword [esp + 0xc], ebx
mov eax, ecx
xor eax, 0x70000001
or eax, edi
mov ecx, esi
je case.0x4c4376.36
mov dword [esp + 0xc], ebx
mov eax, edi
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
adc eax, 0xffffffff
xor esi, esi
mov edi, 0x35
cmp edi, ebx
sbb esi, eax
jb case.0x4c4376.47
jmp dword [ebx*4 + 0x564c74]
mov ecx, esi
Function at 0x4d26f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, ecx
cmp byte [edx + 0x40], 0
je 0x4d2730
mov ecx, edx
call fcn.004cd4d0
test edx, edx
je 0x4d273a
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov ebp, edx
mov ebx, dword [edi + 8]
sub ebp, ecx
jbe 0x4d2793
and byte [esi + 8], 0xfe
lea ecx, [edi + ebx*8]
lea eax, [ecx + eax*4]
add eax, 0x10
mov dword [esi], eax
mov dword [esi + 4], ebp
jmp 0x4d278b
mov dword [esp + 0x20], str.no_dynamic_symbol_table_found
jmp 0x4d2742
mov dword [esp + 0x20], str.the_dynamic_symbol_table_is_empty
mov word [esp + 0x30], 0x103
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.0054f3f2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x20]
mov dword [esp], eax
mov ecx, edi
call fcn.0054f20c
sub esp, 0xc
or byte [esi + 8], 1
mov dword [esi], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x4d27bd
lea edi, [edi + ebx*8]
add edi, 0x10
shl eax, 2
xor ebx, ebx
nop word cs:[eax + eax]
cmp dword [edi + ebx], 0
jne 0x4d27d0
add ebx, 4
cmp eax, ebx
jne 0x4d27b0
and byte [esi + 8], 0xfe
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x4d278b
mov dword [esp + 0x3c], str.the_first_hashed_symbol_index__
mov dword [esp + 0x44], ecx
mov word [esp + 0x4c], 0x903
lea eax, [esp + 0x3c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], str.__is_greater_than_or_equal_to_the_number_of_dynamic_symbols__
mov word [esp + 0x60], 0x302
lea eax, [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
mov word [esp + 0x1c], 0x902
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x5564e0
mov word [esp + 0x30], 0x302
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.0054f3f2
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 3
movsd xmm0, qword [esp + 0x34]
jmp 0x4d276e
Function at 0x502b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, ecx
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
add ecx, 0x1d0
call fcn.005026e0
mov edi, eax
xor esi, esi
cmp edx, esi
je 0x50328b
inc esi
mov ecx, dword [eax]
or ecx, dword [eax + 4]
lea eax, [eax + 0x10]
jne 0x502b50
test esi, esi
je 0x503295
add edi, 8
shl esi, 4
mov dword [esp + 0x7c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
nop dword [eax]
mov esi, edx
test esi, esi
jne 0x502b6b
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
jmp 0x5032b3
Function at 0x5038b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x503ac0
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.0054f8f0
test byte [esp + 4], 1
jne 0x50390f
mov eax, dword [esp]
jmp 0x503ab3
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.0054f902
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.0054f9b6
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x18]
push 0x556440
call fcn.0054f9a4
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
test byte [esp + 4], 1
je 0x50398f
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0054f518
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x5039b8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x5039be
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.0054f9aa
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.005394d0
test byte [esp + 0x30], 1
jne 0x503a3a
test byte [esp + 0xc], 1
jne 0x503a4d
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x503a1a
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x503a63
test byte [esp + 0x18], 1
jne 0x503a76
test byte [esp + 0x44], 1
jne 0x503a89
xor eax, eax
test byte [esp + 4], 1
jne 0x503a9e
jmp 0x503ab3
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x503a0d
