joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d730
Capabilities:
Resolve dns
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x5c8eb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, str.2048
push str._n_r_______________________________________________________________________n
cmovne esi, eax
call fcn.0048f060
push esi
push str.Binding_to__s_n
call fcn.0048f060
lea eax, [ebp - 0x434]
push eax
push esi
call fcn.0047dc30
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x42c], edi
test edi, edi
jns 0x47d796
push str.Unable_to_start_server_n
push 1
call fcn.0048eb50
add esp, 8
test ebx, ebx
je 0x47d7a8
push ebx
push str.Password:__s_n
call fcn.0048f060
add esp, 8
push str.Waiting_for_connections_n
call fcn.0048f060
add esp, 4
cmp dword [ebp - 0x434], 2
mov ecx, 0x10
mov eax, 0x1c
cmove eax, ecx
push eax
mov dword [ebp - 0x430], eax
call fcn.004f6757
mov esi, eax
add esp, 4
test esi, esi
jne 0x47d7fa
call fcn.004f6c72
push dword [eax]
call fcn.004f6d4a
push eax
push str.In_start_tcp_srv:_Out_of_memory_for_client_address._malloc___error:__s
push 1
call fcn.0048eb50
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push esi
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
test edi, edi
jns 0x47d82b
call fcn.004f6c72
cmp dword [eax], 4
jne 0x47d8ed
push esi
call fcn.004f6752
mov edi, dword [ebp - 0x42c]
jmp 0x47d7b2
push 0
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x401
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x430]
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x47d883
push 0
push 0x400
push 0x6016a0
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x6016a0
push str.getnameinfo___error:__s_n
call fcn.0048f060
add esp, 8
jmp 0x47d89b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x428]
push eax
push str._s:_s_Connected_n
call fcn.0048f060
add esp, 0xc
push esi
call fcn.004f6752
push ebx
push edi
call fcn.0047ccd0
add esp, 0xc
test eax, eax
jg 0x47d8ce
push str.Connection_closed_n
call fcn.0048f060
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, dword [ebp - 0x42c]
jmp 0x47d7b5
push dword [ebp - 0x42c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f01b3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.accept___error:__ld_n
call fcn.0047df20
add esp, 8
push 1
call fcn.004f72e5
int3
Function at 0x47dc30
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.0047cf30
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
movups xmmword [ebp - 0x28], xmm0
push 0
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x47dcaa
push 0
push 0x400
push 0x6016a0
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x6016a0
push str.getaddrinfo___error:__s_n
call fcn.0048f060
add esp, 8
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push edi
or edi, 0xffffffff
mov esi, eax
test eax, eax
je 0x47dd72
push dword [esi + 0xc]
push 1
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47dcea
call ebx
push eax
push str.socket___error:__ld_n
call fcn.0047df20
add esp, 8
jmp 0x47dd46
cmp dword [esi + 4], 0x17
jne 0x47dd1e
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x47dd1e
call ebx
push eax
push str.setsockopt___error:__ld_n
call fcn.0047df20
add esp, 8
jmp 0x47dd46
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x47dd67
call ebx
push eax
push str.bind___error:__ld_n
call fcn.0047df20
add esp, 8
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
add esi, 0x1c
cmp dword [esi], 0
je 0x47dd5b
push str.trying_next_address_..._n
call fcn.0048f060
add esp, 4
mov esi, dword [esi]
test esi, esi
jne 0x47dcc3
jmp 0x47dd6f
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x47dda4
push accept
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x47ddae
call ebx
push eax
push str.listen___error:__ld_n
call fcn.0047df20
add esp, 8
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ddc0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.0047cf30
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x24], 0
push dword [ebp + 8]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 0x20], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x47de34
push 0
push 0x400
push 0x6016a0
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x6016a0
push str.getaddrinfo___error:__s_n
call fcn.0048f060
add esp, 8
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push ebx
push esi
mov esi, eax
push edi
test eax, eax
je 0x47ded4
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop word [eax + eax]
push dword [esi + 0xc]
push 1
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47de8c
call ebx
push eax
push str.socket___error:__ld_n
call fcn.0047df20
add esi, 0x1c
add esp, 8
cmp dword [esi], 0
je 0x47dec9
push str.trying_next_address_..._n
call fcn.0048f060
add esp, 4
jmp 0x47dec9
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x47decf
call ebx
push eax
push str.connect___error:__ld_n
call fcn.0047df20
add esi, 0x1c
add esp, 8
cmp dword [esi], 0
je 0x47dec2
push str.trying_next_address_..._n
call fcn.0048f060
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esi]
test esi, esi
jne 0x47de50
mov eax, dword [ebp - 4]
jmp 0x47ded7
mov edi, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
jne 0x47deec
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
or ecx, 0xffffffff
test eax, eax
cmovs edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47e090
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ebp + 0xc]
mov esi, 1
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x47e0be
call fcn.004f6c72
cmp dword [eax], 4
jne 0x47e0d0
xor eax, eax
jmp 0x47e0c0
je 0x47e0c6
add edi, eax
sub esi, eax
jne 0x47e0a1
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
call fcn.0047ce90
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x47e0e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ebx
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x47e119
push 0
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x47e111
call fcn.004f6c72
cmp dword [eax], 4
jne 0x47e120
xor eax, eax
jmp 0x47e113
je 0x47e119
add edi, eax
sub esi, eax
jne 0x47e0f2
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
call fcn.0047ce90
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x47ec10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x5c8eb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push eax
call fcn.00490620
push 0x8000
push esi
call fcn.00501ab4
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x47ec55
mov eax, str.Could_not_open_file
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f01b3
mov esp, ebp
pop ebp
ret
push 0x4000
push 0x5fd6a0
push esi
call fcn.005072ed
add esp, 0xc
test eax, eax
jle 0x47ec96
nop dword [eax]
push eax
lea eax, [ebp - 0x6c]
push 0x5fd6a0
push eax
call fcn.004908c0
push 0x4000
push 0x5fd6a0
push esi
call fcn.005072ed
add esp, 0x18
test eax, eax
jg 0x47ec70
push esi
call fcn.00506cea
lea eax, [ebp - 0x6c]
push 0x5fd6a0
push eax
call fcn.00490320
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x5fd6a0
pop esi
call fcn.004f01b3
mov esp, ebp
pop ebp
ret
Function at 0x488b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
xor bh, bh
xor edi, edi
nop
mov ecx, edi
mov edx, esi
shr edx, cl
mov al, bh
and dl, 1
add al, 0x21
movzx eax, al
inc bh
movzx ecx, dl
inc edi
imul ecx, eax
xor bl, cl
cmp bh, 0x17
jb 0x488b90
mov eax, esi
shr eax, 0x17
and al, 1
shl al, 5
xor bl, al
mov al, bl
and al, 0x1f
cmp al, 0x1f
je 0x488bde
test bl, 0x20
je 0x488bd1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
movzx eax, bl
mov ecx, 0x1e
sub ecx, eax
btc esi, ecx
mov edx, esi
mov eax, esi
and eax, 0x7f00
shr edx, 1
and edx, 0x3f8000
mov ecx, esi
or eax, edx
and ecx, 0x70
shr eax, 1
and esi, 4
or eax, ecx
shr eax, 1
pop edi
or eax, esi
pop esi
shr eax, 2
pop ebx
pop ebp
ret
Function at 0x48d850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
cmp byte [esi], 0
je 0x48d900
movsx eax, byte [esi]
add eax, 0xffffffde
cmp eax, 0x1c
ja case.0x48d87c.35
movzx eax, byte [eax + 0x48d92c]
jmp dword [eax*4 + 0x48d914]
push edi
mov eax, esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.004f88b9
push str.lt_
jmp 0x48d8ea
push edi
mov eax, esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.004f88b9
push str.gt_
jmp 0x48d8ea
push edi
mov eax, esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.004f88b9
push str.quot_
jmp 0x48d8ea
push edi
mov eax, esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.004f88b9
push str.amp_
jmp 0x48d8ea
push edi
mov eax, esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.004f88b9
push str.apos_
push edi
call fcn.00402d30
add esp, 0x18
lea ecx, [esi + 1]
inc esi
cmp byte [esi], 0
jne 0x48d866
push edi
sub esi, ecx
push esi
push 1
push ecx
call fcn.004f88b9
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x48eb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x6023e8], 0
push esi
je 0x48eb64
push str.MESSAGE
jmp 0x48eb69
push str._rError:
push 2
call fcn.004f6faa
add esp, 4
push eax
call fcn.00402d30
mov esi, dword [ebp + 0xc]
add esp, 8
push 2
call fcn.004f6faa
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
push 0
push esi
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.004f614a
add esp, 0x18
push 0x51e8a4
push 2
call fcn.004f6faa
add esp, 4
push eax
call fcn.00402d30
add esp, 8
call fcn.0040f0f0
push dword [ebp + 8]
call fcn.004f72e5
int3

Function at 0x48f420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor esi, esi
test edi, edi
jle 0x48f453
push ebx
mov ebx, dword [ebp + 8]
movzx edx, byte [esi + ebx]
mov eax, ecx
sar eax, 0x18
inc esi
xor edx, eax
shl ecx, 8
movzx eax, dl
xor ecx, dword [eax*4 + 0x5c7df8]
cmp esi, edi
jl 0x48f435
pop ebx
xor eax, eax
test ecx, ecx
pop edi
sete al
pop esi
pop ebp
ret
Function at 0x4924f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492500

Function at 0x492780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x49278c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004927a0
Function at 0x4bd460
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
mov edx, dword [ecx + 4]
mov edi, dword [eax + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x10]
mov esi, edx
sub esi, dword [eax + 0x18]
cmp esi, dword [eax + 0x1c]
jb 0x4bd48d
pop edi
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
push ebx
add esi, 2
lea ebx, [ebp + 0x10]
shl esi, 4
add esi, eax
mov eax, dword [edi + 0x10]
push ebx
push ecx
push edx
mov dword [esi + 0xc], 0
mov eax, dword [eax + 0x18]
push edi
call eax
mov edi, dword [ebp + 0x14]
add esp, 0x10
test eax, eax
jne 0x4bd5a4
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x54]
cmp dword [ecx + 0x48], 0x62697473
lea edx, [ecx + 0x4c]
jne 0x4bd5a4
mov eax, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x40]
add eax, 0x20
sar eax, 6
add ebx, 0x20
mov dword [ebp + 0xc], eax
movzx eax, byte [edx]
sar ebx, 6
cmp eax, dword [edx]
jne 0x4bd5a4
movzx eax, byte [edx + 4]
cmp eax, dword [edx + 4]
jne 0x4bd5a4
movsx eax, byte [edx + 8]
cmp eax, dword [edx + 8]
jne 0x4bd5a4
movsx eax, byte [ecx + 0x64]
cmp eax, dword [ecx + 0x64]
jne 0x4bd5a4
movsx eax, byte [ecx + 0x68]
cmp eax, dword [ecx + 0x68]
jne 0x4bd5a4
movsx eax, bl
cmp eax, ebx
jne 0x4bd5a4
mov eax, dword [ebp + 0xc]
movsx eax, al
cmp eax, dword [ebp + 0xc]
jne 0x4bd5a4
mov al, byte [edx + 4]
push dword [ebp - 4]
mov byte [esi], al
movzx eax, byte [edx]
mov byte [esi + 1], al
movsx ax, byte [edx + 8]
push edx
push esi
mov word [esi + 6], ax
movzx eax, byte [ecx + 0x64]
mov byte [esi + 2], al
movzx eax, byte [ecx + 0x68]
mov byte [esi + 3], al
mov eax, dword [ebp + 0xc]
mov byte [esi + 9], al
mov byte [esi + 8], bl
movzx eax, byte [edx + 0x12]
mov byte [esi + 4], al
movzx eax, byte [edx + 0x10]
dec al
mov byte [esi + 5], al
call fcn.004bd310
add esp, 0xc
mov ecx, eax
test edi, edi
je 0x4bd59b
movzx eax, word [esi + 6]
movsx edx, ax
test ax, ax
jns 0x4bd592
neg edx
movzx eax, byte [esi + 1]
imul eax, edx
mov dword [edi], eax
test ecx, ecx
je 0x4bd5b8
cmp cl, 0x40
je 0x4bd5b8
xor ecx, ecx
mov word [esi], 0xff
mov dword [esi + 0xc], 0
test edi, edi
je 0x4bd5b8
mov dword [edi], ecx
pop ebx
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c7d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push ebx
movzx ebx, word [eax]
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp ecx, eax
jb 0x4c7db3
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, ecx
push esi
mov esi, dword [ebp + 0x14]
cmp esi, eax
cmova esi, eax
xor edx, edx
mov dword [ebp + 0x14], esi
test esi, esi
je 0x4c7e04
push edi
mov edi, dword [ebp + 0x10]
sub ecx, edi
mov dword [ebp + 0xc], esi
mov esi, ecx
movzx eax, byte [esi + edi]
lea edi, [edi + 1]
mov edx, ebx
mov ecx, 0x58bf
shr edx, 8
xor edx, eax
add eax, ebx
imul eax, eax, 0x3193
mov byte [edi - 1], dl
sub ecx, eax
sub dword [ebp + 0xc], 1
movzx ebx, cx
jne 0x4c7dd2
mov esi, dword [ebp + 0x14]
mov edx, esi
mov ecx, dword [ebp - 8]
pop edi
mov eax, dword [ebp + 8]
add ecx, esi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov word [eax], bx
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b0d9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050af58

Function at 0x510b00
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051046e

Function at 0x510b0b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005106a9
Function at 0x10001480
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006c00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push edi
mov edi, dword [ebp + 8]
jne 0x100015a1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x401b87
call esi
lea eax, [ebp - 8]
mov byte [0x401b87], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x401b87
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x401bad
call esi
lea eax, [ebp - 8]
mov byte [0x401bad], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x401bad
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x402ca0
call esi
mov eax, dword [0x10059428]
mov ecx, 0x402ca0
mov dword [ecx], eax
movzx eax, byte [0x1005942c]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x402ce0
call esi
mov eax, dword [0x10059428]
mov ecx, 0x402ce0
mov dword [ecx], eax
movzx eax, byte [0x1005942c]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x402cb0
call esi
mov eax, dword [0x10059428]
mov ecx, 0x402cb0
mov dword [ecx], eax
movzx eax, byte [0x1005942c]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10054bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.100563d4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100052f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10005351
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10005334
cmp edi, 2
jb 0x10005334
cmp byte [esi], cl
jne 0x10005334
cmp byte [esi + 1], cl
jne 0x10005334
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10059a10]
jmp 0x10005305
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10059a10]
test edi, edi
jne 0x10005305
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10005380
cmp cl, 0x23
jne 0x10005367
cmp byte [esi], cl
jne 0x10005367
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10059a10]
test cl, cl
jne 0x10005358
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10005520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10005545
push 0x736
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_RANPINAS1ImGui_StandaloneImGuiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005552
mov dword [edi], 0
mov edx, 0x10062e80
mov ecx, esi
call fcn.10005390
mov esi, eax
test esi, esi
je 0x10005642
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10005638
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10005638
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10005638
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10005638
mov eax, dword [0x100726d8]
test eax, eax
je 0x100055cc
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10005638
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000561d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x100726d8]
add esp, 4
test eax, eax
je 0x1000560a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000562f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0xfc], 0
mov dword [ebp - 8], edi
jg 0x10007b2c
push 0x756
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_RANPINAS1ImGui_StandaloneImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebx + 0xfc]
lea edx, [ebp - 8]
mov ebx, dword [ebx + 0x104]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10059a10]
sub esi, 1
jne 0x10007b46
mov eax, dword [0x100726d8]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10007b7e
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1002a410
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100563d4
mov esp, ebp
pop ebp
ret 4