joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dfd4
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x612781
call fcn.0060bd28
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0048e32d
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
call dword [0x614364]
test eax, eax
jne 0x48e14d
mov ebx, dword [ebp - 0x10]
lea ecx, [edi + 0x18]
push ecx
call dword [0x614388]
lea eax, [ebp - 0x14]
lea ecx, [edi + 0x30]
cmp eax, ecx
je 0x48e03b
mov eax, esi
mov esi, dword [ecx]
mov dword [ecx], eax
mov eax, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ecx + 4], eax
push dword [edi + 0xc]
call dword [0x614270]
lea eax, [edi + 0x18]
push eax
call dword [0x614384]
test ebx, ebx
je 0x48e132
cmp dword [edi + 4], 0
jne 0x48e076
push 0x69f63c
push dword [edi + 0x14]
call fcn.005e87ee
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x48e132
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
add eax, 8
cmp ecx, eax
je 0x48e09f
push 0xffffffffffffffff
push 0
push eax
call fcn.00409916
mov esi, dword [esi]
dec ebx
push 0
push 1
mov dword [ebp - 0x10], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.004097fa
push 0x20
push 1
push esi
call fcn.00403f7c
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 4], 0
je 0x48e100
push dword [edi + 4]
push dword [ebp - 0x1c]
push 1
push eax
call fcn.005f2409
push dword [edi + 4]
push 2
push 1
push 0x6961b0
call fcn.005f2409
add esp, 0x20
mov esi, dword [ebp - 0x14]
test ebx, ebx
jne 0x48e089
cmp dword [edi + 4], 0
je 0x48e11a
push dword [edi + 4]
call fcn.005e4ecd
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004097fa
mov esi, dword [ebp - 0x14]
jmp 0x48e013
cmp dword [edi], 0
jne 0x48e14d
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [0x614364]
lea ecx, [edi + 0x18]
test eax, eax
je 0x48e016
lea ecx, [ebp - 0x14]
call fcn.0048e275
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48ec3e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x612833
call fcn.0060bd28
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x693da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], 0x69f7cc
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x48f52e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [0x614388]
mov ecx, edi
call fcn.0048f50f
test al, al
je 0x48f555
or esi, 0xffffffff
jmp 0x48f5c0
push ebx
push 8
call fcn.00430c2b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x48f568
push 0xfffffffffffffffa
jmp 0x48f5be
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x48f83c
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f3920
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x48f5b2
lea ebx, [edi + 0x14]
jmp 0x48f59c
call dword [0x614384]
push 1
call dword [0x61440c]
push ebx
call dword [0x614388]
cmp byte [edi + 4], 0
push ebx
je 0x48f58e
call dword [0x614384]
jmp 0x48f5bf
push 8
push ebx
call fcn.0049992c
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [0x614384]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48f5d3
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x612833
call fcn.0060bd28
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], 0x69f7cc
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4941b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x49422c
cmp dword [ebp + 0xc], esi
je 0x49422c
cmp dword [edi + 0x10], esi
je 0x4941eb
push esi
push dword [edi + 0x10]
call dword [0x614364]
test eax, eax
jne 0x4941e6
push dword [edi + 0x10]
call dword [0x61444c]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x49422c
mov ebx, dword [edi]
push 0x18
call fcn.00430c2b
pop ecx
mov ecx, eax
test ecx, ecx
je 0x494220
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48db94
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f3920
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x49422e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4adda0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x4ade23
cmp dword [edi + 0x1b0], 0
je 0x4added
push esi
push 1
push edi
call fcn.0049fa80
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.0049fa80
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4ade23
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x617d50
push 2
push eax
call fcn.005f2409
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005f2409
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4b0380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.004b03b0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.005fd289

Function at 0x4b23a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b23be
cmp dword [esi + 0x78], 0
je 0x4b23be
push 2
push 3
push esi
call fcn.004b1970
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004b1d80
add esp, 4
test esi, esi
je 0x4b23de
cmp dword [esi + 0x78], 0
je 0x4b23de
push 3
push esi
call fcn.004b19b0
add esp, 8
pop esi
pop ebp
ret
Function at 0x4bfe80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.005f3920
add esp, 0x18
test eax, eax
je 0x4bfea2
cmp eax, 0xffffffff
jne 0x4bfea4
xor eax, eax
pop ebp
ret

Function at 0x4c32e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6c46a5], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
jne 0x4c3316
call fcn.004c3b70
test al, al
je 0x4c3327
mov byte [0x6c46a5], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x4c3348
push 0x400
push eax
call fcn.00526970
add esp, 8
call fcn.004c3b70
test al, al
jne 0x4c3316
push esi
push edi
nop word [eax + eax]
mov esi, 2
mov dword [ebp - 0x154], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x150], eax
nop
lea eax, [ebp - 0x18c]
push eax
call fcn.004b19f0
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x17c], xmm0
movups xmmword [ebp - 0x16c], xmm0
call fcn.004bb0b0
movups xmm1, xmmword [ebp - 0x17c]
add esp, 0xc
lea ecx, [esi - 1]
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push ecx
call fcn.0060b230
imul esi, dword [ebp - 0x164]
mov edi, eax
lea eax, [ebp - 0x19c]
mov ebx, edx
push eax
mov dword [ebp - 0x158], esi
call fcn.004b19f0
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1ac]
push eax
call fcn.004b19f0
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, esi
cdq
add eax, dword [ecx]
push 0
push dword [ebp - 0x14c]
adc edx, dword [ecx + 4]
push edx
push eax
call fcn.0060b230
shld edx, eax, 8
shl eax, 8
xor ebx, edx
xor edi, eax
mov dword [ebp - 0x168], ebx
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x16c], edi
push eax
call fcn.004b19f0
lea esi, [eax + 8]
lea eax, [ebp - 0x1cc]
push eax
call fcn.004b19f0
add esp, 8
mov ecx, dword [eax]
add ecx, dword [esi]
mov eax, dword [ebp - 0x148]
mov esi, dword [ebp - 0x14c]
add eax, 2
imul ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x148], esi
shl ecx, 0x10
xor eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x150]
movups xmm0, xmmword [ebp - 0x16c]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x154], 1
mov dword [ebp - 0x150], eax
jne 0x4c3370
movsd xmm0, qword [0x61c2a0]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.00525c80
add esp, 0x10
call fcn.004c3b70
test al, al
je 0x4c3350
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.005267c0
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x4c350c
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.00526970
add esp, 8
call fcn.004c3b70
test al, al
jne 0x4c3316
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x15c]
call fcn.004adef0
add esp, 8
call fcn.004c3b70
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
Function at 0x4d4210
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x4d4242
push str.Couldnt_set_desired_mode
push esi
call fcn.004ade30
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4d4259
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.004adef0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4d4272
push ebx
push esi
call fcn.004d3ed0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4d4287
push esi
call fcn.004d2f00
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4d429c
push esi
call fcn.004d3eb0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4d42ac
push esi
call fcn.004d40f0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e0e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6ba08c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e0e5d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4e0ea4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4e0eaa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e0f0b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4e0ed0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4e0f37
mov eax, dword [esi + 4]
push 1
push 0x620f48
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x620f49
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4e0f10
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51a0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x51a0fc
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x51a0fc
push dword [eax + 0x24]
push 1
push dword [ebp + 0x10]
push ecx
call fcn.005f2409
add esp, 0x10
test eax, eax
cmovne eax, dword [ebp + 0x10]
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x51cdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
cmp edx, ebx
je 0x51cf4c
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
push esi
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, dword [ebx + 4]
xor eax, ecx
dec esi
and eax, esi
mov dword [ebp - 8], esi
xor ecx, eax
mov dword [edx + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, esi
and eax, esi
pshufd xmm3, xmm0, 0
xor ecx, eax
mov dword [edx + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, esi
mov esi, dword [ebp + 0x14]
and eax, 4
xor ecx, eax
mov dword [edx + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test esi, esi
jle 0x51cf4b
push edi
cmp esi, 8
jb 0x51cf22
mov edi, dword [edx]
lea edx, [esi - 1]
mov ecx, dword [ebx]
lea edx, [ecx + edx*4]
mov dword [ebp + 0x10], edx
lea edx, [esi - 1]
lea edx, [edi + edx*4]
cmp ecx, edx
mov edx, dword [ebp + 0xc]
ja 0x51ce76
cmp dword [ebp + 0x10], edi
jae 0x51cf22
cmp ecx, ebx
ja 0x51ce83
cmp dword [ebp + 0x10], ebx
jae 0x51cf22
cmp ecx, edx
ja 0x51ce90
cmp dword [ebp + 0x10], edx
jae 0x51cf22
lea ecx, [esi - 1]
lea ecx, [edi + ecx*4]
cmp edi, ebx
ja 0x51cea2
cmp ecx, ebx
jae 0x51cf22
cmp edi, edx
ja 0x51ceaa
cmp ecx, edx
jae 0x51cf22
mov ecx, esi
and ecx, 0x80000007
jns 0x51ceb9
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp + 0x10], esi
sub dword [ebp + 0x10], ecx
mov ecx, dword [ebx]
movups xmm1, xmmword [edi + eax*4]
movups xmm0, xmmword [ecx + eax*4]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edi + eax*4], xmm0
movups xmm0, xmmword [ecx + eax*4]
pxor xmm2, xmm0
movups xmmword [ecx + eax*4], xmm2
movups xmm1, xmmword [edi + eax*4 + 0x10]
movups xmm0, xmmword [ecx + eax*4 + 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edi + eax*4 + 0x10], xmm0
movups xmm0, xmmword [ecx + eax*4 + 0x10]
pxor xmm2, xmm0
movups xmmword [ecx + eax*4 + 0x10], xmm2
add eax, 8
cmp eax, dword [ebp + 0x10]
jl 0x51cec1
cmp eax, esi
jge 0x51cf4a
mov ecx, dword [edx]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [ebp - 8]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
mov edx, dword [ebp + 0xc]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [ebp + 0x14]
jl 0x51cf26
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x531df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x531e40
mov al, byte [esi]
test al, al
je 0x531e40
push edi
mov edi, 0x100
nop dword [eax]
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x531e10
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5320b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x53210a
mov al, byte [edi]
test al, al
je 0x53210a
push ebx
mov ebx, 0x100
nop word [eax + eax]
movsx eax, al
push eax
call fcn.00553080
or eax, ebx
lea edi, [edi + 1]
mov ecx, eax
add esp, 4
shr ecx, 2
add ebx, 0x100
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
mov al, byte [edi]
test al, al
jne 0x5320d0
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x540060
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.0055b0e0
mov esi, eax
push esi
call fcn.0052fa80
add esp, 8
test eax, eax
jne 0x54007e
pop esi
pop ebp
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp fcn.005d3c40
Function at 0x5465d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, dword [eax + 0x60]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [edx + 0x70]
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
test esi, esi
je 0x546638
test edi, edi
je 0x546618
nop dword [eax]
cmp esi, 0x40
jae 0x546618
mov al, byte [esi + edx + 0x30]
inc esi
xor al, byte [ebx]
inc ebx
mov byte [ecx], al
inc ecx
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x546600
mov dword [edx + 0x70], esi
test edi, edi
je 0x5466e7
cmp esi, 0x40
jne 0x546638
mov dword [edx + 0x70], 0
add dword [edx + 0x20], 1
jne 0x546638
inc dword [edx + 0x24]
mov eax, edi
lea esi, [edx + 0x20]
and eax, 0x3f
mov dword [ebp - 0x10], esi
sub edi, eax
mov dword [ebp - 8], eax
mov eax, dword [esi]
cmp edi, 0x40
jb 0x54669d
nop
mov esi, edi
shr esi, 6
add eax, esi
mov dword [ebp - 0xc], eax
cmp eax, esi
jae 0x546667
sub esi, eax
mov dword [ebp - 0xc], 0
lea eax, [edx + 0x20]
shl esi, 6
push eax
push edx
push esi
push ebx
push ecx
call fcn.00587cb0
mov ecx, dword [ebp + 8]
sub edi, esi
mov eax, dword [ebp - 0xc]
add ecx, esi
mov edx, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 0x10]
add esp, 0x14
mov dword [ebp + 8], ecx
mov dword [esi], eax
test eax, eax
jne 0x546698
inc dword [edx + 0x24]
cmp edi, 0x40
jae 0x546650
cmp dword [ebp - 8], 0
je 0x5466e7
push 0x40
lea edi, [edx + 0x30]
push 0
push edi
call fcn.005e1780
push esi
mov esi, dword [ebp - 4]
push esi
push 0x40
push edi
push edi
call fcn.00587cb0
mov eax, dword [ebp - 8]
add esp, 0x20
xor edi, edi
test eax, eax
je 0x5466e4
mov edx, dword [ebp + 8]
sub ebx, edx
nop
lea ecx, [edi + edx]
mov al, byte [ebx + ecx]
xor al, byte [esi + edi + 0x30]
inc edi
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp edi, eax
jb 0x5466d0
mov dword [esi + 0x70], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x555ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x555ee5
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
push dword [edi]
call fcn.005330d0
mov ecx, dword [ebp + 0x10]
add esp, 4
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x555f99
mov ecx, dword [edi + 0x84]
cmp ecx, esi
jne 0x555f36
test esi, esi
jle 0x555f77
mov edx, ebx
lea ecx, [edi + 4]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x555f20
jmp 0x555f74
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x555f54
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.005e1780
add esp, 0xc
test esi, esi
jle 0x555f77
mov edx, ebx
lea ecx, [edi + 0x24]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x555f60
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push ebx
push dword [edi]
call fcn.00533680
add esp, 0x10
test eax, eax
jne 0x555f99
push esi
push ebx
call fcn.00537800
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x5ff4e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ff368