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x503a15
jmp 0x503a1a
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x503a28
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x503a2f
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor eax, eax
test byte [esp + 4], 1
je 0x503ab3
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x503ab3
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x510100
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x6c], eax
mov esi, dword [eax + 0x3c]
mov esi, dword [esi]
movzx esi, word [esi + 0x12]
rol si, 8
mov edi, dword [ebp + 0xc]
cmp si, 8
je 0x510262
movzx esi, si
cmp esi, 0xa4
je 0x5101a3
mov dword [esp + 0xc], ebx
cmp esi, 0xb7
jne case.0x502c40.47
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
mov esi, dword [ebp + 0xc]
adc esi, 0xffffffff
xor eax, eax
mov edi, 0xe
cmp edi, ebx
sbb eax, esi
jb case.0x502c40.47
jmp dword [ebx*4 + 0x56511c]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, edi
je 0x5102a2
mov eax, ecx
xor eax, 0x70000002
or eax, edi
je 0x5102a2
mov dword [esp + 0xc], ebx
mov eax, ecx
xor eax, 0x70000001
or eax, edi
mov ecx, esi
je case.0x502c40.36
mov dword [esp + 0xc], ebx
mov eax, edi
mov ebx, dword [ebp + 8]
add ebx, 0x8fffffff
adc eax, 0xffffffff
xor esi, esi
mov edi, 0x35
cmp edi, ebx
sbb esi, eax
jb case.0x502c40.47
jmp dword [ebx*4 + 0x565044]
mov ecx, esi
Function at 0x537ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 8], eax
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0xc], xmm0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
xor edi, edi
or ecx, eax
je 0x537d5e
mov ebx, esp
nop dword [eax + eax]
inc edi
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
jne 0x537d40
test edi, edi
je 0x537e03
cmp edi, 0x15555556
jae 0x537e0d
lea ebp, [esp + 0x2c]
shl edi, 2
lea ebx, [edi + edi*2]
push ebx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov dword [esi], eax
mov dword [esi + 4], eax
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
movsd xmm0, qword [ebp]
movsd qword [esp], xmm0
lea eax, [esp + 0x38]
movsd xmm0, qword [eax]
movsd qword [esp + 0xc], xmm0
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
je 0x537e00
mov ebx, esp
nop dword [eax]
mov eax, dword [esp + 8]
mov dword [edi + 8], eax
movsd xmm0, qword [esp]
movsd qword [edi], xmm0
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
add edi, 0xc
mov eax, dword [esp]
xor eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
xor ecx, dword [esp + 0x10]
or ecx, eax
jne 0x537dd0
mov dword [esi + 4], edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov ecx, esi
call fcn.00537f60
int3
Function at 0x5394f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x5396bc
mov esi, dword [ebp + 0x10]
cmp ebx, esi
jae 0x5395b0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], str.offset__0x
lea eax, [esp + 0x30]
mov dword [esp + 0x48], eax
mov word [esp + 0x50], 0xf03
lea eax, [esp + 0x40]
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], str.__is_past_the_end_of_the_contents__size_0x
mov word [esp + 0x64], 0x302
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x54]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x70], eax
mov word [esp + 0x78], 0xf02
lea eax, [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x56a946
mov word [esp + 0x24], 0x302
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x5396c6
mov edx, dword [eax]
lea esi, [esp + 0x14]
lea ecx, [esp + 0x3c]
push esi
push eax
call dword [edx + 0x18]
jmp 0x5396bc
jl 0x5396bc
lea eax, [ebp + 8]
mov eax, dword [eax]
add ebx, eax
mov dword [esp + 0x10], eax
add esi, eax
mov dword [esp + 8], ebx
jmp 0x5395e3
mov edi, 1
mov esi, dword [esp + 0xc]
add esi, edi
cmp esi, ebx
ja 0x5396bc
mov eax, ebx
sub eax, esi
push eax
push esi
call fcn.00549b20
add esp, 8
test eax, eax
mov dword [esp + 0xc], esi
je 0x5395d0
mov edi, eax
mov ebx, dword [esp + 4]
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
