joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b37ea
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call fcn.004b36c3
test al, al
je 0x4b3957
mov ecx, esi
call fcn.004b35ad
test eax, eax
je 0x4b3957
lea ecx, [ebp - 0x14]
xor ebx, ebx
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push ecx
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x4b3957
mov byte [ebp - 0x10], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
inc ebx
push ebx
call fcn.004b2da0
push 3
mov dword [ebp - 0x1c], eax
call fcn.004b2da0
push 2
mov dword [ebp - 0x20], eax
call fcn.004b2da0
and dword [ebp - 0x18], 0
add esp, 0xc
cmp dword [ebp - 0xc], 0
mov ecx, eax
mov dword [ebp - 8], ecx
jbe 0x4b3921
xor esi, esi
push edi
mov edi, dword [ebp - 0x14]
cmp dword [esi + edi + 4], ebx
je 0x4b3880
cmp dword [esi + edi + 4], 2
jne 0x4b390d
cmp dword [esi + edi + 0x14], 0
jne 0x4b390d
test ecx, ecx
je 0x4b38b2
mov eax, dword [esi + edi]
and eax, 0x20031
cmp eax, 0x20031
jne 0x4b38b2
push dword [esi + edi + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b38b2
mov byte [ebp - 1], bl
jmp 0x4b390a
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4b38dc
mov eax, dword [esi + edi]
and eax, 0x20031
cmp eax, 0x20031
jne 0x4b38dc
push dword [esi + edi + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b38dc
mov byte [ebp - 2], bl
jmp 0x4b390a
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4b390a
mov eax, dword [esi + edi]
mov edx, 0x30031
and eax, edx
cmp eax, edx
jne 0x4b390a
push dword [esi + edi + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [ebp - 0x10]
test eax, eax
movzx ecx, cl
cmovne ecx, ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x18]
add esi, 0x20
inc edi
mov dword [ebp - 0x18], edi
cmp edi, dword [ebp - 0xc]
jb 0x4b386c
pop edi
lea eax, [ebp - 0x1c]
push eax
call fcn.004b3d62
lea eax, [ebp - 0x20]
push eax
call fcn.004b3d62
lea eax, [ebp - 8]
push eax
call fcn.004b3d62
add esp, 0xc
cmp byte [ebp - 1], 0
je 0x4b3951
cmp byte [ebp - 2], 0
je 0x4b3951
cmp byte [ebp - 0x10], 0
jne 0x4b3953
xor bl, bl
mov al, bl
jmp 0x4b3959
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4b3a16
Capabilities:
Compare security identifiers

Disassembly:
push 0x28
mov eax, 0x7bf995
call fcn.00720804
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.004b6721
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebx + 0x1c], edi
je 0x4b3bc3
cmp dword [ebx + 0x2c], edi
je 0x4b3bc3
test dword [ebp - 0x20], 0x1000
je 0x4b3a5f
test dword [ebp - 0x20], 0x400
mov esi, edi
je 0x4b3bc3
cmp dword [ebp - 0x24], edi
je 0x4b3bc6
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.004b3173
push 1
mov byte [ebp - 4], 1
call fcn.004b2da0
push 3
mov dword [ebp - 0x14], eax
call fcn.004b2da0
push 2
mov dword [ebp - 0x18], eax
call fcn.004b2da0
add esp, 0x14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x10], edi
jbe 0x4b3b86
mov esi, edi
mov edi, dword [ebp - 0x28]
mov eax, dword [esi + edi + 4]
test eax, eax
je 0x4b3b73
cmp eax, 5
je 0x4b3b73
cmp eax, 6
je 0x4b3b73
cmp dword [esi + edi + 0x14], 0
jne 0x4b3b73
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + edi]
call dword [eax + 4]
push dword [esi + edi + 0x1c]
mov byte [ebp + 8], al
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b3b0d
cmp dword [esi + edi + 4], 3
je 0x4b3b02
cmp dword [esi + edi + 4], 4
je 0x4b3b02
xor eax, eax
jmp 0x4b3b05
xor eax, eax
inc eax
push eax
push dword [ebp + 8]
push 1
jmp 0x4b3b67
push dword [esi + edi + 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b3b3b
cmp dword [esi + edi + 4], 3
je 0x4b3b30
cmp dword [esi + edi + 4], 4
je 0x4b3b30
xor eax, eax
jmp 0x4b3b33
xor eax, eax
inc eax
push eax
push dword [ebp + 8]
push 3
jmp 0x4b3b67
push dword [esi + edi + 0x1c]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b3b73
cmp dword [esi + edi + 4], 3
je 0x4b3b5e
cmp dword [esi + edi + 4], 4
je 0x4b3b5e
xor eax, eax
jmp 0x4b3b61
xor eax, eax
inc eax
push eax
push dword [ebp + 8]
push 2
lea eax, [ebp - 0x34]
push eax
call fcn.004b3bd8
add esp, 0x10
mov eax, dword [ebp - 0x10]
add esi, 0x20
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0x24]
jb 0x4b3aa6
sub esp, 0xc
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.00428444
call fcn.004b30da
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.004b3d62
lea eax, [ebp - 0x18]
push eax
call fcn.004b3d62
lea eax, [ebp - 0x1c]
push eax
call fcn.004b3d62
add esp, 0x18
lea ecx, [ebp - 0x34]
call fcn.0043c06a
jmp 0x4b3bc6
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
call fcn.004b61d3
mov eax, esi
call fcn.007207cd
ret 4
Function at 0x4b4393
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
lea eax, [ebp - 4]
push esi
push edi
xor esi, esi
push esi
push 5
push 2
push esi
push eax
push esi
mov dword [ebp - 4], esi
call ebx
or dword [ebp - 8], 0xffffffff
mov edi, esi
jmp 0x4b43da
push edi
call fcn.00741f99
push dword [ebp - 4]
call fcn.0074f6c5
pop ecx
pop ecx
push esi
push 5
push 2
mov edi, eax
lea eax, [ebp - 4]
push esi
push eax
push edi
call ebx
cmp eax, 0x7a
je 0x4b43bb
test eax, eax
jne 0x4b443a
lea ebx, [edi + 0x10]
cmp esi, dword [edi]
jae 0x4b443a
push dword [ebx - 8]
call dword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x7f000001
jne 0x4b4428
push dword [ebx]
call dword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x7f000001
jne 0x4b4428
mov eax, dword [ebp + 8]
movzx eax, word [eax + 2]
cmp dword [ebx - 4], eax
jne 0x4b4428
movzx eax, word [ebx + 4]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, dword [ebp + 0xc]
je 0x4b442e
inc esi
add ebx, 0x18
jmp 0x4b43e6
lea eax, [esi + 1]
imul eax, eax, 0x18
mov eax, dword [eax + edi]
mov dword [ebp - 8], eax
push edi
call fcn.00741f99
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b4449
Capabilities:
Initialize winhttp library

Disassembly:
push 0x78
mov eax, 0x7bfb36
call fcn.00720838
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x6c], esi
call fcn.00459577
cmp dword [edi + 0x10], 0
jne 0x4b4472
xor al, al
jmp 0x4b4590
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x4b446b
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
inc ecx
test eax, eax
je 0x4b449f
mov dword [ebp - 0x84], 2
mov dword [ebp - 0x7c], eax
jmp 0x4b44b6
cmp dword [ebp - 0x5c], 0
je 0x4b455c
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], 3
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x70], ecx
push edi
push eax
call fcn.00409509
pop ecx
pop ecx
push 9
xor eax, eax
lea edi, [ebp - 0x34]
pop ecx
push eax
push eax
push eax
push eax
mov dword [ebp - 4], eax
mov esi, str.BlizzardProxyInfo
lea eax, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
je 0x4b454f
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push ecx
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
push edi
mov esi, eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test esi, esi
je 0x4b454f
cmp dword [ebp - 0x68], 3
jne 0x4b452f
cmp dword [ebp - 0x64], 0
je 0x4b453a
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
call fcn.004b46bc
pop ecx
pop ecx
cmp dword [ebp - 0x64], 0
je 0x4b453a
push dword [ebp - 0x64]
call ebx
cmp dword [ebp - 0x60], 0
je 0x4b4545
push dword [ebp - 0x60]
call ebx
lea ecx, [ebp - 0x4c]
call fcn.004066fd
jmp 0x4b456d
lea ecx, [ebp - 0x4c]
call fcn.004066fd
jmp 0x4b446b
cmp dword [ebp - 0x54], 0
je 0x4b4583
push dword [ebp - 0x54]
push esi
call fcn.004b46bc
pop ecx
pop ecx
cmp dword [ebp - 0x58], 0
je 0x4b4578
push dword [ebp - 0x58]
call ebx
cmp dword [ebp - 0x54], 0
je 0x4b4583
push dword [ebp - 0x54]
call ebx
cmp dword [ebp - 0x50], 0
je 0x4b458e
push dword [ebp - 0x50]
call ebx
mov al, 1
call fcn.007207e2
ret
Function at 0x4b65e0
Capabilities:
Compare security identifiers

Disassembly:
push 0x28
mov eax, 0x7bfe3f
call fcn.00720804
mov esi, ecx
and dword [ebp - 0x20], 0
mov edi, dword [ebp + 8]
and dword [edi], 0
and dword [edi + 4], 0
and dword [edi + 8], 0
and dword [ebp - 4], 0
push 0
mov dword [ebp - 0x20], 1
call fcn.004b695a
test al, al
je 0x4b6717
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4b6717
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 4]
jmp 0x4b670e
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4b6701
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4b6701
mov al, byte [ebx]
test al, al
jne 0x4b66ad
push dword [ebx + 4]
lea eax, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call dword [eax + 4]
mov byte [ebp - 0xd], al
test al, al
je 0x4b6701
mov eax, dword [esi + 0x34]
mov ebx, dword [esi + 0x30]
mov dword [ebp - 0x24], eax
cmp ebx, eax
je 0x4b6701
push dword [ebp - 0x14]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4b669d
add ebx, 8
cmp ebx, dword [ebp - 0x24]
jne 0x4b6683
jmp 0x4b6701
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x2c], al
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
jmp 0x4b66f9
cmp al, 1
jne 0x4b6701
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
cmp eax, ecx
mov dword [ebp - 0x24], ecx
jmp 0x4b66d5
push edx
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4b66df
mov eax, dword [ebp - 0x14]
add eax, 8
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
lea edx, [ebx + 8]
jne 0x4b66be
jmp 0x4b6701
mov eax, dword [esi]
mov ecx, esi
push dword [ebx + 4]
call dword [eax + 4]
or al, 0x80
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
call fcn.00472023
mov eax, dword [esi + 0x2c]
mov edx, dword [ebp - 0x1c]
inc edx
movzx ecx, word [eax + 4]
cmp edx, ecx
mov dword [ebp - 0x1c], edx
jb 0x4b6632
mov eax, edi
call fcn.007207cd
ret 4
Function at 0x4cd174
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0xbc
mov eax, 0x7ab2dc
call fcn.00720838
mov esi, ecx
push esi
push 0x7ec470
push 1
xor ebx, ebx
push ebx
push 0x7ec460
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x4cd1a5
cmp dword [esi], ebx
jne 0x4cd1f9
call fcn.00405a2d
push 2
push eax
lea ecx, [ebp - 0xc8]
call fcn.00404fa8
push edi
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], ebx
push str.Failed_to_connect_Windows_Firewall_policy_due_to
push eax
call fcn.00401ea3
pop ecx
pop ecx
mov ecx, eax
call fcn.004601b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004052de
push 0xb
push str.init_policy
lea ecx, [esi + 0xc]
mov dword [esi + 0x24], edi
call fcn.00403b67
cmp dword [esi], ebx
setne al
call fcn.007207e2
ret
Function at 0x4d6f2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x7c3bb9
call fcn.00720804
xor esi, esi
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00505a2e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4d6f60
mov eax, dword [eax]
push ecx
push eax
mov ecx, edi
call fcn.004ab9d7
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4d6f77
mov eax, dword [eax]
push ecx
push eax
mov ecx, edi
call fcn.004ab935
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
movsd xmm0, qword [eax + 0x20]
or dword [edi + 8], 8
mov ecx, dword [edi + 8]
movsd qword [edi + 0x18], xmm0
or ecx, 0x10
movsd xmm0, qword [eax + 8]
mov dword [edi + 8], ecx
or ecx, 0x20
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [eax + 0x10]
mov dword [edi + 8], ecx
or ecx, 0x40
movsd qword [edi + 0x30], xmm0
movsd xmm0, qword [eax + 0x18]
mov dword [edi + 8], ecx
or ecx, 0x80
movsd qword [edi + 0x38], xmm0
movzx eax, byte [esi]
mov dword [edi + 8], ecx
mov dword [edi + 0x2c], eax
movzx eax, byte [esi]
push eax
call fcn.0061a89f
pop ecx
push eax
mov ecx, edi
call fcn.004c2bd6
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or dword [edi + 8], 0x400
mov edx, dword [edi + 8]
mov dword [edi + 0x48], eax
or edx, 0x800
mov dword [edi + 0x4c], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 8], edx
or edx, 0x1000
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 8], edx
