joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4e44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5add30]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5add30]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5adcb4]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4d4e6f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d4f30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5add30]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5add30]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5adcb4]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4d4f6b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d5040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5add30]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5add30]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5add30]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5adcb4]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x5add30]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5add30]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5add30]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5add30]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4d508b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4eeba4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
call fcn.00405f30
cmp eax, 0x10
je 0x4eebcd
mov ecx, 0x4eec60
mov dl, 1
mov eax, dword [0x4081a4]
call fcn.0040db84
call fcn.00404590
xor ebx, ebx
lea eax, [esi + 0x40]
movzx edx, bl
add edx, edx
movzx edx, byte [edi + edx + 1]
shl edx, 8
movzx ecx, bl
add ecx, ecx
movzx ecx, byte [edi + ecx]
or edx, ecx
mov dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x4eebd2
mov byte [esi + 0x60], 0
mov eax, esi
call fcn.004eeaf4
mov bl, 4
mov eax, esi
call fcn.004ee2b4
mov eax, esi
call fcn.004ee3bc
dec bl
jne 0x4eec02
xor ebx, ebx
lea eax, [esi + 0x20]
movzx edx, bl
add edx, 4
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x4eec19
mov bl, 8
mov eax, esi
mov edx, dword [eax]
mov dword [eax + 0x61], edx
mov edx, dword [eax + 0x20]
mov dword [eax + 0x81], edx
add eax, 4
dec bl
jne 0x4eec34
movzx eax, byte [esi + 0x60]
mov byte [esi + 0xc1], al
pop edi
pop esi
pop ebx
ret

Function at 0x4fadb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffffa0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004c8e10
mov bx, 0x19
lea esi, [esp + 8]
mov eax, pe_nt_image_headers32
call fcn.004c8eec
mov byte [esi], al
inc esi
dec bx
jne 0x4fadc9
lea ecx, [esp + 0x35]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.004be2f4
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx eax, byte [eax + 0x18]
inc eax
mov byte [esp + 0x20], al
lea ecx, [esp + 0x49]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.004be2f4
xor ebx, ebx
lea eax, [esp + 0x21]
movzx edx, bx
lea ecx, [esp + 0x35]
movzx ecx, byte [ecx + edx]
lea esi, [esp + 0x49]
xor cl, byte [esi + edx]
mov byte [eax], cl
inc ebx
inc eax
cmp bx, 0x14
jne 0x4fae14
or byte [esp + 0x21], 0x80
or byte [esp + 0x34], 1
lea edx, [esp + 0x21]
mov eax, dword [esp]
mov ecx, 0x14
call fcn.004c6700
mov edx, dword [esp + 4]
mov edx, dword [edx]
lea eax, [esp + 8]
mov ecx, 0x19
call fcn.004030c8
add esp, 0x60
pop esi
pop ebx
ret
Function at 0x50c434
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x50c43d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x50c99e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
sete byte [ebp - 0x4d]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x28]
call fcn.004c6abc
mov eax, dword [ebp - 4]
test eax, eax
je 0x50c483
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x50c493
mov dword [ebp - 0x2c], 0x1f0b
jmp 0x50c976
mov dl, 1
mov eax, dword [0x4bf660]
call fcn.004c0174
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x50c71d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x38]
mov byte [eax + 4], 0x30
mov dl, 1
mov eax, dword [ebp - 0x38]
call fcn.004c0834
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.004c08d8
mov esi, eax
mov byte [esi + 4], 0x30
xor edx, edx
mov eax, esi
call fcn.004c0834
mov edx, eax
mov eax, esi
call fcn.004c08d8
mov ebx, eax
mov byte [ebx + 4], 6
mov edx, dword [0x5b2138]
mov eax, ebx
call fcn.004bfa44
mov dl, 1
mov eax, esi
call fcn.004c0834
mov edx, eax
mov eax, esi
call fcn.004c08d8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov byte [eax + 4], 0xa0
mov dl, 1
mov eax, esi
call fcn.004c0834
mov edx, eax
mov eax, esi
call fcn.004c08d8
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x501098]
call fcn.005010f8
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x50c604
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.00501200
mov ecx, 0x50c9b8