sub esi, dword [esp + 0x10]
mov dword [esp + 0x18], str.__6tx_
mov dword [esp + 0x14], 0x551330
mov dword [esp + 0x1c], esi
mov ecx, eax
lea eax, [esp + 0x14]
push eax
call fcn.0054f24e
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
mov ebx, eax
xor esi, esi
jmp 0x53964d
lea edx, [ecx + 1]
mov dword [ebx + 0x10], edx
mov byte [ecx], al
inc esi
cmp edi, esi
je 0x53967c
mov eax, dword [esp + 0xc]
movzx eax, byte [eax + esi]
mov ecx, eax
add cl, 0xe0
cmp cl, 0x5f
jb 0x539664
mov eax, 0x2e
mov ecx, dword [ebx + 0x10]
cmp ecx, dword [ebx + 0xc]
jb 0x539640
movzx eax, al
mov ecx, ebx
push eax
call fcn.0054f22a
inc esi
cmp edi, esi
jne 0x53964d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x90]
mov ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0xc]
jae 0x5396a0
lea edx, [ecx + 1]
mov dword [eax + 0x10], edx
mov byte [ecx], 0xa
jmp 0x5396a9
mov ecx, eax
push 0xa
call fcn.0054f22a
mov ebx, dword [esp + 8]
inc edi
mov esi, dword [esp + 0xc]
add esi, edi
cmp esi, ebx
jbe 0x5395e3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.0043e320
int3
Function at 0x549cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x549cd1
jmp dword [eax*4 + 0x56e444]
cmp dword [0x5770ec], 0
je 0x549de0
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x577108]
test edi, edi
je 0x549dd5
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x549d1b
mov edi, dword [edi + 8]
test edi, edi
je 0x549dd5
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x549d10
test esi, esi
je 0x549d10
mov ecx, dword [edi + 4]
call dword [0x56e8cc]
push esi
call ecx
add esp, 4
jmp 0x549d10
call fcn.00549510
jmp case.default.0x549cd1
cmp dword [0x5770ec], 0
je case.default.0x549cd1
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x577108]
test edi, edi
je 0x549dc8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x549d87
mov edi, dword [edi + 8]
test edi, edi
je 0x549dc8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x549d80
test esi, esi
je 0x549d80
mov ecx, dword [edi + 4]
call dword [0x56e8cc]
push esi
call ecx
add esp, 4
jmp 0x549d80
cmp dword [0x5770ec], 0
jne 0x549dbc
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x5770ec], 1
jmp case.default.0x549cd1
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x549cd1
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5770ec]
cmp eax, 1
jne case.default.0x549cd1
mov eax, dword [0x577108]
test eax, eax
je 0x549e12
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x549e00
mov dword [0x577108], 0
mov dword [0x5770ec], 0
push 0x5770f0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x549f50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x550004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x549fb6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x549fb6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x549fb6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x549fb6
mov edx, dword [esp + 0xc]
sub edx, dword [0x550004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x549fa6
add esi, 0x28
dec ecx
je 0x549fb6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x549fa0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x549fa0
mov eax, esi
pop esi
pop edi
ret
Function at 0x10004f10
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [edx - 2]
cmp ecx, 0xa
ja case.default.0x10004f1c
jmp dword [ecx*4 + 0x10005078]
cmp al, 0x40
jne 0x10004f2d
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x10004f3c
cmp cl, 0x7a
jbe 0x10004f8c
cmp al, 0x30
jl 0x10004f44
cmp al, 0x39
jle 0x10004f8c
cmp al, 0x2d
je 0x10004f8c
cmp al, 0x5f
je 0x10004f8c
cmp al, 0x2e
je 0x10004f8c
cmp al, 0x21
je 0x10004f8c
cmp al, 0x7e
je 0x10004f8c
cmp al, 0x2a
je 0x10004f8c
cmp al, 0x27
je 0x10004f8c
cmp al, 0x28
je 0x10004f8c
cmp al, 0x29
je 0x10004f8c
cmp al, 0x25
je 0x10004f8c
cmp al, 0x3b
je 0x10004f8c
cmp al, 0x3a
je 0x10004f8c
cmp al, 0x26
je 0x10004f8c
