joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x4f1391
mov esi, 0x80
cmp esi, dword [edi]
jne 0x4f139d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5c39fc]
test eax, eax
je 0x4f13a8
call eax
lea ecx, [esi*8]
push ecx
call fcn.004f0a00
mov esi, eax
mov eax, dword [0x5c3a00]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x4f13c8
call eax
test esi, esi
je 0x4f1395
mov edx, dword [edi + 0xc]
push ebx
push edx
call fcn.004e3800
push esi
mov dword [edi + 0xc], esi
call dword [0x5c0470]
mov ebx, eax
shr ebx, 3
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.004b9850
mov ecx, dword [edi + 8]
add esp, 0x14
mov dword [edi + 8], 0
test ecx, ecx
je 0x4f14ad
nop
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x4f1441
lea esp, [esp]
movzx edi, byte [esi]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x4f1420
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x4f1489
mov esi, dword [eax]
test esi, esi
je 0x4f145f
mov edx, dword [eax + 4]
jmp 0x4f1461
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x4f1489
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4f1481
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x4f14a2
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x4f14a2
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x4f1498
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x4f1410
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fe770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4fe90f
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4fe793
cmp dword [esi + 0x1f0], 0
jne 0x4fe7a2
mov eax, 0xffff
add word [ebx + 0x20], ax
jne 0x4fe90e
push edi
mov edi, dword [ebx + 0x10]
mov dword [ebp - 8], edi
test edi, edi
je 0x4fe874
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x4fe7c8
cmp dword [esi + 0x1f0], 0
jne 0x4fe853
mov ecx, dword [edi]
mov eax, ecx
test ecx, ecx
jne 0x4fe7d5
mov dword [ebp - 4], ecx
jmp 0x4fe7f0
cmp byte [ecx], 0
je 0x4fe7e6
lea ebx, [ebx]
inc eax
cmp byte [eax], 0
jne 0x4fe7e0
sub eax, ecx
and eax, 0x3fffffff
mov dword [ebp - 4], eax
mov esi, dword [edi + 0x18]
cmp dword [esi + 0x18], 0
je 0x4fe829
mov edx, dword [ebp - 4]
xor eax, eax
cmp edx, eax
jle 0x4fe820
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4fe802
mov edi, dword [ebp - 8]
xor edx, edx
div dword [esi + 0x18]
mov ebx, edx
jmp 0x4fe82b
xor ebx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [edi]
push edx
push eax
mov edx, ebx
lea eax, [esi + 0x18]
call fcn.004e4c00
add esp, 8
test eax, eax
je 0x4fe84d
mov edx, ebx
lea ecx, [esi + 0x18]
call fcn.004e4ca0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ecx, esi
call fcn.004e38a0
mov eax, edi
mov ecx, esi
call fcn.004e38a0
mov edi, dword [ebp - 0xc]
mov dword [ebp - 8], edi
test edi, edi
jne 0x4fe7b1
push ebx
mov eax, esi
call fcn.004f76b0
push ebx
mov edi, esi
call fcn.004f6be0
mov eax, dword [ebx]
add esp, 8
mov ecx, esi
call fcn.004e38a0
mov eax, dword [ebx + 0x28]
mov ecx, esi
call fcn.004e38a0
mov edi, dword [ebx + 0x1c]
test edi, edi
je 0x4fe8b4
push edi
push esi
call fcn.004edb80
add esp, 8
mov eax, edi
mov ecx, esi
call fcn.004e38a0
mov eax, dword [ebx + 0x2c]
push eax
push esi
call fcn.004f5b30
add esp, 8
test esi, esi
je 0x4fe8ce
cmp dword [esi + 0x1f0], 0
jne 0x4fe8da
push 0
mov edi, ebx
call fcn.004ee670
add esp, 4
cmp dword [ebx + 0x3c], 0
je 0x4fe904
xor edi, edi
cmp dword [ebx + 0x38], edi
jle 0x4fe8fa
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx + edi*4]
mov ecx, esi
call fcn.004e38a0
inc edi
cmp edi, dword [ebx + 0x38]
jl 0x4fe8e7
mov eax, dword [ebx + 0x3c]
mov ecx, esi
call fcn.004e38a0
mov eax, ebx
mov ecx, esi
call fcn.004e38a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x40], edx
mov edx, dword [ecx + 0x10]
add eax, eax
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x28], eax
mov eax, 1
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
jmp 0x4fee53
mov esi, dword [ebp - 0x30]
push eax
push str.sqlite_stat_d
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
call fcn.004fa9a0
mov ecx, dword [esi]
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x1c]
cmp byte [ebp - 0x1c], bl