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.005011ac
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.005011d4
push eax
push 0x50c9cc
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 0x30]
mov edx, ebx
shr edx, 0x18
and edx, 0xff
call fcn.00404e28
push dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
mov edx, ebx
shr edx, 0x10
and edx, 0xff
call fcn.00404e28
push dword [ebp - 0x5c]
lea eax, [ebp - 0x60]
mov edx, ebx
shr edx, 8
and edx, 0xff
call fcn.00404e28
push dword [ebp - 0x60]
lea eax, [ebp - 0x64]
mov edx, ebx
and edx, 0xff
call fcn.00404e28
push dword [ebp - 0x64]
lea eax, [ebp - 0x54]
mov edx, 5
call fcn.00404fe4
mov edx, dword [ebp - 0x54]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov cl, 0x31
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
call fcn.005012b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c60b
mov eax, dword [ebp - 0x4c]
call fcn.00403cdc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c9a5
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.00404c64
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404c64
ret
Function at 0x517a5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x517bef
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x517ab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
dec eax
cdq
idiv dword [ebp - 0x18]
mov ebx, eax
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x517ae2
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00405370
test ebx, ebx
jle 0x517bbc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00405370
lea eax, [ebp - 8]
call fcn.00405140
xor ecx, ecx
mov edx, dword [ebp - 0x18]
call fcn.004035fc
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.00517a00
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 4]
call fcn.00404f68
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x517ba2
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00517c00
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00404cd8
mov eax, dword [ebp - 4]
test eax, eax
je 0x517b6f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x517b9d
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00405140
lea eax, [eax + ebx - 1]
movzx eax, byte [eax]
push eax
lea eax, [ebp - 8]
call fcn.00405140
lea eax, [eax + ebx - 1]
pop edx
xor byte [eax], dl
inc ebx
dec esi
jne 0x517b7a
dec dword [ebp - 0x24]
jne 0x517b46
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00404f1c
mov eax, dword [ebp + 8]
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x517afe
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
call fcn.00405370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517bf6
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404c64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c64
ret
Function at 0x52007c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x520101
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x5200b3
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
mov eax, esi
call fcn.0041daf0
sub ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x520050]
call fcn.004060ec
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x520108
lea eax, [ebp - 4]
mov edx, dword [0x520050]
call fcn.004061ec
ret
Function at 0x54154c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x541697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x541592
mov eax, dword [ebp - 0x34]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fdiv dword [0x5416a8]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00425890
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405148
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x5415d5
mov eax, dword [ebp - 0x38]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x24]
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00405148
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404f68
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00541148
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00541348
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00405370
mov eax, dword [ebp + 8]
call fcn.00405140
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x541674
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dl, byte [edx + ecx - 1]
xor al, dl
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x20]
dec dword [ebp - 0x30]
jne 0x54164c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54169e
lea eax, [ebp - 0x2c]
call fcn.00404c40
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404c64
ret

Function at 0x5452a4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004035fc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x5516e0
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x5b4a7c], 0
mov eax, dword [0x5b718c]
cmp dword [eax], 2
jne 0x5518b9
mov eax, dword [0x5b6a24]
cmp dword [eax], 5
jl 0x5518b9
call fcn.00549338
test al, al
jne 0x551711
call fcn.00549344
call fcn.00549330
mov dword [0x5b4a84], eax
push 0x5518bc
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a48], eax
cmp dword [0x5b4a48], 0
jne 0x55176c
mov edx, 0x8000
mov eax, 0x5518d0
call fcn.0040f7e4
mov dword [0x5b4a80], eax
mov eax, dword [0x5b4a80]
mov dword [0x5b4a84], eax
push 0x5518bc
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a48], eax
cmp dword [0x5b4a48], 0
je 0x5518b4
push 0x5518dc
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a4c], eax
cmp dword [0x5b4a4c], 0
je 0x5518b4
push 0x5518e8
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a50], eax
cmp dword [0x5b4a50], 0
je 0x5518b4
mov byte [0x5b4a7c], 1
push 0x5518f8
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a54], eax
push 0x551904
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a58], eax
push 0x551910
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a5c], eax
push 0x551920
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a60], eax
push 0x551930
mov eax, dword [0x5b4a84]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a64], eax
mov edx, 0x8000
mov eax, 0x551948
call fcn.0040f7e4
mov dword [0x5b4a88], eax
cmp dword [0x5b4a88], 0
je 0x5518b9
push 0x551958
mov eax, dword [0x5b4a88]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a68], eax
push 0x551974
mov eax, dword [0x5b4a88]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a6c], eax
push 0x551994
mov eax, dword [0x5b4a88]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a70], eax
push 0x5519b0
mov eax, dword [0x5b4a88]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a74], eax
push 0x5519c8
mov eax, dword [0x5b4a88]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b4a78], eax
ret
call fcn.00551660
ret
Function at 0x56050c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
test dl, dl
je 0x560523
add esp, 0xfffffff0
call fcn.00404040
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403cac
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
xor ecx, ecx
mov edx, 0x10
call fcn.00407c08
lea eax, [esi + 0x1c]
mov edx, 0x5605b4
call fcn.00404c94
mov dword [esi + 0x20], 0x22cc
xor eax, eax
mov dword [esi + 0x24], eax
lea eax, [esi + 0x28]
call fcn.00404c40
lea eax, [esi + 0x2c]
call fcn.00404c40
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x56058d
mov eax, esi
call fcn.005605ec
mov eax, esi
test bl, bl
je 0x5605a2
call fcn.00404098
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5605ec
Capabilities:
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
inc esi
je 0x56063e
mov word [ebx + 0xc], 2
movzx eax, word [ebx + 0x20]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0xe], ax
mov eax, dword [ebx + 0x1c]
call fcn.004050e0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x14]
xor ecx, ecx
mov edx, 8
call fcn.00407c08
mov byte [ebx + 4], 1
pop esi
pop ebx
ret
mov eax, ebx
call fcn.0056064c
mov byte [ebx + 4], 0
pop esi
pop ebx
ret

Function at 0x560680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push 0x10
lea ebx, [eax + 0xc]
push ebx
push 0
push ecx
push edx
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
pop ebx
ret
Function at 0x560698
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5607b5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x24], 0xffffffff
je 0x56079a
call fcn.0040bcf4
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 0x5607cc
call fcn.0040c8f4
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x2c]
call fcn.00404f68
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 0x28]
call fcn.00405078
je 0x560783
lea eax, [ebx + 0x28]
mov edx, dword [ebp - 4]
call fcn.00404c94
mov eax, dword [ebx + 0x28]
call fcn.00409b70
test al, al
jne 0x56074a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebx + 0x28]
call fcn.004050e0
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov dword [ebx + 0x24], esi
cmp esi, 0xffffffff
je 0x56079a
push esi
call sub.KERNEL32.DLL_CloseHandle
mov edx, 0x41
mov eax, dword [ebx + 0x28]
call fcn.00409a24
mov esi, eax
mov dword [ebx + 0x24], esi
cmp esi, 0xffffffff
je 0x56079a
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
xor ecx, ecx
mov edx, esi
mov eax, dword [ebx + 0x24]
call fcn.00409ad4
inc eax
jne 0x560783
mov dword [ebx + 0x24], 0xffffffff
jmp 0x56079a
mov edx, edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x24]
call fcn.00409aa8
inc eax
jne 0x56079a
mov dword [ebx + 0x24], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5607bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c64
ret