joyce8/EMBER2024-capa huggingface dataset:
Function at 0x383ed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebp, dword [ecx]
cmp ebp, ecx
je 0x384079
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x14], 0x18e
add dword [esp + 0x14], 0x8fd9
shl dword [esp + 0x14], 0xf
add dword [esp + 0x14], 0xa98
xor dword [esp + 0x14], 0x48b38a98
mov dword [esp + 0x10], 0x9208
imul eax, dword [esp + 0x10], 0x75
mov dword [esp + 0x10], eax
shr dword [esp + 0x10], 0xb
or dword [esp + 0x10], 0x128383aa
imul eax, dword [esp + 0x10], 0x35
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff3c94
imul eax, dword [esp + 0x10], 0x6f
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x74ad7137
mov dword [esp + 0x10], 0xeadf
shl dword [esp + 0x10], 9
shl dword [esp + 0x10], 0xd
imul eax, dword [esp + 0x10], 0x5d
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xd479
imul eax, dword [esp + 0x10], 0x13
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x4e4fc4eb
cmp word [edx], 0
je 0x38405f
jmp 0x383fa0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0x9208
imul eax, dword [esp + 0x10], 0x75
mov dword [esp + 0x10], eax
shr dword [esp + 0x10], 0xb
or dword [esp + 0x10], 0x128383aa
imul eax, dword [esp + 0x10], 0x35
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff3c94
imul eax, dword [esp + 0x10], 0x6f
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x74ad7137
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0xeadf
shl dword [esp + 0x10], 9
shl dword [esp + 0x10], 0xd
imul eax, dword [esp + 0x10], 0x5d
shl esi, cl
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xd479
imul eax, dword [esp + 0x10], 0x13
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x4e4fc4eb
movzx ecx, byte [esp + 0x10]
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x38403e
cmp eax, 0x5a
ja 0x38403e
add eax, 0x20
mov dword [esp + 0x14], eax
add edx, 2
add dword [esp + 0x14], esi
add dword [esp + 0x14], edi
sub dword [esp + 0x14], ebx
cmp word [edx], 0
jne 0x383fa0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor eax, 0x2f5614d2
cmp eax, dword [esp + 0x1c]
je 0x384083
mov ebp, dword [ebp]
cmp ebp, ecx
jne 0x383ef5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x384350
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x3844ee
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x3844ee
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x3844ee
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x3844ee
mov eax, dword [0x38db44]
test eax, eax
jne 0x3843bb
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0xdae4ae1
mov ecx, eax
call fcn.00383e30
mov dword [0x38db44], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x3844e5
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x38dc6c]
test eax, eax
jne 0x38441b
mov ecx, 0xfd7834c6
call fcn.00383ed0
mov edx, 0x9c233dc
mov ecx, eax
call fcn.00383e30
mov dword [0x38dc6c], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x38449e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x38dc6c]
test eax, eax
jne 0x384486
mov ecx, 0xfd7834c6
call fcn.00383ed0
mov edx, 0x9c233dc
mov ecx, eax
call fcn.00383e30
mov dword [0x38dc6c], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x384445
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.00384620
mov edx, edi
mov ecx, ebx
call fcn.00384530
pop esi
test eax, eax
jne 0x3844e5
mov eax, dword [0x38dfc4]
test eax, eax
jne 0x3844d9
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0xce8d33fc
mov ecx, eax
call fcn.00383e30
mov dword [0x38dfc4], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x405930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
movzx eax, bx
mov dword [ebp - 0x34], eax
mov esi, ecx
cmp di, bx
jne 0x40596d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4059a7
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4059a7
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405a77
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x4059d4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405a07
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x405a46
sub eax, 1
je 0x405a46
sub eax, 2
jne 0x405a77
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4059df
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x405a64
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x405a77
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], ecx
movzx eax, ax
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408efb
mov esp, ebp
pop ebp
ret 4
Function at 0x405f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x406034
cmp byte [esi + 0x3e], 0
je 0x406034
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x406022
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x405fe9
sub eax, 1
je 0x405fed
sub eax, 2
jne 0x406022
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40600b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x406022
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408efb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00408efb
mov esp, ebp
pop ebp
ret

Function at 0x408e17
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x408e3e
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x408e41
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00408df3
pop esi
leave
ret 8

Function at 0x40992e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40996d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40996d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40996d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40996d
cmp dword [ecx + 0x74], 0xe
jbe 0x40996d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x9cb5a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9cb5cc
call fcn.0096daf8
mov dword [eax], esi
call fcn.0096dae5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0096e73a
mov eax, esi
jmp 0x9cb621
test dword [ebp + 0xc], 0xfffffff9
jne 0x9cb5b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9cb5f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096db0b
pop ecx
call fcn.0096dae5
mov eax, dword [eax]
jmp 0x9cb621
test al, 0x10
jne 0x9cb61f
test al, 1
je 0x9cb61f
test byte [ebp + 0xc], 2
je 0x9cb61f
call fcn.0096daf8
mov dword [eax], 5
call fcn.0096dae5
mov dword [eax], 0xd
jmp 0x9cb5f0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x6fd7252f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x32577f98
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41d7f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
cmp esi, eax
jae 0x41d820
lea eax, [esi + 1]
mov dword [ebx + 0xc], eax
movzx eax, byte [esi]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x38]
mov edx, 0x8000
mov ebp, eax
mov edi, dword [ebx + 8]
test ecx, ecx
cmove ecx, edx
mov edx, dword [ebx + 4]
sub ebp, edx
mov esi, edx
add ecx, ebp
cmp ecx, edi
jl 0x41d8d0
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x41d9b0
mov ebp, dword [ebx + 0x30]
test ebp, ebp
jne 0x41d8bd
mov ebp, dword [ebx + 0x44]
cmp edx, esi
mov dword [esp + 0x1c], ebp
jne 0x41d868
test ebp, ebp
jne 0x41d9c0
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x41d882
cmp ebp, dword [ebx + 8]
jge 0x41d882
cmp ebp, edi
jg 0x41d882
cmp esi, edx
je 0x41d93e
mov edi, ebp
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call ecx
test eax, eax
jne 0x41d8e0
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x41d8fd
mov eax, esi
xor edx, edx
xor ecx, ecx
add dword [ebx + 0x28], edx
mov dword [ebx + 0xc], esi
adc dword [ebx + 0x2c], ecx
mov dword [ebx + 0x10], eax
add dword [ebx + 0x68], edx
adc dword [ebx + 0x6c], ecx
cmp eax, esi
ja 0x41d805
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
sub edi, ebp
mov esi, eax
jmp 0x41d843
cmp eax, 0xdfb9b0bb
je 0x41d920
test eax, eax
jns 0x41d930
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x30], 1
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
jmp 0x41d8b5
mov dword [esp + 8], str.Invalid_return_value_0_for_stream_protocol_n
mov dword [esp + 4], 0x18
mov dword [esp], 0
call fcn.0056b9c0
lea esi, [esi]
mov dword [ebx + 0x30], 1
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
jmp 0x41d8b5
mov ecx, eax
mov edx, eax
add eax, esi
sar ecx, 0x1f
jmp 0x41d8a3
cmp esi, dword [ebx + 0xc]
je 0x41d880
mov dword [esp], ebp
call fcn.0056e030
test eax, eax
mov esi, eax
je 0x41d9f9
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll__aligned_free
mov edx, dword [ebx + 0x34]
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x78], ebp
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xc], esi
test edx, edx
je 0x41d9f2
lea eax, [esi + ebp]
mov dword [ebx + 0x34], 1
mov edi, ebp
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x40], esi
test ecx, ecx
jne 0x41d882
lea esi, [esi]
mov eax, 0xffffffea
jmp 0x41d8eb
mov dword [ebx + 0x30], 1
xor eax, eax
jmp 0x41d8bf
mov ebp, dword [ebx + 0x40]
cmp eax, ebp
jbe 0x41d9e6
sub eax, ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x3c], eax
test ecx, ecx
mov dword [ebx + 0x40], edx
je 0x41d9a0
jmp 0x41d868
mov dword [ebx + 0x10], esi
mov edi, ebp
jmp 0x41d98c
mov dword [esp + 8], str.Failed_to_decrease_buffer_size_n
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call fcn.0056b9c0
mov esi, dword [ebx + 4]
mov edi, dword [ebx + 0x78]
jmp 0x41d98c
Function at 0x4309e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ecx
mov dword [esp + 0x14], 0
xor ecx, ecx
mov dword [esp + 0xc], ebx
pop ebx
jmp 0x42f600
Function at 0x476700
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x27c
mov ebp, dword [esp + 0x290]
mov dword [esp + 0xc], 1
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.00419560
mov dword [esp + 0xd0], eax
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x458]
mov esi, dword [ebp + 0x45c]
mov dword [esp + 0xd4], edx
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x450]
mov dword [esp + 0xb0], esi
mov dword [esp + 0xa4], edi
mov dword [esp + 0xb4], eax
mov eax, dword [ebp + 0x454]
mov dword [esp + 8], str.missing_streams
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 4]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call fcn.00575760
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x6855e2
mov dword [esp + 4], str.skip_clear
mov dword [esp], ebp
mov dword [esp + 0x80], eax
call fcn.00573870
or esi, edi
jne 0x476850
mov eax, dword [ebp + 4]
mov edi, 0x68694e
mov ecx, 4
mov dword [esp + 0xb8], 0
mov eax, dword [eax]
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x540920
Capabilities:
Create thread
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x2b0]
mov eax, dword [eax + 0x10]
test ah, 0x10
je 0x540942
test dword [ebx + 0x3c], 0x90000
je 0x540970
cmp edx, 1
je 0x5409f0
test ah, 0x20
je 0x5409a0
test byte [ebx + 0x2b4], 2
je 0x5409a0
cmp edx, 0x10
mov dword [ebx + 0x2b8], 2
jg 0x5409ae
jmp 0x5409e1
test byte [ebx + 0x41], 0x80
jne 0x540942
cmp edx, 1
je 0x5409f0
test byte [ebx + 0x2b4], 1
je 0x54094b
cmp edx, 0x10
mov dword [ebx + 0x2b8], 1
jg 0x5409ae
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.004d6530
test ah, 0x80
je 0x540a01
cmp edx, 0x10
jle 0x540a2a
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0x10
mov dword [esp + 8], str.Application_has_requested__d_threads._Using_a_thread_count_greater_than__d_is_not_recommended._n
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call fcn.0056b9c0
mov eax, dword [ebx + 0x2b8]
mov edx, eax
and edx, 2
test edx, edx
je 0x540a20
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp 0x540d50
mov dword [ebx + 0x2b8], 0
add esp, 0x28
xor eax, eax
pop ebx
ret
mov dword [ebx + 0x2b0], 1
mov dword [ebx + 0x2b8], 0
add esp, 0x28
xor eax, eax
pop ebx
ret
test al, 1
jne 0x540993
jmp 0x5409fa
mov eax, dword [ebx + 0x2b8]
mov edx, eax
and edx, 2
jmp 0x5409dd
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 0x2b0]
mov dword [esp], eax
call fcn.004e34d0
test eax, eax
je 0x540d79
cmp dword [ebx + 0x10], 1
je 0x540e60
test esi, esi
je 0x540e33
cmp esi, 1
jle 0x540e20
mov dword [esp], 0x30
call fcn.0056e410
mov edx, dword [ebx + 0xc]
mov edi, eax
mov eax, dword [ebx + 0x1c]
mov ecx, 0
test byte [edx + 0x74], 0x20
mov edx, 0x540a80
mov dword [eax + 0x14], edi
cmove edx, ecx
test edi, edi
je 0x540e0b
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x540a90
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00582240
cmp eax, 1
jle 0x540e00
mov dword [ebx + 0x2b0], eax
mov dword [ebx + 0x2c0], 0x540af0
xor eax, eax
mov dword [ebx + 0x2c4], 0x540b90
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call fcn.00582150
mov eax, dword [ebx + 0x1c]
add eax, 0x14
mov dword [esp], eax
call fcn.0056e3f0
mov dword [ebx + 0x2b0], 1
mov dword [ebx + 0x2b8], 0
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0055c250
mov edx, dword [ebx + 0x60]
test edx, edx
jne 0x540e70
cmp eax, 1
jle 0x540e16
mov esi, 0xf
cmp eax, 0xf
cmovg eax, esi
lea esi, [eax + 1]
mov dword [ebx + 0x2b0], esi
jmp 0x540d8a
cmp dword [ebx + 0x60], 0xaf0
jle 0x540d79
jmp 0x540e16
lea ecx, [edx + 0x1e]
add edx, 0xf
cmovs edx, ecx
sar edx, 4
cmp eax, edx
cmovg eax, edx
jmp 0x540e3f
