joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x581ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5df310]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x5df310]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
push str.:_Nonblocking_input_is_not_implemented_by_this_object.
push eax
lea eax, [esp + 0x18]
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.0053a5c0
add esp, 0xc
mov edi, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0050fc23
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [esp + 0x44], 1
mov byte [ecx], 0
call fcn.00405180
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x53d488
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042257b
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BufferedTransformation::BlockingInputOnly.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0050fc14
add esp, 0x30
ret 4

Function at 0x53d830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x581949
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5df310]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5df310]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x18], esi
call fcn.0053a430
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.0
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [esp + 0x30], 3
mov byte [ecx], bl
call fcn.00405180
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push ebp
mov byte [esp + 0x30], 4
mov byte [ecx], bl
call fcn.00405180
mov eax, dword [esp + 0x38]
mov byte [esp + 0x24], 5
cmp eax, ebx
jge 0x53d8f4
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x53d90f
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xc], ecx
jmp 0x53d916
mov edx, dword [esp + 0x30]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0050fc14
add esp, 0x14
ret 0x18
Function at 0x53d9a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5819a1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5df310]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.005402a0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.0053d720
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.005402c0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
test ecx, ecx
je 0x53da1c
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x53ffb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5819a1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5df310]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.005402a0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.0053fe20
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.005402c0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
test ecx, ecx
je 0x54002c
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x540c60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x20]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x540cac
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
lea esp, [esp]
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x540c90
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x540cd5
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x540cd5
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x540cc8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x540d70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x540d80
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x5e9b70], edx
mov dword [esi*8 + 0x5e9b74], eax
inc esi
cmp esi, 0x100
jl 0x540d80
mov dword [0x5ea378], edi
mov dword [0x5ea37c], edi
mov dword [0x5ea370], edi
mov dword [0x5ea374], edi
pop edi
pop esi
mov byte [0x5ea380], 1
pop ebx
ret
Function at 0x540e00
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x5b19c8]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x5e9370], edx
mov dword [eax*8 + 0x5e9374], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x540e10
pop edi
pop esi
pop ebp
mov byte [0x5ea381], 1
pop ebx
add esp, 0x10
ret
Function at 0x552a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x5df310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x298], 0
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x18]
push edi
je case.default.0x552a88
test eax, eax
je case.default.0x552a88
mov eax, dword [eax + 0x84]
test eax, eax
je case.default.0x552a88
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0x552a88
jmp dword [edx*4 + 0x552bb8]
mov ecx, str.Header
mov edx, str.from
jmp 0x552aa5
mov ecx, str.Header
mov edx, 0x5b29d4
push eax
push edx
push ecx
push str.__s__s__s_
lea ecx, [ebp - 0xa4]
push 0xa0
push ecx
call sym.PlatSoftware.exe_curl_msnprintf
lea eax, [ebp - 0xa4]
add esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x552ad0
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x164]
test eax, eax
je 0x552b38
mov edx, dword [esi + 0xf4]
push edx
push edi
lea ecx, [ebp - 0xa4]
push ecx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x552ba7
mov eax, dword [esi + 0x164]
test eax, eax
je 0x552b68
mov edx, dword [esi + 0xf4]
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0xa8]
push ecx
push edx
push ebx
push esi
call eax
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050fc14
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0xf0]
push edx
push 1
push 2
push 0x5b29b0
call fcn.00515e15
mov eax, dword [esi + 0xf0]
push eax
push 1
lea ecx, [ebp - 0xa4]
push edi
push ecx
call fcn.00515e15
add esp, 0x20
jmp case.default.0x552a88
test ebx, ebx
js 0x552ba5
cmp ebx, 2
jg 0x552ba5
mov eax, dword [esi + 0xf0]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x5b29b0]
push 2
push ecx
call fcn.00515e15
mov edx, dword [esi + 0xf0]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xa8]
push edx
push 1
push eax
push ecx
call fcn.00515e15
add esp, 0x20
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050fc14
mov esp, ebp
pop ebp
ret
Function at 0x552cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x5df310]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi]
lea eax, [ebp + 0x14]
push eax
push ecx
mov dword [ebp - 0xb4], edi
call sym.PlatSoftware.exe_curl_mvaprintf
mov ecx, eax
add esp, 8
mov dword [ebp - 0xbc], ecx
test ecx, ecx
jne 0x552d3f
pop edi
lea eax, [ecx + 0x1b]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050fc14
mov esp, ebp
pop ebp
ret
push ebx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x552d43
sub eax, ebx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xa8], ecx
jmp 0x552d60
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, dword [edi + 0x134]
mov edx, dword [ebp - 0xb0]
sete al
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, dword [ebp - 0xa8]
push edx
push ecx
mov dword [ebp - 0xb8], 0
mov edx, dword [edi + eax*4 + 0x148]
push eax
push edi
call edx
mov ebx, eax
xor ecx, ecx
add esp, 0x14
cmp ebx, ecx
jge 0x552dbc
mov eax, dword [ebp - 0xb8]
cmp eax, ecx
je 0x552ec0
cmp eax, 0x51
jne 0x552eb8
xor ebx, ebx
mov dword [ebp - 0xac], ecx
cmp dword [esi + 0x2e4], ecx
je 0x552e9f
cmp dword [esi + 0x298], ecx
je 0x552e46
mov eax, dword [edi + 0x84]
cmp eax, ecx
je 0x552e46
push eax
push 0x5b29d4
push str.Data
push str.__s__s__s_
lea eax, [ebp - 0xa4]
push 0xa0
push eax
call sym.PlatSoftware.exe_curl_msnprintf
lea eax, [ebp - 0xa4]
add esp, 0x18
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x552e10
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x164]
test eax, eax
je 0x552e69
mov ecx, dword [esi + 0xf4]
push ecx
push edi
lea edx, [ebp - 0xa4]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x552e99
mov edi, dword [ebp - 0xb4]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x552e9f
mov ecx, dword [esi + 0xf4]
mov edx, dword [ebp - 0xa8]
push ecx
push ebx
push edx
push 4
push esi
call eax
add esp, 0x14
jmp 0x552e9f
mov eax, dword [esi + 0xf0]
push eax
push 1
push 2
push 0x5b29b0
call fcn.00515e15
mov ecx, dword [esi + 0xf0]
push ecx
push 1
lea edx, [ebp - 0xa4]
push edi
push edx
call fcn.00515e15
add esp, 0x20
jmp 0x552e40
mov edi, dword [ebp - 0xb4]
cmp ebx, dword [ebp - 0xb0]
je 0x552eca
sub dword [ebp - 0xb0], ebx
add dword [ebp - 0xa8], ebx
jmp 0x552d60
mov dword [ebp - 0xac], eax
jmp 0x552eca
mov dword [ebp - 0xac], 0x37
mov eax, dword [ebp - 0xbc]
push eax
call dword [0x5e11d4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xac]
add esp, 4
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0050fc14
mov esp, ebp
pop ebp
ret
Function at 0x55fcf0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, dword [esi]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
cmp eax, 2
je 0x55fd28
push str.Couldnt_set_desired_mode
push ebx
call fcn.00552c50
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x55fd3f
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00552bd0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x55fd53
call fcn.0055f8b0
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x55fd68
push esi
call fcn.0055f920
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x55fd81
push 0xd
push 1
push esi
call fcn.00562620
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x55fd95
push 0xe
push 1
push esi
call fcn.00562620
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x56c810
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x56c821
jmp dword [ecx*4 + 0x56c890]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x56c900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dl, byte [edi]
test dl, dl
je 0x56c9b1
mov cl, byte [esi]
test cl, cl
je 0x56c9b1
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x56c92a
jmp dword [eax*4 + 0x56c9d8]
mov dl, 0x41
jmp case.default.0x56c92a
mov dl, 0x42
jmp case.default.0x56c92a
mov dl, 0x43
jmp case.default.0x56c92a
mov dl, 0x44
jmp case.default.0x56c92a
mov dl, 0x45
jmp case.default.0x56c92a
mov dl, 0x46
jmp case.default.0x56c92a
mov dl, 0x47
jmp case.default.0x56c92a
mov dl, 0x48
jmp case.default.0x56c92a
mov dl, 0x49
jmp case.default.0x56c92a
mov dl, 0x4a
jmp case.default.0x56c92a
mov dl, 0x4b
jmp case.default.0x56c92a
mov dl, 0x4c
jmp case.default.0x56c92a
mov dl, 0x4d
jmp case.default.0x56c92a
mov dl, 0x4e
jmp case.default.0x56c92a
mov dl, 0x4f
jmp case.default.0x56c92a
mov dl, 0x50
jmp case.default.0x56c92a
mov dl, 0x51
jmp case.default.0x56c92a
mov dl, 0x52
jmp case.default.0x56c92a
mov dl, 0x53
jmp case.default.0x56c92a
mov dl, 0x54
jmp case.default.0x56c92a
mov dl, 0x55
jmp case.default.0x56c92a
mov dl, 0x56
jmp case.default.0x56c92a
mov dl, 0x57
jmp case.default.0x56c92a
mov dl, 0x58
jmp case.default.0x56c92a
mov dl, 0x59
jmp case.default.0x56c92a
mov dl, 0x5a
push ecx
call fcn.0056c810
add esp, 4
cmp dl, al
jne 0x56c9b1
mov dl, byte [edi + 1]
inc edi
inc esi
test dl, dl
jne 0x56c915
movzx eax, byte [edi]
push eax
call fcn.0056c810
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.0056c810
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebp
ret
Function at 0x56ca40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov dl, byte [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test dl, dl
je 0x56cb05
lea esp, [esp]
mov cl, byte [esi]
test cl, cl
je 0x56cb05
test edi, edi
je 0x56cb09
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x56ca7d
jmp dword [eax*4 + 0x56cb38]
mov dl, 0x41
jmp case.default.0x56ca7d
mov dl, 0x42
jmp case.default.0x56ca7d
mov dl, 0x43
jmp case.default.0x56ca7d
mov dl, 0x44
jmp case.default.0x56ca7d
mov dl, 0x45
jmp case.default.0x56ca7d
mov dl, 0x46
jmp case.default.0x56ca7d
mov dl, 0x47
jmp case.default.0x56ca7d
mov dl, 0x48
jmp case.default.0x56ca7d
mov dl, 0x49
jmp case.default.0x56ca7d
mov dl, 0x4a
jmp case.default.0x56ca7d
mov dl, 0x4b
jmp case.default.0x56ca7d
mov dl, 0x4c
jmp case.default.0x56ca7d
mov dl, 0x4d
jmp case.default.0x56ca7d
mov dl, 0x4e
jmp case.default.0x56ca7d
mov dl, 0x4f
jmp case.default.0x56ca7d
mov dl, 0x50
jmp case.default.0x56ca7d
mov dl, 0x51
jmp case.default.0x56ca7d
mov dl, 0x52
jmp case.default.0x56ca7d
mov dl, 0x53
jmp case.default.0x56ca7d
mov dl, 0x54
jmp case.default.0x56ca7d
mov dl, 0x55
jmp case.default.0x56ca7d
mov dl, 0x56
jmp case.default.0x56ca7d
mov dl, 0x57
jmp case.default.0x56ca7d
mov dl, 0x58
jmp case.default.0x56ca7d
mov dl, 0x59
jmp case.default.0x56ca7d
mov dl, 0x5a
push ecx
call fcn.0056c810
add esp, 4
cmp dl, al
jne 0x56cb05
mov dl, byte [ebx + 1]
inc ebx
dec edi
inc esi
test dl, dl
jne 0x56ca60
test edi, edi
jne 0x56cb13
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
movzx eax, byte [ebx]
push eax
call fcn.0056c810
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.0056c810
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
pop ebp
ret
Function at 0x56cba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jb 0x56cc4c
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x56cbcd
jmp dword [ecx*4 + 0x56cc50]
mov al, 0x41
jmp case.default.0x56cbcd
mov al, 0x42
jmp case.default.0x56cbcd
mov al, 0x43
jmp case.default.0x56cbcd
mov al, 0x44
jmp case.default.0x56cbcd
mov al, 0x45
jmp case.default.0x56cbcd
mov al, 0x46
jmp case.default.0x56cbcd
mov al, 0x47
jmp case.default.0x56cbcd
mov al, 0x48
jmp case.default.0x56cbcd
mov al, 0x49
jmp case.default.0x56cbcd
mov al, 0x4a
jmp case.default.0x56cbcd
mov al, 0x4b
jmp case.default.0x56cbcd
mov al, 0x4c
jmp case.default.0x56cbcd
mov al, 0x4d
jmp case.default.0x56cbcd
mov al, 0x4e
jmp case.default.0x56cbcd
mov al, 0x4f
jmp case.default.0x56cbcd
mov al, 0x50
jmp case.default.0x56cbcd
mov al, 0x51
jmp case.default.0x56cbcd
mov al, 0x52
jmp case.default.0x56cbcd
mov al, 0x53
jmp case.default.0x56cbcd
mov al, 0x54
jmp case.default.0x56cbcd
mov al, 0x55
jmp case.default.0x56cbcd
mov al, 0x56
jmp case.default.0x56cbcd
mov al, 0x57
jmp case.default.0x56cbcd
mov al, 0x58
jmp case.default.0x56cbcd
mov al, 0x59
jmp case.default.0x56cbcd
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x56cc4b
dec edi
jne 0x56cbc0
pop esi
pop edi
pop ebp
ret
Function at 0x570340
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5e11d0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x57036b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x5703b2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x5703b5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x570416
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x5703e0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x57044f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5b80dc
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5b80dd
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x570420
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x570de0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5df310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x570e27
sub eax, edx
push eax
call fcn.0056d080
push eax
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00570c60
lea ecx, [ebp - 0x5c]
push ecx
push edi
call fcn.00570d10
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
xor ecx, ebp
pop esi
call fcn.0050fc14
mov esp, ebp
pop ebp
ret
Function at 0x5728a0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x5728c2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x5728b6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x5728f2
cmp dword [esi + 8], 0
jne 0x5728e5
mov ecx, dword [eax + 8]
push 0x5af8b0
push ecx
call fcn.00536f3a
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x5728e5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00515ca1
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x572914
mov eax, dword [esi + 8]
test eax, eax
je 0x57290e
push eax
call fcn.005159e3
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret