joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor esi, esi
mov ecx, dword [ebx + 0x3c]
mov edi, dword [ecx + ebx + 0x78]
mov ecx, dword [edi + ebx + 0x24]
add edi, ebx
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x18], esi
jbe 0x4054e2
nop
mov ecx, dword [eax + esi*4]
add ecx, ebx
call fcn.004053e0
mov ecx, dword [ebp - 4]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4054d0
test dl, dl
je 0x4054cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4054d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4054b0
xor eax, eax
jmp 0x4054d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4054eb
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4054a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x694747f8
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x10002084
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x403fd7
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x403fd9
ret

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
xlatb
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0
push ebx
sbb eax, 0x14508900
xor cl, byte [esi]
add dl, byte [ecx + 0x14]
mov dword [edx], ebx
mov eax, dword [esi]
mov dword [eax + 0x34], 1
mov ecx, dword [esi]
add ecx, 0x2a
push ecx
call 0xad406010
pop edi
sub dword [eax], esi
pop ebp
ret
push ebp
mov ebp, esp
or dword [edx + 0x10], 0x53008702
mov ebx, dword [ebp + 0x2f]
push esi
jg 0x4067db
sahf
add al, 0x83
clc
dec dword [edi]
test byte [ecx + eax + 0x4b8b000a], dl
xchg ebx, eax
popal
leave
je 0x5c6a52
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0x12
inc esp
test eax, 0x710137
push esp
xor eax, 0x40c1be
dec eax
test eax, edi
je 0x60996944
call esi
cmp ah, 0xa
add byte [edx - 0x4d], dh
and ecx, dword [ebx]
add byte [edi], cl
test dword [ecx + 1], edx
test eax, 0x207b8b00
mov esi, dword [ebx + 0x24]
mov eax, esi
mov ebx, 0x5f0e75c6
adc edi, dword [eax + 0xb24b4]
pop ebx
mov esp, ebp
sub dl, al
inc ecx
add byte [ebx + 0x12e0443], cl
pop eax
add byte [eax], al
test esi, esi
dec esi
test dword [eax], ecx
std
invalid
Function at 0x421244
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004210ba

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4063f8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
lea eax, [0x573638]
push eax
push 0
push 2
call sub.KERNEL32.dll_OpenFileMappingA
mov dword [0x58d140], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x58d13c], eax
mov edx, dword [0x58d13c]
add esp, 4
mov dword [0x58d148], edx
cmp dword [0x58d148], 0
jne 0x406472
sub esp, 4
mov dword [0x58d144], 0x704
push 0x704
call fcn.00563550
add esp, 8
mov dword [0x58d148], eax
sub esp, 4
lea edx, str.hEventIter
push edx
push 0
push 0x1f0003
call sub.KERNEL32.dll_OpenEventA
lea edx, str.hEventUnsOut
mov dword [0x58d138], eax
push edx
push 0
push 0x1f0003
call sub.KERNEL32.dll_OpenEventA
lea edx, str.hEventFinishedOK
mov dword [0x58d134], eax
push edx
push 0
push 0x1f0003
call sub.KERNEL32.dll_OpenEventA
lea edx, [0x5735f8]
mov dword [0x58d130], eax
push edx
push 0
push 0x1f0003
call sub.KERNEL32.dll_OpenEventA
add esp, 4
mov dword [0x58d12c], eax
call sub.KERNEL32.dll_GetCurrentThread
mov esp, ebp
mov dword [0x58d128], eax
pop ebp
ret
Function at 0x53c6a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], 1
mov dword [0x5a6168], ebx
mov dword [0x5a616c], 0x5a0368
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
lea eax, [ebp - 4]
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ebx
push ecx
call fcn.0053f0b0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ecx + esi - 1]
cmp esi, edi
ja 0x53c835
cmp esi, edi
ja 0x53c835
cmp dword [0x588fb8], 1
jle 0x53c71c
movsx ecx, byte [esi]
push 8
push ecx
call fcn.00564779
add esp, 8
jmp 0x53c72a
movsx edx, byte [esi]
mov eax, dword [str.________________________________H]
mov al, byte [eax + edx*2]
and eax, 8
test eax, eax
je 0x53c731
inc esi
jmp 0x53c6fb
mov ecx, dword [0x5a6168]
mov eax, dword [ebp - 8]
inc ecx
cmp ecx, eax
mov dword [0x5a6168], ecx
jle 0x53c799
cmp eax, 1
jne 0x53c77a
push 0x5a616c
push 0
push 0x2c
mov dword [ebp - 8], 0xb
call fcn.0053f0b0
add esp, 0xc
test eax, eax
jne 0x53c837
mov ecx, dword [0x5a616c]
mov edx, dword [0x5a0368]
mov dword [ecx], edx
jmp 0x53c799
add eax, 0xa
push 0x5a616c
mov dword [ebp - 8], eax
shl eax, 2
push eax
call fcn.0053f0f0
add esp, 8
test eax, eax
jne 0x53c837
mov ecx, dword [0x5a616c]
mov eax, dword [0x5a6168]
mov edx, dword [ebp - 4]
mov dword [ecx + eax*4 - 4], edx
cmp esi, edi
ja 0x53c820
cmp byte [esi], 0x22
jne 0x53c7df
inc esi
test ebx, ebx
je 0x53c7d5
mov al, byte [esi]
xor ebx, ebx
cmp al, 0x22
jne 0x53c7df
cmp esi, edi
ja 0x53c7da
mov ecx, dword [ebp - 4]
mov byte [ecx], 0x22
mov ecx, dword [ebp - 4]
inc ecx
inc esi
mov dword [ebp - 4], ecx
jmp 0x53c7da
mov ebx, 1
cmp byte [esi], 0x22
je 0x53c7b4
test ebx, ebx
jne 0x53c80f
cmp dword [0x588fb8], 1
jle 0x53c7fc
movsx edx, byte [esi]
push 8
push edx
call fcn.00564779
add esp, 8
jmp 0x53c80b
movsx eax, byte [esi]
mov ecx, dword [str.________________________________H]
mov al, byte [ecx + eax*2]
and eax, 8
test eax, eax
jne 0x53c820
mov eax, dword [ebp - 4]
mov dl, byte [esi]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
inc ecx
inc esi
mov dword [ebp - 4], ecx
jmp 0x53c7ab
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
mov ecx, dword [ebp - 4]
inc ecx
cmp esi, edi
mov dword [ebp - 4], ecx
jbe 0x53c703
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x548010
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x5a3aa0]
push ebx
xor eax, eax
push esi
test edx, edx
push edi
jbe 0x548038
mov ecx, 0x5a0aa0
mov esi, dword [ebp + 8]
mov edi, dword [ecx]
cmp esi, edi
je 0x548055
inc eax
add ecx, 8
cmp eax, edx
jb 0x548027
mov eax, dword [ebp + 0xc]
push 0x800
push 0x5a2f34
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x548061
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [eax*8 + 0x5a0aa4]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 0x10000080
push 3
push 0
push 1
push 0x80000000
push 0x5a2f34
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x548092
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
jne 0x5480bf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
jne 0x5480e9
call ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov eax, dword [edx + 0x18]
add eax, ecx
mov ecx, dword [0x5a3aa0]
mov dword [ecx*8 + 0x5a0aa0], edx
mov dword [ecx*8 + 0x5a0aa4], eax
inc ecx
mov dword [0x5a3aa0], ecx
pop ebp
ret
Function at 0x548ea0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi + 0xc]
add eax, edx
cmp byte [eax], 0xcc
jne 0x548ec8
mov edx, dword [esi + 8]
cmp ecx, edx
jae 0x548ec8
mov bl, byte [eax + 1]
inc eax
inc ecx
cmp bl, 0xcc
je 0x548eba
mov edx, dword [esi + 8]
pop esi
cmp ecx, edx
pop ebx
jb 0x548ed5
xor eax, eax
pop ebp
ret
mov dl, byte [eax]
xor ecx, ecx
cmp dl, 0xe9
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x551ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [eax + 0x12c]
push edi
mov ebx, dword [esi]
and ecx, 2
je 0x551b22
mov edx, dword [esi + 8]
cmp edx, 5
jl 0x551b22
cmp edx, 0x11
jg 0x551b22
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x551bff
lea esi, [ebx + ecx - 1]
mov cl, byte [edi + ebx]
mov dl, cl
xor dl, byte [esi]
xor cl, dl
mov byte [edi + ebx], cl
mov cl, byte [esi]
xor cl, dl
inc edi
mov byte [esi], cl
dec esi
cmp edi, eax
jl 0x551b01
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
movsx edx, byte [eax + 0x120]
mov eax, dword [esi + 8]
mov dword [ebp + 0xc], edx
cmp eax, 0x19
jl 0x551b39
cmp eax, 0x1f
jle 0x551b4b
cmp eax, 0x28
jl 0x551bff
cmp eax, 0x30
jg 0x551bff
test ecx, ecx
je 0x551b82
test edx, edx
jne 0x551b82
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x551b82
lea esi, [ebx + ecx - 1]
mov cl, byte [edi + ebx]
mov dl, byte [esi]
xor dl, cl
xor cl, dl
mov byte [edi + ebx], cl
mov cl, byte [esi]
xor cl, dl
inc edi
mov byte [esi], cl
dec esi
cmp edi, eax
jl 0x551b67
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov eax, dword [eax*4 + 0x57d024]
cmp eax, 0xffffffff
jne 0x551b9d
pop edi
pop esi
mov eax, 0x4000005f
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax*4]
add eax, edx
mov eax, dword [eax*4 + 0x57d0e8]
test eax, eax
je 0x551bff
lea ecx, [ebp - 0x10]
push ecx
push 0
push ebx
call eax
add esp, 0xc
cmp eax, 1
je 0x551bcd
pop edi
pop esi
mov eax, 0x4000005f
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp eax, 4
jne 0x551be8
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [edx]
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp eax, 8
jne 0x551bff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x553a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
shl eax, 1
movsx edx, byte [eax + 0x57d430]
cmp ecx, edx
jle 0x553a97
movsx eax, byte [eax + 0x57d431]
mov dword [esi + 0xc], eax
cmp ecx, 2
jne 0x553aa9
cmp dword [esi + 0x1c], 1
jne 0x553aa9
mov dword [esi + 0x10], 3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x553c04
movsx ecx, byte [eax*2 + 0x57d430]
cmp ecx, dword [esi + 0x10]
jne 0x553c04
cmp eax, 0x1c
jne 0x553aec
mov ecx, dword [esi + 0x18]
mov eax, ecx
and eax, 0x80000003
jns 0x553adb
dec eax
or eax, 0xfffffffc
inc eax
je 0x553ae6
mov edx, 4
sub edx, eax
mov eax, edx
lea ebx, [ecx + eax + 4]
jmp 0x553af1
mov ebx, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
mov edi, ecx
mov dword [ebp - 4], ebx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jle 0x553b44
mov edx, dword [esi]
sub edx, eax
lea eax, [ecx + 1]
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
shl eax, 9
push ecx
push eax
mov dword [ebp + 8], edx
call fcn.0053f0f0
add esp, 8
test eax, eax
jne 0x553c09
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 8]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi + 4]
mov edi, ecx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jg 0x553b06
mov eax, dword [esi + 0xc]
cmp eax, 0x1c
je 0x553baf
mov ecx, dword [esi]
and eax, 0xff
pop edi
mov edx, dword [ecx]
and edx, 0xffff0000
xor edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x20]
and eax, 0xff
and edx, 0xff00ffff
shl eax, 0x10
or eax, edx
mov dword [ecx], eax
mov edx, dword [esi + 0x1c]
shl edx, 0x18
and eax, 0xffffff
or edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x18]
mov dword [ecx + 8], edx
mov ecx, dword [esi]
mov eax, dword [esi + 8]
add ecx, 0xc
add eax, 0xc
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov cl, byte [esi + 0xc]
mov byte [eax], cl
mov dx, word [esi + 0x18]
mov word [eax + 2], dx
mov byte [eax + 1], 0
mov edi, dword [esi + 0x14]
lea edx, [eax + 4]
mov eax, dword [esi + 0x18]
xor ecx, ecx
test eax, eax
jle 0x553be6
mov eax, edx
sub edi, edx
mov bl, byte [edi + eax]
inc ecx
mov byte [eax], bl
mov ebx, dword [esi + 0x18]
inc eax
cmp ecx, ebx
jl 0x553bd5
mov ebx, dword [ebp - 4]
lea eax, [edx + ebx - 4]
mov dword [esi + 0xc], 0
mov dword [esi], eax
mov eax, dword [esi + 8]
add eax, ebx
pop edi
mov dword [esi + 8], eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc000003e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x554990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00554400
mov eax, dword [0x5a3d24]
mov esi, dword [ebp + 8]
test eax, eax
je 0x5549b8
test esi, esi
je 0x5549ad
mov eax, dword [esi]
jmp 0x5549af
xor eax, eax
push eax
call fcn.0056edf0
add esp, 4
test esi, esi
je 0x5549c0
mov esi, dword [esi]
jmp 0x5549c2
xor esi, esi
push esi
call fcn.0056446a
pop esi
nop
nop
nop
nop
nop
nop
nop

Function at 0x555760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5a3d24]
push ebx
push esi
xor esi, esi
test eax, eax
push edi
je 0x555828
mov eax, dword [ebp + 0x20]
cmp eax, 1
je 0x5557aa
cmp eax, 2
je 0x5557aa
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x555798
cmp eax, 0xfffffffa
jne 0x555798
mov ebx, dword [ebp + 8]
mov esi, 1
jmp 0x5557b5
test eax, eax
jne 0x5557b2
mov esi, 1
call fcn.0056ee00
mov ebx, eax
jmp 0x5557b5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x5a3d24]
test eax, eax
je 0x5557d8
test edi, edi
je 0x5557d8
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x5557d8
push ebx
call fcn.0056edf0
push ebx
call fcn.0056ee00
add esp, 8
test esi, esi
je 0x555828
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
push eax
push ecx
call fcn.0056edf0
mov edi, dword [ebp + 0x14]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
mov dword [edi], esi
jne 0x555800
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push ebx
push 2
push 0x588ba8
call fcn.0056edf0
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov byte [esi + edx], 0xa
mov eax, dword [edi]
inc eax
mov dword [edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x20]
push 0
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x20]
pop edi
mov dword [esi], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x4013d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x23c
mov eax, dword [0x40c07c]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
xor ebx, ebx
push ebx
push 2
mov byte [esp + 0x13], bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov ebp, eax
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x20], 0x22c
call fcn.00401aa0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401427
xor al, al
jmp 0x4014e4
lea edx, [esp + 0x14]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4014d9
push edi
mov edi, dword [esp + 0x24c]
push esi
lea eax, [esp + 0x40]
push eax
call fcn.004021a6
add esp, 4
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004011d0
mov esi, dword [esp + 0x14]
mov eax, dword [edi]
mov ecx, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401496
cmp dx, bx
je 0x401492
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401496
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401470
xor eax, eax
jmp 0x40149b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4014c5
cmp esi, ebx
je 0x4014b4
push esi
call fcn.004019c8
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401443
jmp 0x4014d7
cmp esi, ebx
mov byte [esp + 0x13], 1
je 0x4014d7
push esi
call fcn.004019c8
add esp, 4
pop esi
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x240]
pop ebp
pop ebx
xor ecx, esp
call fcn.0040220f
add esp, 0x23c
ret 4

Function at 0x401500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x41c
mov eax, dword [0x40c07c]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
mov esi, dword [esp + 0x424]
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.00401aa0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea edx, [esp + 0x216]
push 0
push edx
mov word [esp + 0x21c], 0
call fcn.00401aa0
add esp, 0xc
lea eax, [esp + 0x210]
push eax
push 0
push 0x409178
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [esp + 0x210]
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004011d0
mov ecx, dword [esp + 0x41c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040220f
add esp, 0x41c
ret 4