or edx, 0x2000
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 8], edx
or edx, 0x4000
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 8], edx
or edx, 0x8000
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 8], edx
or edx, 0x10000
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [edi + 8], edx
or edx, 0x20000
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], ecx
mov eax, dword [esi + 0x40]
mov dword [edi + 8], edx
or edx, 0x40000
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 8], edx
or edx, 0x80104
mov dword [edi + 0x88], eax
mov eax, edi
mov ecx, dword [esi + 0x48]
mov dword [edi + 0x8c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [edi + 0x60], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [edi + 8], edx
mov dword [edi + 0x28], ecx
call fcn.007207cd
ret
Function at 0x4f09da
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f0a01
mov eax, dword [ebp + 8]
or dword [eax + 4], esi
mov byte [eax], 0
jmp 0x4f0ab6
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, 0x4000
push 4
pop ebx
cmp eax, 0xffffffff
je 0x4f0a61
test eax, eax
mov dword [ebp - 4], 4
mov ebx, edi
cmovne ebx, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x1002
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
push 4
cmp dword [ebp - 8], ebx
je 0x4f0a60
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
pop ebx
push ebx
push eax
push 0x1002
push 0xffff
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x4f0a61
pop ebx
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x4f0aab
test eax, eax
mov dword [ebp - 4], ebx
cmovne edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [ebp - 8], edi
je 0x4f0aab
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 0x1001
push 0xffff
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov byte [eax], 1
mov dword [eax + 4], esi
pop esi
leave
ret

Function at 0x50e7f8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 4]
neg eax
sbb al, al
xor ecx, ebp
inc al
call fcn.007207bc
leave
ret
Function at 0x515245
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x280c
call fcn.00721650
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x280c], eax
add eax, 0x2844
push ebx
xor ebx, ebx
push esi
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x2808], ebx
jb 0x51527b
mov eax, dword [eax]
push 0x7f54e8
push eax
call fcn.0074f8fe
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x515303
push esi
call fcn.0074f6d0
pop ecx
test eax, eax
jne 0x5152fc
push edi
push esi
push 0x2800
lea eax, [ebp - 0x2804]
push 1
push eax
call fcn.00742b27
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x5152f0
mov ebx, edi
mov ecx, dword [ebp - 0x280c]
lea edx, [ebp - 0x2804]
mov eax, edi
sub eax, ebx
add eax, edx
push dword [ecx + 0x2800]
push ebx
push eax
push dword [ecx + 0x2804]
call dword [ecx + 0x2978]
add esp, 0x10
test eax, eax
js 0x515313
sub ebx, eax
jne 0x5152b9
mov ebx, dword [ebp - 0x2808]
push esi
call fcn.0074f6d0
pop ecx
test eax, eax
je 0x51529a
pop edi
push esi
call fcn.0074226b
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
push 0
mov ebx, eax
push 2
push esi
mov dword [ebp - 0x2808], ebx
call fcn.00742fc0
add esp, 0xc
jmp 0x5152f0

Function at 0x517270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
shr edx, 2
mov esi, 0xeeeeeeee
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x5172c3
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x925960]
movzx ecx, bl
add esi, dword [eax + ecx*4 + 0x1000]
mov eax, ebx
not eax
shl eax, 0x15
add eax, 0x11111111
lea ecx, [esi + ebx]
imul esi, esi, 0x21
xor ecx, dword [edi]
shr ebx, 0xb
or ebx, eax
mov dword [edi], ecx
lea edi, [edi + 4]
add esi, 3
add esi, ecx
sub edx, 1
jne 0x51728b
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x51742b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x7fed7fed
mov dword [ebp - 4], 0xeeeeeeee
mov al, byte [ebx]
test al, al
je 0x517486