cmp al, 0x3d
je 0x10004f8c
cmp al, 0x2b
je 0x10004f8c
cmp al, 0x24
je 0x10004f8c
cmp al, 0x2c
jne case.default.0x10004f1c
mov eax, 3
ret
cmp al, 0x5b
jne 0x10004f9c
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x10004fab
cmp cl, 0x7a
jbe 0x10004fbf
cmp al, 0x30
jl 0x10004fb3
cmp al, 0x39
jle 0x10004fbf
cmp al, 0x2e
je 0x10004fbf
cmp al, 0x2d
jne case.default.0x10004f1c
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x10004fd4
cmp cl, 0x7a
jbe 0x10004fbf
cmp al, 0x30
jl 0x10004fdc
cmp al, 0x39
jle 0x10004fbf
cmp al, 0x2e
je 0x10004fbf
cmp al, 0x2d
je 0x10004fbf
cmp al, 0x3a
jne case.default.0x10004f1c
mov eax, 0xb
ret
cmp al, 0x5d
jne case.0x10004f1c.5
mov eax, 8
ret
cmp al, 0x30
jl 0x10005004
cmp al, 0x39
jle 0x1000502a
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x10005013
cmp cl, 0x66
jbe 0x1000502a
cmp al, 0x3a
je 0x1000502a
cmp al, 0x2e
je 0x1000502a
cmp edx, 7
jne case.default.0x10004f1c
cmp al, 0x25
jne case.default.0x10004f1c
mov eax, 9
ret
mov eax, 7
ret
cmp al, 0x5d
je 0x10004ff6
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x10005043
cmp cl, 0x7a
jbe 0x1000505f
cmp al, 0x30
jl 0x1000504b
cmp al, 0x39
jle 0x1000505f
cmp al, 0x25
je 0x1000505f
cmp al, 0x2e
je 0x1000505f
cmp al, 0x2d
je 0x1000505f
cmp al, 0x5f
je 0x1000505f
cmp al, 0x7e
jne case.default.0x10004f1c
mov eax, 0xa
ret
sub al, 0x30
cmp al, 9
mov eax, 0xc
jbe 0x10005075
mov eax, 1
ret
Function at 0x10005770
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x1000577b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.10005790
Function at 0x1000c060
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127c58
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x1019f010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test byte [0x101a4e64], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [edi], vtable.CTcpServer.0
mov dword [edi + 4], ebx
mov dword [edi + 8], 0x2710
jne 0x1000c0ea
or dword [0x101a4e64], 1
lea eax, [ebp - 0x30]
push eax
call esi
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1f4
jae 0x1000c0e0
lea eax, [ebp - 0x54]
push eax
call esi
mov ecx, dword [ebp - 0x40]
lea edx, [ecx + ecx + 2]
mov dword [0x101a4e60], edx
jmp 0x1000c0ea
mov dword [0x101a4e60], 0x1f4
test byte [0x101a4e5c], 1
mov eax, dword [0x101a4e60]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], getpeername
mov dword [edi + 0x14], 0x12c
jne 0x1000c11f
or dword [0x101a4e5c], 1
lea ecx, [ebp - 0x78]
push ecx
call esi
mov edx, dword [ebp - 0x74]
mov dword [0x101a4e58], edx
mov eax, dword [0x101a4e58]
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0x3a98
mov dword [edi + 0x20], 0x96
mov dword [edi + 0x24], 0x12c
mov dword [edi + 0x28], 0x258
mov dword [edi + 0x2c], 0x4b0
mov dword [edi + 0x30], 0x7530
mov dword [edi + 0x34], 0x2710
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
xor ecx, ecx
mov word [edi + 0x48], cx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x50], 0xffffffff
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], 3
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [edi + 0x70], eax
lea esi, [edi + 0x80]
call fcn.100112c0
lea eax, [edi + 0x164]
mov byte [ebp - 4], 3
mov dword [edi + 0x160], ebx
push eax
call fcn.10011410
mov dword [edi + 0x2b0], ebx
mov eax, dword [edi + 0x2b0]
mov dword [edi + 0x2ac], ebx
mov dword [edi + 0x2f0], ebx
mov dword [edi + 0x330], ebx
cmp eax, ebx
je 0x1000c20a
push eax
call fcn.1010ef42
mov dword [edi + 0x2b0], ebx
mov dword [edi + 0x2ac], ebx
mov dword [edi + 0x2f0], ebx
add esp, 4
mov dword [edi + 0x330], ebx
mov byte [ebp - 4], 5
mov dword [edi + 0x370], ebx
push 8
mov dword [edi + 0x374], ebx
call fcn.1010ee2e
add esp, 4
cmp eax, ebx
je 0x1000c22f
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x1000c231
xor eax, eax
mov dword [edi + 0x37c], eax
mov dword [edi + 0x378], eax
mov dword [edi + 0x380], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8