joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53507c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x535142
mov word [ebx], 2
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockname
inc eax
je 0x535142
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1008
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockopt
inc eax
je 0x535142
cmp dword [ebx + 4], 0
jne 0x53510d
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x53514e
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004035bc
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getpeername
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x53514e
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x547d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x547d9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040492c
mov eax, dword [ebp - 4]
call fcn.00404b3c
mov esi, eax
test esi, esi
jle 0x547d78
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d0c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x547d5b
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004048e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547da4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret
Function at 0x548a9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x548ca1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x548cb8
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x548c6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x548b7b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x548bc2
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x548b8d
mov edx, 0x548ccc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x548be5
mov edx, 0x548ce0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x548cf4
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548c76
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret

Function at 0x548fcc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a7f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x549011
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549018
mov eax, dword [ebp - 8]
call fcn.0040a914
ret
Function at 0x54b648
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x54b84d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x54b864
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54b81b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x54b727
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x54b76e
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x54b739
mov edx, 0x54b878
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x54b791
mov edx, 0x54b88c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x54b8a0
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54b822
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret
Function at 0x54b8a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54b92b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004035bc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x54b944
mov edx, ebx
call fcn.00404b88
mov eax, dword [ebp - 0x24]
call fcn.00404d00
mov dword [ebp - 0x16], eax
mov eax, 0x54b948
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54b932
lea eax, [ebp - 0x24]
call fcn.00404894
ret
Function at 0x54f2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x54f4f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f18c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x54f50c
call fcn.00404b88
mov dl, 1
mov eax, dword [0x412ce8]
call fcn.004039ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54f4c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a998
test al, al
je 0x54f3cf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x54f416
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409fe4
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x54f3e1
mov edx, 0x54f520
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x54f439
mov edx, 0x54f534
mov eax, dword [ebp - 0xc]
call fcn.00415cc8
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035bc
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d00
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404aec
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x54f548
call fcn.00404b88
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f4ca
mov eax, dword [ebp - 0xc]
call fcn.00403a08
ret
Function at 0x54f550
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x54f558
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x54f725
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x54f70a
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409fe4
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.0054f81c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404e28
test eax, eax
jle 0x54f702
mov eax, dword [0x567918]
cmp byte [eax], 0
je 0x54f61b
lea ecx, [ebp - 0x14]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x54f73c
call fcn.00404b88
mov edx, dword [ebp - 0x10]
mov eax, dword [0x57f73c]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415cc8
jmp 0x54f658
lea ecx, [ebp - 0x18]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x18]
mov edx, 0x54f750
call fcn.00404b44
mov edx, dword [ebp - 0x18]
mov eax, dword [0x57f73c]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415cc8
lea ecx, [ebp - 0x1c]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0040ac34
test al, al
jne 0x54f6ee
push 4
lea ecx, [ebp - 0x20]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x20]
mov edx, 0x54f770
call fcn.00404b44
mov eax, dword [ebp - 0x20]
call fcn.00404d00
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00404d00
push eax
call sub.kernel32.dll_MoveFileExA
lea ecx, [ebp - 0x28]
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.0054f2f0
mov eax, dword [0x567908]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc ebx
dec esi
jne 0x54f590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f72c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004048b8
ret
Function at 0x54f81c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x54f8c6
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x54f879
push 0x90
lea eax, [ebp - 0x91]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x91]
call fcn.0040b424
mov eax, dword [ebp - 0x128]
mov edx, ebx
call fcn.00409fe4
jmp 0x54f8a8
push 0x90
lea eax, [ebp - 0x122]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x122]
call fcn.0040b424
mov eax, dword [ebp - 0x12c]
mov edx, ebx
call fcn.00409fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f8cd
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.004048b8
ret

Function at 0x55006c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1f
push 0
push 0
dec ecx
jne 0x550074
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x5508b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x464f70]
call fcn.00465134
mov ebx, eax
mov edx, 0x80000003
mov eax, ebx
call fcn.00465264
mov cl, 1
mov edx, 0x5508cc
mov eax, ebx
call fcn.00465418
lea ecx, [ebp - 0x10]
mov edx, 0x5508f8
mov eax, ebx
call fcn.00465afc
mov eax, ebx
call fcn.00403a08
mov eax, dword [ebp - 0x10]
mov edx, 0x550908
call fcn.00404c4c
jne 0x5500fe
mov ecx, 0x550918
mov edx, 0x550924
mov eax, ebx
call fcn.00465ac8
mov eax, dword [0x56793c]
mov byte [eax], 0
mov eax, dword [0x56793c]
cmp byte [eax], 0
jne 0x550128
mov eax, dword [0x57f73c]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x550934
call fcn.00415cc8
jmp 0x550890
mov edx, dword [ebp - 4]
mov eax, dword [0x57f74c]
call fcn.004e97bc
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5501b9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x5501a2
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x55018d
mov eax, dword [0x57f73c]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x550974
call fcn.00415cc8
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x5501a2
push 0
mov cx, word [0x550994]
mov dl, 1
mov eax, 0x5509a0
call fcn.0046aa68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5501c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5508bd
lea eax, [ebp - 0xf8]
mov edx, 0x3b
call fcn.004048b8
lea eax, [ebp - 8]
call fcn.00404894
ret
Function at 0x550adc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x57f74c]
call fcn.004e97bc
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x550b73
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x550b5c
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x550b47
mov eax, dword [0x57f73c]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x550b88
call fcn.00415cc8
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x550b5c
push 0
mov cx, word [0x550ba8]
mov dl, 1
mov eax, 0x550bb4
call fcn.0046aa68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550b7a
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x556954
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a7f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x556999
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5569a0
mov eax, dword [ebp - 8]
call fcn.0040a914
ret

Function at 0x55ab30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
push ebp
push 0x55abb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040492c
mov eax, dword [ebp - 4]
call fcn.00404b3c
mov esi, eax
test esi, esi
jle 0x55ab94
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d0c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x55ab77
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004048e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55abc0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret

Function at 0x561e3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x561f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x567988]
cmp dword [eax], 0
je 0x561eb0
lea edx, [ebp - 4]
mov eax, dword [0x567988]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e4]
call fcn.0043db4c
mov eax, dword [ebp - 4]
mov edx, 0x561f9c
call fcn.00404c4c
je 0x561f5f
lea edx, [ebp - 8]
mov eax, dword [0x567988]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e4]
call fcn.0043db4c
mov eax, dword [ebp - 8]
mov edx, 0x561fac
call fcn.00404c4c
je 0x561f5f
mov eax, dword [0x57f7c0]
cmp dword [eax + 0x3c], 0x14b
jge 0x561ecd
mov edx, 0x14b
mov eax, dword [0x57f7c0]
call fcn.0043d0b8
mov edx, dword [0x567494]
mov edx, dword [edx]
mov eax, dword [ebx + 0x2e8]
call fcn.00501eec
mov edx, dword [0x567494]
mov edx, dword [edx]
mov eax, dword [ebx + 0x2e8]
call fcn.00501eec
mov eax, dword [0x567494]
mov eax, dword [eax]
call fcn.0043e2b8
mov eax, dword [0x56793c]
cmp byte [eax], 0
jne 0x561f5f
mov eax, dword [0x567918]
cmp byte [eax], 0
je 0x561f5f
lea eax, [ebp - 0x10]
mov edx, dword [0x567494]
mov edx, dword [edx]
mov edx, dword [edx + 0x2d0]
add edx, 0x24
call fcn.00404ae0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x561fbc
call fcn.00404b88
mov eax, dword [ebp - 0xc]
call fcn.0046ab94
push 3
push 0
push 0
push 0x562050
push 0x5620a8
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561f8e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048b8
ret
Function at 0x562b3c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, 0x562374
call fcn.00407ff0
xor eax, eax
push ebp
push 0x562d5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x567794]
mov eax, dword [eax]
call fcn.00462c74
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, 0x562d74
call fcn.00462720
push 0x562d7c
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x57f7c8], eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x562c98
xor eax, eax
push ebp
push 0x562bd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x567908]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x55c8e0]
call fcn.00462c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x562be2
mov ecx, dword [0x567494]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x55a8a8]
call fcn.00462c94
mov ecx, dword [0x567944]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x54f110]
call fcn.00462c94
mov ecx, dword [0x567744]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x5563b8]
call fcn.00462c94
mov ecx, dword [0x5674f0]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x54e428]
call fcn.00462c94
mov ecx, dword [0x567680]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x558060]
call fcn.00462c94
mov ecx, dword [0x5675ac]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x5337b8]
call fcn.00462c94
mov ecx, dword [0x5674cc]
mov eax, dword [0x567794]
mov eax, dword [eax]
mov edx, dword [0x557b84]
call fcn.00462c94
mov eax, dword [0x567794]
mov eax, dword [eax]
call fcn.00462d28
jmp 0x562cc5
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00403314
cmp dword [ebp - 0x10], 0
jne 0x562cc5
push 0
mov ecx, 0x562d84
mov edx, 0x562d90
mov eax, dword [0x567794]
mov eax, dword [eax]
call fcn.00462ea8
jmp 0x562d42
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00403314
cmp dword [ebp - 0x14], 0
je 0x562d37
mov dl, 1
mov eax, dword [0x464f70]
call fcn.00465134
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00465264
mov cl, 1
mov edx, 0x562dac
mov eax, ebx
call fcn.00465418
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00403314
mov ecx, dword [ebp - 0x18]
mov edx, 0x562dd0
mov eax, ebx
call fcn.00465ac8
push 0
push 0
push 0xbd3
push 0
push 0x562ddc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [0x57f7c8]
push eax
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x562d64
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004048b8
ret