push edi
mov edi, dword [ebp + 0xc]
shl edi, 8
movsx eax, al
push eax
call fcn.0074fb41
mov edx, eax
inc ebx
pop ecx
push 0x5c
cmp edx, 0x2f
pop eax
cmove edx, eax
mov eax, dword [0x925960]
add esi, dword [ebp - 4]
lea ecx, [edi + edx]
xor esi, dword [eax + ecx*4]
imul ecx, dword [ebp - 4], 0x21
lea eax, [esi + 3]
add ecx, edx
add eax, ecx
mov dword [ebp - 4], eax
mov al, byte [ebx]
test al, al
jne 0x51744d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x52bd20
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x1c], edi
jne 0x52bd33
or eax, 0xffffffff
jmp 0x52bdd2
mov ecx, dword [esi + 4]
lea eax, [esi + 0x2e]
cmp ecx, eax
jne 0x52bd58
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
cmp edx, eax
jae 0x52bd58
movzx eax, byte [edx]
jmp 0x52bdd2
test ecx, ecx
jne 0x52bd96
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x52bd7b
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x52bd77
push ecx
call fcn.00721177
pop ecx
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x24], eax
add ecx, eax
jmp 0x52bd81
lea ecx, [esi + 0x2d]
lea eax, [esi + 0x2c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
push dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
sub eax, ecx
push eax
push 1
push ecx
call fcn.00742b27
add esp, 0x10
test eax, eax
jne 0x52bdc4
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x28]
add eax, ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp 0x52bd2b
mov ecx, dword [esi + 4]
add eax, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
movzx eax, byte [ecx]
pop edi
pop esi
ret

Function at 0x530506
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2e0], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d0], 0x10001
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, edi
jne 0x5305bb
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [ebp - 0x20c]
lea ecx, [ebp - 0x2dc]
push ecx
lea ecx, [ebp - 0x2d4]
mov dword [ebx], eax
push ecx
push eax
call fcn.0053043e
mov bl, al
add esp, 0xc
test bl, bl
je 0x530598
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x2d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e0]
sub ecx, dword [ebp - 0x2dc]
mov dword [eax], ecx
test esi, esi
je 0x5305aa
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
push edi
push esi
push 0x4a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x5305cf
xor al, al
jmp 0x5305ac
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x5305e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5305cb
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x530557
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x5305db
Function at 0x530665
Capabilities:
Create thread

Disassembly:
jmp 0x53201b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push 0x94ab60
call esi
push 0x94abc4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
push edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
push edi
mov dword [0x94abdc], eax
call esi
push 0x94ab5c
push 0x10000
push edi
push 0x532322
push 0x40000
push edi
mov dword [0x94abe0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x94ab58], eax
call fcn.00530603
neg al
pop edi
sbb al, al
inc al
mov byte [0x94ab7d], al
pop esi
ret

Function at 0x530de6
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 4
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x530e82
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push esi
call sub.KERNEL32.dll_Thread32First
jmp 0x530e77
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
jne 0x530e6d
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x18], eax
je 0x530e6d
xor eax, eax
push eax
push eax
push eax
push eax
push 1
push 1
push ebx
push edi
push eax
push dword [ebp - 0x18]
call fcn.005311f3
push 0x7e19c8
push ebx
call edi
add esp, 0x30
lea eax, [ebp - 0x20]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x530e3d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret