joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5124f4
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5124fd
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
mov eax, dword [ebp - 8]
call fcn.00405c0c
mov eax, dword [ebp - 0xc]
call fcn.00405c0c
xor eax, eax
push ebp
push 0x51270c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.00512268
mov eax, dword [ebp - 0x18]
call fcn.005122b8
lea edx, [ebp - 0x10]
mov eax, 0x512720
call fcn.00512450
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.0040adfc
mov dl, 1
mov eax, dword [0x41a10c]
call fcn.00404818
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5126cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x512730
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x512740
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x24]
push 0x512754
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405adc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x512760
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x2c]
push 0x512774
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405adc
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x512740
push dword [ebp - 4]
push 0x512754
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00405adc
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00403210
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x51278c
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040b06c
push dword [ebp - 0x3c]
push 0x51279c
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00405adc
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov edx, 0x5127a8
call fcn.00405a68
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x48]
call fcn.00512420
mov eax, dword [ebp - 0x48]
call fcn.00402f84
call fcn.00402f48
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5126d3
mov eax, dword [ebp - 0x14]
call fcn.00404848
ret
Function at 0x5127b0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5127b8
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
mov eax, dword [ebp - 8]
call fcn.00405c0c
xor eax, eax
push ebp
push 0x5129b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00512268
mov eax, dword [ebp - 0x14]
call fcn.005122b8
lea edx, [ebp - 0xc]
mov eax, 0x5129c4
call fcn.00512450
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040adfc
mov dl, 1
mov eax, dword [0x41a10c]
call fcn.00404818
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x512971
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5129d4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00403210
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x5129f0
call fcn.00405a68
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x512a00
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x28]
push 0x512a14
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405adc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 4], 0
je 0x5128d6
push 0x512a34
push dword [ebp - 4]
push 0x512a44
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00405adc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00403210
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040b06c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x512a50
call fcn.00405a68
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov edx, 0x5129f0
call fcn.00405a68
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x44]
call fcn.00512420
mov eax, dword [ebp - 0x44]
call fcn.00402f84
call fcn.00402f48
mov eax, 0x512a60
call fcn.0044af4c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512978
mov eax, dword [ebp - 0x10]
call fcn.00404848
ret
Function at 0x512cc8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x512cd0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x512ddf
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405930
lea eax, [ebp - 0x14]
mov edx, 0x512df4
call fcn.00405a24
mov eax, dword [ebp - 0x14]
call fcn.0040ace0
test al, al
je 0x512d3c
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00405930
lea eax, [ebp - 0x18]
mov edx, 0x512df4
call fcn.00405a24
mov eax, dword [ebp - 0x18]
call fcn.00405c1c
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x512d42
inc ebx
cmp bl, 0x5b
jne 0x512cec
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405930
lea eax, [ebp - 0x1c]
mov edx, 0x512df4
call fcn.00405a24
mov eax, dword [ebp - 0x1c]
call fcn.00405c1c
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x20]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.0040a7e8
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a7e8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.00405a68
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040579c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512de6
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.0040576c
lea eax, [ebp - 4]
call fcn.00405748
ret
Function at 0x512e94
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x512e9c
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x512ff6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00405748
mov bl, 0x43
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405930
lea eax, [ebp - 0x24]
mov edx, 0x51300c
call fcn.00405a24
mov eax, dword [ebp - 0x24]
call fcn.00405c1c
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x512fba
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405930
lea eax, [ebp - 0x28]
mov edx, 0x51300c
call fcn.00405a24
mov eax, dword [ebp - 0x28]
call fcn.00405c1c
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x2c]
movzx eax, word [ebp - 0xc]
mov edx, 4
call fcn.0040a7e8
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a7e8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
pop ecx
call fcn.00405a68
mov eax, ebx
sub al, 0x40
call fcn.0040b30c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, ebx