je 0x4fee85
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x4fee80
lea edx, [ebp - 0x1c]
sub eax, edx
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], eax
cmp eax, ebx
jle 0x4fefa0
jmp 0x4feeaa
mov ecx, dword [ebp - 0x34]
mov edx, ebx
cmp ebx, 2
jge 0x4feeb4
xor edx, 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4fef0b
mov ecx, dword [ecx + 0x10]
mov esi, edx
add esi, esi
mov esi, dword [ecx + esi*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x4feef0
lea ecx, [ecx]
movzx ebx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5932a0]
cmp cl, byte [ebx + 0x5932a0]
jne 0x4feeed
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4feed0
mov ebx, dword [ebp - 0x20]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x5932a0]
movzx eax, byte [eax + 0x5932a0]
sub eax, ecx
jne 0x4fef6d
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x4fef4d
xor eax, eax
mov edx, edi
lea ecx, [ebp - 0x1c]
test edi, edi
jle 0x4fef46
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4fef25
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x44]
xor edx, edx
div dword [esi + 8]
jmp 0x4fef4f
xor edx, edx
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [esi + 8]
call fcn.004e4c00
add esp, 8
test eax, eax
je 0x4fefc1
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4fef80
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x4feea7
cmp dword [ebp - 0x24], 0
je 0x4fefa0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x1c]
push eax
push ecx
push str.DELETE_FROM__Q._s_WHERE__s_Q
call fcn.004fe680
add esp, 0x14
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 3
jle 0x4fee50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b92b7
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0
jmp 0x4fef6d
Function at 0x5001b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor eax, eax
test dword [edx + 0x18], 0x4000000
mov dword [ebp - 4], eax
je 0x5002f9
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ecx + 0x24]
test edi, edi
je 0x500216
lea esp, [esp]
mov eax, dword [edi + 0x14]
test eax, eax
jle 0x50020c
lea edx, [edi + 0x24]
mov esi, eax
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x5001fc
or eax, 0xffffffff
jmp 0x500203
mov eax, 1
shl eax, cl
or dword [ebp - 4], eax
add edx, 8
dec esi
jne 0x5001f0
mov edi, dword [edi + 4]
test edi, edi
jne 0x5001e0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx]
mov eax, esi
test esi, esi
jne 0x500225
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x500242
cmp byte [esi], 0
je 0x500236
lea ebx, [ebx]
inc eax
cmp byte [eax], 0
jne 0x500230
sub eax, esi
and eax, 0x3fffffff
mov edi, eax
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ecx + 0x44]
add ebx, 0x38
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0xc], ebx
je 0x500287
xor eax, eax
mov edx, edi
mov ecx, esi
test edi, edi
jle 0x500281
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x500260
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [ebx]
jmp 0x500289
xor edx, edx
push edi
push esi
mov eax, ebx
call fcn.004e4c00
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x5002f3
mov edi, dword [eax + 8]
cmp edi, ebx
je 0x5002f3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
push ecx
push edx
xor eax, eax
mov dword [ebp - 8], ebx
call fcn.004fff70
mov eax, dword [ebp - 8]
add esp, 0x10
cmp eax, ebx
je 0x5002ec
mov ecx, dword [eax + 0x24]
cmp ecx, ebx
jle 0x5002ec
mov edx, dword [eax + 4]
mov esi, ecx
nop
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x5002dc
or eax, 0xffffffff
jmp 0x5002e3
mov eax, 1
shl eax, cl
or dword [ebp - 4], eax
add edx, 4
dec esi
jne 0x5002d0
mov edi, dword [edi + 0xc]
cmp edi, ebx
jne 0x5002a2
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x507ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [edx]
xor esi, esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
lea esp, [esp]
test edi, edi
je 0x5080a8
cmp byte [edi], 0
mov eax, edi
je 0x508026
nop
inc eax
cmp byte [eax], 0
jne 0x508020
sub eax, edi
and eax, 0x3fffffff
cmp dword [ebx + 0x1a8], 0
lea ecx, [ebx + 0x19c]
mov esi, eax
je 0x508081
xor eax, eax
mov edx, esi
mov ecx, edi
