joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a7d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5cc718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebx, ecx
push esi
push edi
push 0
mov esi, dword [ebx + 0x40]
mov edi, dword [ebx + 0x34]
mov eax, edi
mov ebp, esi
and eax, 0xffff
and ebp, 0xffff
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x1c]
lea eax, [eax + ebp + 0x1e]
push eax
mov dword [esp + 0x1c], eax
call fcn.0054c130
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x62b4f0]
push 1
mov dword [esp + 0x30], 0
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dx, word [ebx + 0xa]
mov word [eax + 4], dx
mov edx, dword [esp + 0x20]
mov cx, word [ebx + 0xc]
mov word [edx + 6], cx
mov ecx, dword [esp + 0x20]
mov ax, word [ebx + 0xe]
mov word [ecx + 8], ax
mov eax, dword [esp + 0x20]
mov dx, word [ebx + 0x10]
mov word [eax + 0xa], dx
mov edx, dword [esp + 0x20]
mov cx, word [ebx + 0x12]
mov word [edx + 0xc], cx
mov ecx, dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0xe], eax
mov eax, dword [esp + 0x20]
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x12], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [ebx + 0x1c]
mov dword [edx + 0x16], ecx
mov eax, dword [esp + 0x20]
mov word [eax + 0x1a], si
mov ecx, dword [esp + 0x20]
mov word [ecx + 0x1c], di
mov edx, dword [esp + 0x20]
mov esi, dword [ebx + 0x3c]
mov ecx, ebp
mov eax, ecx
lea edi, [edx + 0x1e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov esi, dword [ebx + 0x30]
mov eax, ecx
lea edi, [edx + ebp + 0x1e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
push edi
push ecx
mov ecx, esi
call fcn.0054bd30
lea ecx, [ebx + 0x2c]
call fcn.0054c1e0
mov ecx, esi
call fcn.0054b2c0
mov ecx, esi
mov word [ebx + 0x20], ax
call fcn.0054c040
sub eax, edi
lea ecx, [esp + 0x18]
mov dword [ebx + 0x28], eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.0054c1b0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x54b400
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5cc8f8
push eax
mov al, byte [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x20
test al, al
push ebx
push ebp
push esi
mov esi, ecx
jne 0x54b56f
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x48]
add edx, eax
test eax, eax
mov dword [esi + 0x48], edx
je 0x54b44c
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x40]
push eax
push edx
mov ebx, dword [ecx]
call dword [ebx + 0x38]
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x24]
or ebp, 0xffffffff
cmp eax, 1
jne 0x54b4d5
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00548d20
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0059db8f
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebp
call fcn.0059db8f
test bl, bl
je 0x54b4bc
xor eax, eax
jmp 0x54b4d2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
imul eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x20]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x24]
mov ebx, 2
cmp eax, ebx
jne 0x54b560
mov al, byte [esi + 0x4c]
test al, al
je 0x54b560
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 0
lea eax, [esp + 0x40]
push 1
push eax
mov ecx, esi
mov dword [esp + 0x40], 1
call fcn.0054b5b0
mov ecx, dword [esi + 0x1c]
mov byte [esp + 0x34], bl
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov eax, dword [esp + 0x3c]
push eax
call fcn.00547eb0
add esp, 4
test eax, eax
je 0x54b534
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0059e89f
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.0059e87d
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call fcn.0059db8f
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], ebp
call fcn.0059db8f
jmp 0x54b57f
mov ecx, dword [esi + 0x1c]
cmp dword [ecx + 4], ebp
je 0x54b57f
mov edx, dword [ecx]
call dword [edx + 0x4c]
jmp 0x54b57f
mov ecx, dword [esi + 0x1c]
or ebp, 0xffffffff
cmp dword [ecx + 4], ebp
je 0x54b57f
mov eax, dword [ecx]
call dword [eax + 0x4c]
lea ecx, [esi + 0x3c]
call fcn.0054c1e0
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x50], ebp
mov dword [esi + 0x24], 0
mov dword [esi + 0x1c], 0
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x54b5b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cc96e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 8], ebx
jne 0x54b5f6
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call fcn.0059dc03
test bl, 1
mov dword [esp + 0x28], 3
je 0x54b61d
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.0059db8f
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00547840
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.00547960
add esp, 0x10
mov ecx, dword [0x61cab0]
mov dword [esp + 0x38], ecx
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x54b66a
push 0x62b504
lea ecx, [esp + 0x3c]
call fcn.0059dd26
jmp 0x54b680
mov edx, dword [esi + 0x50]
lea eax, [esp + 0x38]
push edx
push 0x62b4f8
push eax
call fcn.0059a7f7
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call fcn.0059ddce
push 0x610754
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x34], 7
call fcn.0059de34
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x38]
push edx
push eax
push esi
mov byte [esp + 0x34], 8
call fcn.0059ddce
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.0059db8f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.0059db8f
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.0059db8f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.0059db8f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.0059db8f
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0059db8f
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x54bb70
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x5cca38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00548d20
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.0059db8f
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0059db8f
test bl, bl
pop ebx
je 0x54bc00
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x5501c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5501e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00452800
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x55020a
test byte [esp + 8], 2
je 0x55020a
call fcn.00452873
mov dword [eax], 0xd
call fcn.0045287c
mov dword [eax], 5
jmp 0x5501e3
xor eax, eax
ret

Function at 0x551a50
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x551aa0
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x551c70
push 0
push 0
call fcn.00452692
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x551aa0
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x551a8f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x551af0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x551b04
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x551b51
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x552862
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocString
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x5528f2
cmp eax, ebx
je 0x5528f2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5528fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x552aa5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x552bf7
xor edx, edx
cmp eax, edx
je 0x552bf7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x552ada
cmp eax, ecx
jb 0x552ada
xor ecx, ecx
jmp 0x552adf
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x552af9
jg 0x552bf7
cmp eax, dword [esi + 8]
ja 0x552bf7
cmp ecx, edx
jne 0x552b13
cmp eax, dword [esi + 0x42c]
ja 0x552b13
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x552b58
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x552b33
cmp edi, edx
jb 0x552b33
xor edx, edx
jmp 0x552b38
mov edx, 1
cmp ecx, ebx
ja 0x552b58
cmp dword [esp + 0x14], edx
jg 0x552b58
jl 0x552b48
cmp eax, edi
ja 0x552b58
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00552c10
test eax, eax
je 0x552bf7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x552ba6
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x552be7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x552be7
jmp 0x552bb6
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x552be7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x552be7
cmp dword [edi], ebp
jne 0x552be7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x553040
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ccf48
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x553072
call fcn.0052bac0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x553083
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x5530d8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x5530be
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x553204
cmp dword [esp + 0x18], ebx
jne 0x5530d8
cmp dword [esp + 0x14], ebx
je 0x553204
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x5530e9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.0059d8fc
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x55312f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x55312f
call fcn.0047bca0
test eax, eax
je 0x55312f
push 0x6104d4
lea ecx, [esp + 0x14]
call fcn.0059dd26
push ebx
lea ecx, [esp + 0x14]
call fcn.0059dfbc
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x5531de
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x55316b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x5531de
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x5531b9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x5531bc
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x5531b4
mov dword [esi + 0x10], ebx
jmp 0x5531bc
mov dword [esi + 0x10], ecx
jmp 0x5531bc
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.0059db8f
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0059db8f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x55305a
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ccf48
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x553072
call fcn.0052bac0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x553083
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x5530d8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x5530be
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x553204
cmp dword [esp + 0x18], ebx
jne 0x5530d8
cmp dword [esp + 0x14], ebx
je 0x553204
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x5530e9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.0059d8fc
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x55312f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x55312f
call fcn.0047bca0
test eax, eax
je 0x55312f
push 0x6104d4
lea ecx, [esp + 0x14]
call fcn.0059dd26
push ebx
lea ecx, [esp + 0x14]
call fcn.0059dfbc
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x5531de
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x55316b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x5531de
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x5531b9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x5531bc
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x5531b4
mov dword [esi + 0x10], ebx
jmp 0x5531bc
mov dword [esi + 0x10], ecx
jmp 0x5531bc
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.0059db8f
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0059db8f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x553cc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00450be0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x553d09
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x553d09
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x620e38
call fcn.00598e50
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0054fe5f
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x553e1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x553e1b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x553e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x553e1b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x553e1b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00450be0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x553e1b
mov ecx, dword [ebp - 4]
push 0x5db35c
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.00450303
add esp, 8
test eax, eax
je 0x553e1b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x557770
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00450be0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x55779b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x5577ad
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x557919
push esi
call fcn.0055f240
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x5577e3
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.00553e40
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x557822
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.005567f0
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.00556960
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.00556a60
add esp, 0x24
jmp 0x557861
test ebp, ebp
jl 0x55782e
cmp ebp, 0x80
jle 0x557842
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.00553e40
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x557886
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x55788f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.005567f0
push esi
call fcn.0055f240
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00556960
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x5578cb
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.005567f0
push esi
call fcn.0055f240
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00556960
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.00556b10
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x5578fe
jmp 0x55788d