joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x820
mov eax, dword [ebp + 8]
test eax, eax
je 0x515f8f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x515f8f
mov eax, dword [ebp + 0xc]
lea ebx, [esp + 0x20]
mov ecx, 0x100
mov edi, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x18], eax
add eax, 0x3fffff
mov dword [esp + 0x1c], edi
mov edx, eax
shl edx, 0xa
lea eax, [edi + edx]
mov edi, ebx
mov esi, eax
mov eax, dword [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov esi, dword [esp + 0x1c]
lea edi, [edx + 0x400]
shl eax, 0xb
mov ecx, dword [ecx + 0x18]
lea edx, [esi + eax - 0x400]
mov esi, 1
cmp ecx, esi
jbe 0x515ede
nop
lea esi, [esi]
lea eax, [edx + 0x10]
add esi, 1
cmp ebx, eax
jae 0x515eb6
lea eax, [esp + 0x30]
cmp eax, edx
ja 0x515f97
xor eax, eax
nop
lea esi, [esi]
movdqu xmm0, xmmword [edx + eax]
pxor xmm0, xmmword [ebx + eax]
movaps xmmword [ebx + eax], xmm0
add eax, 0x10
cmp eax, 0x400
jne 0x515ec0
add edx, edi
cmp ecx, esi
ja 0x515ea0
mov eax, dword [ebp + 8]
lea edi, [esp + 0x420]
mov ecx, 0x100
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x420]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0051eb30
mov edi, dword [0x7e226c]
test edi, edi
jne 0x515fd1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x515f4a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00517740
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x7e226c]
mov ebx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
shl ebx, 0xa
test edx, edx
mov eax, dword [eax]
je 0x515f69
test eax, eax
jne 0x515fc3
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x515f8f
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
test edx, edx
mov eax, dword [eax]
je 0x516004
mov dword [esp + 4], ebx
mov dword [esp], eax
call edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov dword [esp + 0x1c], ecx
lea esi, [esi]
mov ecx, dword [edx + eax*8]
xor dword [ebx + eax*8], ecx
mov ecx, dword [edx + eax*8 + 4]
xor dword [ebx + eax*8 + 4], ecx
add eax, 1
cmp eax, 0x80
jne 0x515fa0
mov ecx, dword [esp + 0x1c]
add edx, edi
jmp 0x515eda
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00515dd0
jmp 0x515f69
mov dword [esp], ebx
mov dword [esp + 4], 0x400
call fcn.00515dd0
mov ebx, dword [0x7e226c]
test ebx, ebx
je 0x515f26
mov dword [esp + 4], 0x400
mov dword [esp], esi
call fcn.00515dd0
jmp 0x515f26
mov dword [esp], eax
call fcn.00548438
jmp 0x515f8f
Function at 0x536bc0
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [0x863128]
mov dword [esp], eax
call fcn.00537070
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x536bf0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__open_osfhandle]
add esp, 0x28
mov ebx, eax
mov eax, ebx
pop ebx
ret
mov dword [esp], 8
call sub.msvcrt.dll__mkdir
mov eax, dword [0x863128]
mov dword [esp], eax
call fcn.00537070
mov dword [esp + 0x18], eax
mov eax, dword [0x863124]
mov dword [esp], eax
call fcn.00537070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll___dllonexit
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00537080
mov dword [0x863128], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00537080
mov dword [esp], 8
mov dword [0x863124], eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0x28
mov eax, ebx
pop ebx
ret

Function at 0x537090
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x862600]
test esi, esi
jle 0x5371a0
mov edi, dword [0x862604]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x5370c4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x537145
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x5370b0
mov dword [esp], eax
mov ebx, eax
call fcn.00537980
test eax, eax
mov edi, eax
je 0x5371c7
mov eax, dword [0x862604]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00537a80
add eax, dword [edi + 0xc]
mov edx, dword [0x862604]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x5371a7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x53713e
sub eax, 4
and eax, 0xfffffffb
jne 0x537150
add dword [0x862600], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x862604]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x53713e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00701f80
lea esi, [esi]
xor esi, esi
jmp 0x5370ce
mov eax, dword [0x862604]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00701f80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00701f80
mov esi, esi
lea edi, [edi]
Function at 0x537600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x862618
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [0x862610]
sub esp, 4
test ebx, ebx
je 0x537655
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x53764e
test esi, esi
je 0x53764e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x537630
mov dword [esp], 0x862618
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x53c260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x53c3f0
cmp byte [ebx], 0
je 0x53c3b0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x53c3e0
test al, 0x10
je 0x53c3b0
lea edi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
mov ebx, edi
call sub.msvcrt.dll__initterm
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x53c2c4
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
mov ecx, eax
cmove ebx, edx
add cl, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_memset
test eax, eax
mov esi, eax
je 0x53c3d0
lea edx, [ebx + 1]
lea ebp, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], ebp
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_putchar
cmp byte [esi + 0x22c], 0
mov edx, dword [esp + 0x1c]
jne 0x53c390
add ebx, ebp
lea edx, [esi + 0x120]
mov eax, 0x2a
mov ecx, 0x41
mov word [ebx], ax
xor eax, eax
mov dword [esi + 0x224], 0xffffffff
mov edi, edx
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esi + ebx + 0x22b]
add ebx, ebp
cmp al, 0x5c
je 0x53c33a
cmp al, 0x2f
je 0x53c33a
mov ecx, 0x5c
mov word [ebx], cx
lea ebx, [ebp + edx]
jmp 0x53c33a
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0x14
add esp, 0x13c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x53c37b
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 2
jmp 0x53c37b
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0xe
jmp 0x53c37b
Function at 0x548820
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__lseeki64]
mov ebx, dword [esp + 0x20]
cmp eax, ebx
ja 0x54883b
lea edx, [eax + 0x260]
cmp ebx, edx
jbe 0x548850
add ebx, 0x20
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
sub esp, 4
add esp, 0x18
pop ebx
ret
mov ecx, ebx
sub ecx, eax
mov eax, ecx
sar eax, 5
add eax, 0x10
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
or dword [ebx + 0xc], 0x8000
add esp, 0x18
pop ebx
ret

Function at 0x54a470
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x73f758], eax
je 0x54a487
add esp, 0xc
ret
call sub.msvcrt.dll_exit
lea esi, [esi]

Function at 0x54a980
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x54a9b0
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0054a330
cmp eax, 1
je 0x54a9b2
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__wchmod]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x54aa05
jmp 0x54aa22
cmp eax, 0x6a
je 0x54aa13
add eax, 1
cmp byte [ebx + eax], 0
jne 0x54aa00
cmp eax, 0x6a
jne 0x54aa22
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push eax
call sub.msvcrt.dll_exit
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
jmp 0x54aa13
Function at 0x54aab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x863088], 1
je 0x54aac5
call fcn.0054aa30
mov eax, dword [0x73f758]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x54aaf0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0054a8d0
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x54aadc
test esi, esi
je 0x54aadc
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call fcn.0054a980
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x54abf2
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x73f758]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
je 0x54abf2
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll_exit
mov esi, esi
lea edi, [edi]
Function at 0x54ad30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x54ad60
mov edi, dword [esp + 0x28]
test edi, edi
je 0x54ae01
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x54ae30
cmp eax, 3
jne 0x54ad4a
mov eax, dword [0x73f758]
cmp eax, 0xffffffff
je 0x54ad4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x54ad4a
test byte [eax + 0x20], 0x30
je 0x54ae52
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x54af54
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x54add4
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x54adc6
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0054a170
lea eax, [ebx + 0x38]
call fcn.0054a980
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x54aed9
mov eax, ebx
call fcn.0054a670
jmp 0x54aed9
mov eax, dword [0x863064]
test eax, eax
je 0x54ad4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_RemoveVectoredExceptionHandler]
mov dword [0x863064], 0
sub esp, 4
jmp 0x54ad4a
mov dword [esp + 4], 0x54a390
mov dword [esp], 1
call dword [sym.imp.KERNEL32.DLL_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x863064], eax
jmp 0x54ad4a
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x54af00
test eax, eax
je 0x54ae70
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x54af30
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x54af40
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x54aeb5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.0054a170
mov eax, esi
call fcn.0054a980
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x54adf5
mov eax, dword [0x73f758]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
jmp 0x54ad4a
test eax, eax
je 0x54af10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0054a170
lea eax, [ebx + 0x38]
call fcn.0054a980
jmp 0x54ad4a
call fcn.0054ac40
jmp 0x54ae8c
mov dword [esp], edi
call fcn.0054a170
mov eax, esi
call fcn.0054a980
jmp 0x54ad4a
call fcn.0054ac40
jmp 0x54ada2
Function at 0x54b8c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0054aab0
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x54b942
test byte [ebx + 0x20], 0x30
jne 0x54b8f6
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_memmove
mov eax, dword [0x73f758]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x54b939
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x54b986
test eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
je 0x54b92c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x54b949
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.0054ac40
jmp 0x54b8dd
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x54b9ad
mov eax, dword [0x73f758]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
push eax
push eax
jmp 0x54b939
test eax, eax
mov dword [ebx], 0xdeadbeef
je 0x54b99a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x54b96c
mov eax, ebx
call fcn.0054a670
jmp 0x54b96c
Function at 0x54e280
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add ecx, eax
cmp eax, ecx
movdqa xmm3, xmmword [edx]
movdqa xmm2, xmmword [edx + 0x10]
movdqa xmm1, xmmword [edx + 0x20]
movdqa xmm0, xmmword [edx + 0x30]
jae 0x54e2fb
movdqa xmm7, xmmword [0x74faa0]
movdqa xmm6, xmmword [0x74fab0]
movdqa xmm5, xmmword [0x74fac0]
movdqa xmm4, xmmword [0x74fad0]
nop
lea esi, [esi]
aesdec xmm3, xmm7
add eax, 0x40
aesenc xmm2, xmm6
aesdec xmm1, xmm5
aesenc xmm0, xmm4
movaps xmmword [eax - 0x40], xmm3
movaps xmmword [eax - 0x30], xmm2
movaps xmmword [eax - 0x20], xmm1
movaps xmmword [eax - 0x10], xmm0
cmp ecx, eax
ja 0x54e2d0
movaps xmmword [edx], xmm3
movaps xmmword [edx + 0x10], xmm2
movaps xmmword [edx + 0x20], xmm1
movaps xmmword [edx + 0x30], xmm0
leave
ret
Function at 0x54e890
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqa xmm0, xmmword [0x7dea40]
add edx, eax
movdqa xmm1, xmmword [0x7dea50]
cmp eax, edx
movdqa xmm3, xmmword [0x7dea60]
movdqa xmm4, xmmword [0x7dea70]
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm1
movaps xmmword [esp + 0x10], xmm3
movaps xmmword [esp], xmm4
movdqa xmm2, xmmword [0x7dea00]
movdqa xmm5, xmmword [0x7dea10]
movdqa xmm6, xmmword [0x7dea20]
movdqa xmm7, xmmword [0x7dea30]
movdqa xmm4, xmmword [ecx]
movdqa xmm3, xmmword [ecx + 0x10]
movdqa xmm1, xmmword [ecx + 0x20]
movdqa xmm0, xmmword [ecx + 0x30]
jae 0x54e985
nop
aesdec xmm4, xmm2
add eax, 0x40
aesenc xmm3, xmm2
aesdec xmm1, xmmword [esp + 0x30]
aesenc xmm0, xmmword [esp + 0x30]
aesdec xmm4, xmm5
aesenc xmm3, xmm5
aesdec xmm1, xmmword [esp + 0x20]
aesenc xmm0, xmmword [esp + 0x20]
aesdec xmm4, xmm6
aesenc xmm3, xmm6
aesdec xmm1, xmmword [esp + 0x10]
aesenc xmm0, xmmword [esp + 0x10]
aesdec xmm4, xmm7
aesenc xmm3, xmm7
aesdec xmm1, xmmword [esp]
aesenc xmm0, xmmword [esp]
movaps xmmword [eax - 0x40], xmm4
movaps xmmword [eax - 0x30], xmm3
movaps xmmword [eax - 0x20], xmm1
movaps xmmword [eax - 0x10], xmm0
cmp edx, eax
ja 0x54e910
leave
ret
Function at 0x5516f0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
movdqa xmm4, xmmword [str._f__nc]
lea ecx, [edi + eax - 0x1000]
lea edx, [edi + 0x1000]
mov ebx, edi
movdqa xmm3, xmmword [esi]
lea eax, [ecx + 0x2000]
movdqa xmm2, xmmword [esi + 0x10]
mov dword [esp + 0xc], eax
movdqa xmm1, xmmword [esi + 0x20]
movdqa xmm0, xmmword [esi + 0x30]
movdqa xmm5, xmmword [0x74fa50]
movdqa xmm6, xmmword [0x74fa60]
movdqa xmm7, xmmword [0x74fa70]
cmp ebx, ecx
jae 0x5517c6
mov eax, ebx
mov esi, esi
lea edi, [edi]
aesdec xmm3, xmmword [0x74faa0]
add eax, 0x40
prefetcht0 byte [edx]
aesenc xmm2, xmmword [0x74fab0]
add edx, 0x40
aesdec xmm1, xmmword [0x74fac0]
aesenc xmm0, xmmword [0x74fad0]
aesenc xmm7, xmmword [eax - 0x40]
aesdec xmm6, xmmword [eax - 0x30]
aesenc xmm5, xmmword [eax - 0x20]
aesdec xmm4, xmmword [eax - 0x10]
movaps xmmword [eax - 0x40], xmm3
movaps xmmword [eax - 0x30], xmm2
movaps xmmword [eax - 0x20], xmm1
movaps xmmword [eax - 0x10], xmm0
cmp eax, ecx
jb 0x551760
mov eax, ebx
not eax
add eax, ecx
and eax, 0xffffffc0
lea ebx, [ebx + eax + 0x40]
add ecx, 0x1000
cmp ecx, dword [esp + 0xc]
mov edx, edi
jne 0x551751
movaps xmmword [esi + 0x30], xmm0
mov eax, dword [ebp + 0x10]
movaps xmmword [esi], xmm3
movaps xmmword [esi + 0x10], xmm2
movaps xmmword [esi + 0x20], xmm1
movdqa xmm0, xmmword [0x74fa80]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
aesdec xmm4, xmm0
movdqa xmm0, xmmword [0x74fa90]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
aesdec xmm4, xmm0
movaps xmmword [eax], xmm7
movaps xmmword [eax + 0x10], xmm6
movaps xmmword [eax + 0x20], xmm5
movaps xmmword [eax + 0x30], xmm4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x649700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, dword [ebp + 8]
and esp, 0xfffffff0
movzx eax, byte [ebx]
lea edx, [eax - 9]
mov eax, ebx
cmp dl, 0x17
ja 0x649767
mov esi, 0x800013
bt esi, edx
jae 0x649767
lea ecx, [ebx + 0x10]
add eax, 1
and ecx, 0xfffffff0
cmp eax, ecx
je 0x649770
movzx edx, byte [ebx + 1]
sub edx, 9
cmp dl, 0x17
ja 0x649767
bt esi, edx
jae 0x649767
mov ebx, 0x800013
jmp 0x649755
bt ebx, edx
jae 0x649767
add eax, 1
cmp ecx, eax
je 0x649770
movzx esi, byte [eax]
lea edx, [esi - 9]
cmp dl, 0x17
jbe 0x649750
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movdqa xmm4, xmmword [str._________________n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_r_r_r_r_r_r_r_r_r_r_r_r_r_r_r_r_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tuuuuuuuubtnufruuuuuuuuuuuuuuuuuu]
movdqa xmm5, xmmword [eax]
movdqa xmm0, xmm4
movdqa xmm3, xmmword [0x766eb0]
pcmpeqb xmm0, xmm5
movdqa xmm2, xmmword [0x766ec0]
movdqa xmm1, xmmword [0x766ed0]
jmp 0x6497af
add eax, 0x10
movdqa xmm5, xmmword [eax]
movdqa xmm0, xmm5
pcmpeqb xmm0, xmm4
movdqa xmm6, xmm5
pcmpeqb xmm6, xmm3
por xmm0, xmm6
movdqa xmm6, xmm5
pcmpeqb xmm5, xmm1
pcmpeqb xmm6, xmm2
por xmm0, xmm6
por xmm0, xmm5
pmovmskb edx, xmm0
xor dx, 0xffff
je 0x6497a0
movzx edx, dx
mov ecx, 0xffffffff
bsf edx, edx
cmove edx, ecx
lea esp, [ebp - 8]
add eax, edx
pop ebx
pop esi
pop ebp
ret
Function at 0x6e9370
Capabilities:
Parse credit card information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [ecx + 0x94]
mov esi, dword [ecx + 0x98]
cmp edx, esi
je 0x6e93a0
mov eax, dword [ecx + 0x7c]
test eax, eax
je 0x6e93b2
cmp eax, 2
je 0x6e93c0
cmp eax, 1
je 0x6e93d0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ecx + 0x84], 0x1b
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.006e9670
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x6e9fe0
mov ebx, ecx
lea ecx, [edx + 1]
mov edi, dword [ebx + 0x9c]
mov dword [ebx + 0x94], ecx
movzx ebp, byte [edx]
mov edi, dword [edi + 0x18]
mov eax, ebp
test byte [edi + ebp*2], 8
jne 0x6e9450
cmp al, 0x2c
je 0x6e9440
test dword [ebx + 0x80], 0x120
je 0x6e94e2
cmp al, 0x5c
jne 0x6e94fc
cmp esi, ecx
je 0x6e94fc
cmp byte [edx + 1], 0x7d
jne 0x6e94fc
add edx, 2
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], 0xd
mov dword [ebx + 0x94], edx
jmp 0x6e9398
mov dword [ebx + 0x84], 0x19
jmp 0x6e9398
movsx eax, al
mov dword [ebx + 0x84], 0x1a
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0xa4]
lea esi, [ebx + 0xa0]
mov dword [esp], 0
mov ecx, esi
mov dword [esp + 4], eax
call fcn.006ce170
mov eax, dword [ebx + 0x94]
sub esp, 0x10
cmp dword [ebx + 0x98], eax
jne 0x6e94cb
jmp 0x6e9398
lea edx, [eax + 1]
mov ecx, esi
mov dword [ebx + 0x94], edx
movsx eax, byte [eax]
mov dword [esp], eax
call fcn.006cfc40
mov eax, dword [ebx + 0x94]
sub esp, 4
cmp eax, dword [ebx + 0x98]
je 0x6e9398
mov edx, dword [ebx + 0x9c]
movzx ecx, byte [eax]
mov edx, dword [edx + 0x18]
test byte [edx + ecx*2], 8
jne 0x6e94a0
jmp 0x6e9398
cmp al, 0x7d
jne 0x6e94fc
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], 0xd
jmp 0x6e9398
mov dword [esp + 4], str.Unexpected_character_in_brace_expression.
mov dword [esp], 7
call fcn.006f76f0