Function at 0x55c310
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, ecx
mov ecx, 0x20
sub ecx, edx
xor edx, edx
shl ebx, cl
mov ecx, ebx
xor ebx, ebx
jmp 0x55c385
mov edx, ebx
mov esi, ebx
shl edx, 0x18
shl esi, 0x19
sar edx, 0x1f
and edx, ecx
xor edx, esi
mov esi, edx
add edx, edx
sar esi, 0x1f
and esi, ecx
xor edx, esi
mov esi, edx
add edx, edx
sar esi, 0x1f
and esi, ecx
xor edx, esi
mov esi, edx
add edx, edx
sar esi, 0x1f
and esi, ecx
xor esi, edx
mov edx, esi
add esi, esi
sar edx, 0x1f
and edx, ecx
xor edx, esi
mov esi, edx
add edx, edx
sar esi, 0x1f
and esi, ecx
xor esi, edx
mov edx, esi
add esi, esi
sar edx, 0x1f
and edx, ecx
xor edx, esi
mov esi, edx
add edx, edx
sar esi, 0x1f
and esi, ecx
xor edx, esi
bswap edx
mov dword [eax + ebx*4], edx
add ebx, 1
cmp ebx, 0x100
jne 0x55c325
lea ebx, [eax + 0x400]
mov dword [eax + 0x400], 1
mov ecx, eax
mov edx, dword [ecx]
add ecx, 4
movzx esi, dl
shr edx, 8
xor edx, dword [eax + esi*4]
movzx esi, dl
mov dword [ecx + 0x3fc], edx
shr edx, 8
xor edx, dword [eax + esi*4]
movzx esi, dl
mov dword [ecx + 0x7fc], edx
shr edx, 8
xor edx, dword [eax + esi*4]
mov dword [ecx + 0xbfc], edx
cmp ecx, ebx
jne 0x55c3a5
xor eax, eax
pop ebx
pop esi
ret
Function at 0x5655c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x48]
mov eax, dword [esi + 0x178]
mov edx, dword [ebx + 0x178]
test eax, eax
je 0x565685
test edx, edx
mov ecx, dword [eax + 4]
je 0x565651
mov eax, dword [edx + 4]
cmp eax, ecx
je 0x565690
mov edi, dword [ecx + 4]
mov dword [esp + 0x1c], edi
mov edi, dword [edi + 0xc]
test edi, edi
je 0x565610
cmp dword [edi + 4], eax
je 0x5656b0
mov edi, dword [ecx + 0x24]
cmp dword [esi + 0x50], edi
je 0x56570c
mov edi, dword [ebx + 0x50]
cmp dword [eax + 0x24], edi
jne 0x5656e0
mov edx, dword [eax + 4]
mov edx, dword [edx]
mov edx, dword [edx + 0x4c]
test edx, edx
je 0x5656e0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x50]
cmp dword [ecx + 0x24], eax
jne 0x5656e0
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x5656e0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ecx
call eax
cmp eax, 0xffffffd8
jne 0x565649
mov edx, dword [ebx + 0x178]
test edx, edx
je 0x5656e0
mov eax, dword [edx + 4]
jmp 0x56561c
mov edi, dword [eax + 0x28]
cmp dword [esi + 0x50], edi
jne 0x5655f9
mov edi, dword [eax + 0x24]
cmp dword [ebx + 0x50], edi
jne 0x5655f9
nop
lea esi, [esi]
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x5656ea
mov esi, dword [eax + 4]
mov dword [esp], ebx
call fcn.00562860
mov eax, dword [esi]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005634c0
mov eax, 0xffffffd8
jmp 0x565649
mov dword [esp + 8], str.Invalid_mapping_found_when_attempting_unmap._n
mov dword [esp + 4], 0x10
mov dword [esp], ecx
call fcn.0056b9c0
mov eax, 0xffffffea
jmp 0x565649
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x565669
jmp 0x565689
Function at 0x56adf0
Capabilities:
Query environment variable

Disassembly:
cmp byte [edx], 0
je 0x56ae30
push esi
push ebx
mov ebx, edx
mov esi, eax
sub esp, 0x34
mov edx, dword [0x66efcc]
test edx, edx
js 0x56ae32
cmp esi, 4
je 0x56ae16
mov eax, dword [0x66efcc]
test eax, eax
jne 0x56ae70
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], ebx
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
add esp, 0x34
pop ebx
pop esi
ret
repz ret
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
cmp eax, 0xffffffff
mov dword [0x7f6964], eax
je 0x56ae5c
mov dword [esp], str.NO_COLOR
call sub.msvcrt.dll_getenv
test eax, eax
je 0x56aed0
cmp esi, 4
mov dword [0x66efcc], 0
jne 0x56ae0d
jmp 0x56ae16
movzx eax, byte [esi + 0x704580]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or ax, word [0x7f696a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0x7f6964]
mov dword [esp], eax
call esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
sub esp, 8
mov dword [esp], ebx
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
movzx eax, word [0x7f6968]
mov dword [esp + 4], eax
mov eax, dword [0x7f6964]
mov dword [esp], eax
call esi
sub esp, 8
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x56ae5c
lea eax, [esp + 0x1a]
mov dword [0x66efcc], 1
mov dword [esp + 4], eax
mov eax, dword [0x7f6964]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
movzx eax, word [esp + 0x22]
mov word [0x7f6968], ax
and ax, 0xf0
mov word [0x7f696a], ax
jmp 0x56ae08