test esi, esi
jle 0x508071
jmp 0x508050
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x508050
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 8]
xor edx, edx
div dword [ebx + 0x19c]
lea ecx, [ebx + 0x19c]
jmp 0x508083
xor edx, edx
push esi
push edi
mov eax, ecx
call fcn.004e4c00
add esp, 8
test eax, eax
je 0x50809e
mov eax, dword [eax + 8]
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
jmp 0x5080ab
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
xor eax, eax
jmp 0x5080ab
mov eax, dword [ebx + 8]
test eax, eax
je 0x5080bd
movzx ecx, byte [esi + 0x593b20]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x5080dc
inc esi
mov dword [ebp - 4], esi
cmp esi, 3
jl 0x508010
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
pop edi
pop esi
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x517bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x3c]
cmp dword [edx], 0
push edi
mov edi, eax
mov dword [ebp - 4], 0
jne 0x517c03
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx]
or eax, 0x1e
push 0
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push 0
push ecx
call eax
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jne 0x517d58
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x517c3c
mov eax, dword [ebx + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.004bf410
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], ecx
push esi
lea ecx, [ecx]
test edi, edi
je 0x517d54
mov esi, dword [edi + 0x14]
mov dword [ebp - 8], esi
cmp esi, dword [ebx + 0x18]
ja 0x517d47
test byte [edi + 0x18], 0x20
jne 0x517d47
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [esi - 1]
push 0
push ecx
call fcn.004bf410
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp esi, 1
jne 0x517ce0
mov esi, dword [edi + 0x10]
movzx ecx, byte [esi + 0x64]
movzx edx, byte [esi + 0x65]
movzx eax, byte [esi + 0x66]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x67]
mov esi, dword [edi + 4]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, edx
inc ecx
mov byte [esi + 0x1b], cl
mov eax, ecx
mov edx, ecx
shr eax, 0x18
mov byte [esi + 0x18], al
shr edx, 0x10
mov byte [esi + 0x19], dl
mov ebx, ecx
shr ebx, 8
mov byte [esi + 0x1a], bl
mov esi, dword [edi + 4]
mov byte [esi + 0x5e], bl
mov ebx, dword [ebp + 8]
mov byte [esi + 0x5c], al
mov byte [esi + 0x5d], dl
mov byte [esi + 0x5f], cl
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 8]
mov dword [ecx + 0x60], 0x23e22d00
push dword [ebp - 0xc]
mov eax, dword [edi + 4]
push dword [ebp - 0x10]
mov ecx, dword [ebx + 0x80]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
mov ecx, dword [ebp - 8]
push ecx
push eax
call edx
add esp, 0x14
mov dword [ebp - 4], eax
cmp esi, 1
jne 0x517d28
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
mov dword [ebx + 0x64], ecx
mov edx, dword [eax + 0x1c]
mov dword [ebx + 0x68], edx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x6c], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x70], edx
cmp esi, dword [ebx + 0x20]
jbe 0x517d30
mov dword [ebx + 0x20], esi
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ecx + 0x58]
mov ebx, esi
call fcn.0050d580
mov ebx, dword [ebp + 8]
add esp, 4
cmp dword [ebp - 4], 0
mov edi, dword [edi + 0xc]
je 0x517c40
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54d270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570720
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x30], edi
test ebx, ebx
jne 0x54d2b8
push ebx
push ebx
push ebx
push 2
call fcn.00558600
xor al, al
jmp 0x54d452
mov esi, dword [edi + 0x2c]
test esi, esi
je 0x54d2d1
nop
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x54]
push 1
call edx
test esi, esi
jne 0x54d2c0
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
push ebx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
call fcn.004bb7bb
push ebx
call fcn.004bb6cc
xor esi, esi
push esi
push esi
push ebx
mov edi, eax
call fcn.004bb7bb
add esp, 0x1c
cmp edi, esi
jg 0x54d318
mov ecx, dword [ebp - 0x30]
push esi
push esi
push esi
push 0xd
call fcn.00558600
xor al, al
jmp 0x54d452
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], esi
cmp edi, 0xf
je 0x54d34f
push 1
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401d60
test al, al
je 0x54d34f
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x54d34c
lea eax, [ebp - 0x2c]
mov byte [eax], 0
lea eax, [edi + 1]
push eax
call fcn.0046a4eb
push ebx
mov esi, eax
push 1
push edi
push esi
mov dword [ebp - 0x34], esi
mov byte [esi], 0
call fcn.004bb51b
add esp, 0x14
cmp eax, 1
je 0x54d3a4
push esi
call fcn.004b9392
mov ecx, dword [ebp - 0x30]
add esp, 4
push 0
push 0
push 0
push 2
call fcn.00558600
cmp dword [ebp - 0x18], 0x10
jb 0x54d39d
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004b8946
add esp, 4
xor al, al
jmp 0x54d452
mov ebx, dword [ebp - 0x34]
mov byte [ebx + edi], 0
cmp byte [ebx], 0
mov eax, esi
je 0x54d403
mov cl, byte [esi]
cmp cl, 0xa
jne 0x54d3cd
mov edx, esi
sub edx, eax
inc edx
push edx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004027d0
inc esi
mov eax, esi
jmp 0x54d3fe
cmp cl, 0xd
jne 0x54d3fd
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x54d3e4
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004027d0
push 0xa
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040c390
cmp byte [esi + 1], 0xa
jne 0x54d3c8
add esi, 2
mov eax, esi
jmp 0x54d3fe
inc esi
cmp byte [esi], 0
jne 0x54d3b2
sub esi, eax
je 0x54d411
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.004027d0
push ebx
call fcn.004b9392
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp dword [ebp - 0x18], 0x10
jae 0x54d426
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x30]
mov edx, dword [esi]
mov edx, dword [edx + 8]
push ecx
push 0
push eax
mov ecx, esi
call edx
cmp byte [esi + 0x58], 0
lea ecx, [ebp - 0x2c]
je 0x54d44b
call fcn.004dace0
xor al, al
jmp 0x54d452
call fcn.004dace0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret 8
Function at 0x55b3a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x4027e1
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x402809
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x402810
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x4027ef
jmp 0x402812
mov eax, 0x1505
jmp 0x402812
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40e5bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov edi, esp
mov ecx, 5
mov esi, 0x47270c
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0x40
jb 0x40e63c
shr ebp, 6
xor ebx, ebx
mov esi, edx
xor edi, edi
movzx eax, byte [esi + edi]
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + edi + 0x14], ecx
movzx eax, byte [esi + edi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + edi + 0x14], ecx
add edi, 4
cmp edi, 0x40
jne 0x40e5e7
mov ecx, esp
lea edx, [esp + 0x14]
call fcn.0040e6d6
inc ebx
lea edx, [esi + edi]
cmp ebx, ebp
jne 0x40e5e3
add esi, edi
mov edx, esi
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebp
and esi, 0x3f
je 0x40e670
xor eax, eax
movzx edi, byte [edx + eax]
mov ecx, ebx
and cl, 0x18
shl edi, cl
mov ecx, eax
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
inc eax
add ebx, 8
cmp esi, eax
jne 0x40e654
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
xor eax, eax
inc eax
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
cmp esi, 0x38
jb 0x40e6a8
mov ecx, esp
lea edi, [esp + 0x14]
mov edx, edi
call fcn.0040e6d6
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x70]
lea edx, [esp + 0x14]
mov dword [edx + 0x38], ebx
shr ebp, 0x1d
mov dword [edx + 0x3c], ebp
mov ecx, esp
call fcn.0040e6d6
xor eax, eax
mov ecx, dword [esp + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 5
jne 0x40e6c2
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4166d4
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4167d3
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4167cc
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x41677d
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x41671d
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x416797
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x416785
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x416711
shl ecx, 0x10
or ecx, edi
jmp 0x4167d6
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret