joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406817
Capabilities:
Get system information on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov cl, byte [eax + 0x54]
test ecx, ecx
jne 0x406831
jmp 0x4068db
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x28], 0
jmp 0x40684d
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + ecx + 2]
cmp dword [ebp - 0x28], edx
jae 0x40686e
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
jmp 0x406844
push 1
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xa
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x58]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x58]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x2c]
call fcn.00406691
mov eax, dword [ebp - 0x2c]
add eax, 0x3c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x54], 0
mov esp, ebp
pop ebp
ret
Function at 0x420539
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x42055b
cmp dword [edi + 0x3c], 0
jne 0x42055b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0042cc77
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00420588
pop edi
pop esi
pop ebx
ret 8

Function at 0x421b93
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421bcb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00424997
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042496f
jmp 0x421bd7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x421bdb
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x442a30
mov ecx, edi
call fcn.004246e7
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x421c2e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x421c41
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00424997
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.0042496f
jmp 0x421c41
mov ecx, esi
call fcn.00423b61
test eax, eax
je 0x421c41
push edi
mov ecx, eax
call fcn.00421b93
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x423389
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4233cb
call fcn.0042cc77
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4233cb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4233c2
xor eax, eax
jmp 0x4233d3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004233d9
pop edi
pop esi
pop ebx
ret 4
Function at 0x42daae
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42dadc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42dafa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042da14
jmp 0x42dafa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42dafa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042da14
test edi, edi
mov eax, edi
jne 0x42dae4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x51ad60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x51adc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x51adb7
mov edx, dword [0x5899e8]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x51adab
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x51ad90
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x51adb9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x521720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x52178c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x5217d3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0054bdd8
add esp, 8
test eax, eax
jne 0x5217d1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x5217d5
jmp 0x521783
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x52efd0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x57b2e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0052a4e0
add esp, 4
movzx edx, al
test edx, edx
je 0x52f061
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00540b70
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x52f05f
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x52f05f
jmp 0x52f061
jmp 0x52efe3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005412c5
mov esp, ebp
pop ebp
ret
Function at 0x531f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555fd7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57b2e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00530630
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00530630
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00530630
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00531910
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00531910
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00531910
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x532150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556087
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57b2e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.005304f0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.005304f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.005304f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00531930
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00531930
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00531930
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x53c0fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x53c183
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00540bf0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x53c146
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x53c168
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x53c1de
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.0053becc
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x53c1ca
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x53c1de
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x53c107
pop esi
pop ebx
leave
ret
Function at 0x5412c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x57b2e0]
jne 0x5412cf
repz ret
jmp fcn.00547a04

Function at 0x548318
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x57b5e0]
je 0x548333
inc edi
cmp edi, 0x17
jb 0x548324
cmp edi, 0x17
jae 0x5484b3
push ebp
push 3
call fcn.0054e724
cmp eax, 1
pop ecx
je 0x54847f
push 3
call fcn.0054e724
test eax, eax
pop ecx
jne 0x548367
cmp dword [0x57b420], 1
je 0x54847f
cmp ebx, 0xfc
je 0x5484b2
push 0x582194
mov ebx, 0x314
push ebx
mov ebp, 0x58b018
push ebp
call fcn.005481ac
add esp, 0xc
test eax, eax
je 0x54839d
push esi
push esi
push esi
push esi
push esi
call fcn.005434eb
add esp, 0x14
push 0x104
mov esi, 0x58b031
push esi
push 0
mov byte [0x58b135], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5483e1
push 0x58217c
push 0x2fb
push esi
call fcn.005481ac
add esp, 0xc
test eax, eax
je 0x5483e1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.005434eb
add esp, 0x14
push esi
call fcn.00542fc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x548426
push esi
call fcn.00542fc0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x58b32c
push 0x582178
sub ecx, eax
push ecx
push eax
call fcn.0054d26f
add esp, 0x14
test eax, eax
je 0x548426
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.005434eb
add esp, 0x14
jmp 0x548428
xor esi, esi
push 0x57ca58
push ebx
push ebp
call fcn.0054d1fe
add esp, 0xc
test eax, eax
je 0x548448
push esi
push esi
push esi
push esi
push esi
call fcn.005434eb
add esp, 0x14
push dword [edi*8 + 0x57b5e4]
push ebx
push ebp
call fcn.0054d1fe
add esp, 0xc
test eax, eax
je 0x54846a
push esi
push esi
push esi
push esi
push esi
call fcn.005434eb
add esp, 0x14
push 0x12010
push 0x582150
push ebp
call fcn.0054e567
add esp, 0xc
jmp 0x5484b2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x5484b2
cmp ebp, 0xffffffff
je 0x5484b2
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x57b5e4]
push dword [esi]
call fcn.00542fc0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x54e567
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00547be2
xor ebx, ebx
cmp dword [0x58b6f8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x54e63d
push 0x5832a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x54e71d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x583298
push edi
call esi
cmp eax, ebx
je 0x54e71d
push eax
call fcn.00547b74
mov dword [esp], 0x583288
push edi
mov dword [0x58b6f8], eax
call esi
push eax
call fcn.00547b74
mov dword [esp], 0x583274
push edi
mov dword [0x58b6fc], eax
call esi
push eax
call fcn.00547b74
mov dword [0x58b700], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00543820
test eax, eax
pop ecx
pop ecx
je 0x54e60b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005434eb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x54e63d
push 0x583258
push edi
call esi
push eax
call fcn.00547b74
cmp eax, ebx
pop ecx
mov dword [0x58b708], eax
je 0x54e63d
push 0x583240
push edi
call esi
push eax
call fcn.00547b74
pop ecx
mov dword [0x58b704], eax
mov eax, dword [0x58b704]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x54e6c2
cmp dword [0x58b708], ecx
je 0x54e6c2
push eax
call fcn.00547beb
push dword [0x58b708]
mov esi, eax
call fcn.00547beb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x54e6c2
cmp edi, ebx
je 0x54e6c2
call esi
cmp eax, ebx
je 0x54e68f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x54e68f
test byte [ebp - 0x18], 1
jne 0x54e6c2
lea eax, [ebp - 0x10]
push eax
call fcn.00543857
test eax, eax
pop ecx
je 0x54e6aa
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005434eb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x54e6b9
or dword [ebp + 0x10], 0x200000
jmp 0x54e6fd
or dword [ebp + 0x10], 0x40000
jmp 0x54e6fd
mov eax, dword [0x58b6fc]
cmp eax, dword [ebp - 8]
je 0x54e6fd
push eax
call fcn.00547beb
cmp eax, ebx
pop ecx
je 0x54e6fd
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x54e6fd
mov eax, dword [0x58b700]
cmp eax, dword [ebp - 8]
je 0x54e6fd
push eax
call fcn.00547beb
cmp eax, ebx
pop ecx
je 0x54e6fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x58b6f8]
call fcn.00547beb
cmp eax, ebx
pop ecx
je 0x54e71d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x54e71f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4fb3180
Capabilities:
Encode data using xor

Disassembly:
call 0x4fb30f9
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x4fb3129
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x4fb3145
xor edx, 0
jmp 0x4fb3150
xor edx, edx
jmp 0x4fb3167
jmp 0x4fb3173
xor eax, eax
push 0x8427d7c0
call 0x4fb3180
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x4fb31bc
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x4fb3195
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x4fb31d3
add eax, 0
jno 0x4fb31d8
add esi, 0
ret 0x10

Function at 0x4fb3f41
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x4fb3f63
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x4fb4105
cmp edi, dword [ebp + 0x10]
jb 0x4fb4105
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.04fb3a2d
inc edi
jmp 0x4fb3fec
jmp 0x4fb3ff9
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.04fb3a2d
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.04fb3a2d
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x4fb404d
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x4fb4031
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.04fb407b
add dword [eax], 0x39
jle 0x4fb4057
sub al, 0xf5
mov ch, al
call fcn.04fb4090
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10