call fcn.00405930
push dword [ebp - 0x34]
push 0x513018
push dword [ebp - 4]
push 0x513028
fild qword [ebp - 0x20]
fdiv dword [0x513030]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x38]
xor edx, edx
mov al, 0xa
call fcn.00510ccc
push dword [ebp - 0x38]
push 0x51303c
lea eax, [ebp - 8]
mov edx, 7
call fcn.00405adc
inc ebx
cmp bl, 0x5b
jne 0x512ebf
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.0040579c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512ffd
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.0040576c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040576c
ret

Function at 0x51356c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov eax, esi
call fcn.00405748
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x5135ec
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x5135a5
mov eax, esi
mov edx, 0x513608
call fcn.0040579c
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x5135bc
mov eax, esi
mov edx, 0x513618
call fcn.0040579c
mov eax, dword [esp]
and eax, 4
cmp eax, 4
jne 0x5135d3
mov eax, esi
mov edx, 0x513624
call fcn.0040579c
mov eax, dword [esp]
and eax, 8
cmp eax, 8
jne 0x5135f8
mov eax, esi
mov edx, 0x513634
call fcn.0040579c
jmp 0x5135f8
mov eax, esi
mov edx, 0x51364c
call fcn.0040579c
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x513bb8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
xor eax, eax
push ebp
push 0x513d02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x298]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x513cda
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.0040b49c
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x513cc3
mov edx, dword [eax + 0xc]
test edx, edx
je 0x513cbd
mov ebx, dword [edx]
test ebx, ebx
je 0x513cb7
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x513d1c
call fcn.0040bea8
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.0040579c
mov byte [ebp - 5], 1
jmp 0x513cc7
mov byte [ebp - 5], 0
jmp 0x513cc7
mov byte [ebp - 5], 0
jmp 0x513cc7
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513ce1
call sub.wsock32.dll_WSACleanup
ret
Function at 0x5141d4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5143d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 4]
call fcn.00405748
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x5143a4
mov ebx, dword [ebp - 0x94]
cmp ebx, 6
jne 0x51428c
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x514257
lea eax, [ebp - 4]
mov edx, 0x5143ec
call fcn.004057e0
jmp 0x51428c
cmp eax, 2
jne 0x51426b
lea eax, [ebp - 4]
mov edx, 0x5143fc
call fcn.004057e0
jmp 0x51428c
cmp eax, 3
jne 0x51427f
lea eax, [ebp - 4]
mov edx, 0x51440c
call fcn.004057e0
jmp 0x51428c
lea eax, [ebp - 4]
mov edx, 0x514420
call fcn.004057e0
cmp ebx, 5
jne 0x5142cc
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x5142ab
lea eax, [ebp - 4]
mov edx, 0x514434
call fcn.004057e0
jmp 0x5142cc
cmp eax, 2
jne 0x5142bf
lea eax, [ebp - 4]
mov edx, 0x514444
call fcn.004057e0
jmp 0x5142cc
lea eax, [ebp - 4]
mov edx, 0x514458
call fcn.004057e0
cmp ebx, 4
jne 0x51430c
mov eax, dword [ebp - 0x90]
cmp eax, 0xa
jne 0x5142eb
lea eax, [ebp - 4]
mov edx, 0x51446c
call fcn.004057e0
jmp 0x51430c
cmp eax, 0x5a
jne 0x5142ff
lea eax, [ebp - 4]
mov edx, 0x51447c
call fcn.004057e0
jmp 0x51430c
lea eax, [ebp - 4]
mov edx, 0x51448c
call fcn.004057e0
push dword [ebp - 4]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0040a7c0
push dword [ebp - 0x9c]
push 0x51449c
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.0040a7c0
push dword [ebp - 0xa0]
push 0x5144a8
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.0040a7c0
push dword [ebp - 0xa4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405adc
push dword [ebp - 4]
push 0x5144b4
lea eax, [ebp - 0xa8]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.004059c8
push dword [ebp - 0xa8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405adc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040579c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5143db
lea eax, [ebp - 0xa8]
mov edx, 4
call fcn.0040576c
lea eax, [ebp - 4]
call fcn.00405748
ret
Function at 0x5149ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x514bb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov bx, 1
inc ebx
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b61c
push dword [ebp - 0x114]
push edi
push 0x514bcc
lea eax, [ebp - 0x118]
call fcn.005114fc
push dword [ebp - 0x118]
push 0x514bcc
call fcn.0040cf0c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481044
movzx eax, ax
lea edx, [ebp - 0x11c]
call fcn.0040a6d4
push dword [ebp - 0x11c]
call fcn.0040cf0c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481068
movzx eax, ax
lea ecx, [ebp - 0x120]
mov edx, 2
call fcn.00510d4c
push dword [ebp - 0x120]
call fcn.0040cf0c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0048108c
movzx eax, ax
lea ecx, [ebp - 0x124]
mov edx, 2
call fcn.00510d4c
push dword [ebp - 0x124]
push 0x514bcc
call fcn.0040cf38
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004810b0
movzx eax, ax
lea ecx, [ebp - 0x128]
mov edx, 2
call fcn.00510d4c
push dword [ebp - 0x128]
call fcn.0040cf38
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004810d8
movzx eax, ax
lea ecx, [ebp - 0x12c]
mov edx, 2
call fcn.00510d4c
push dword [ebp - 0x12c]
call fcn.0040cf38
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481100
movzx eax, ax
lea ecx, [ebp - 0x130]
mov edx, 2
call fcn.00510d4c
push dword [ebp - 0x130]
push 0x514bcc
lea edx, [ebp - 0x134]
movzx eax, bx
call fcn.0040a6d4
push dword [ebp - 0x134]
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0xf
call fcn.00405adc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040579c
mov eax, dword [esi]
call fcn.0040acbc
test al, al
jne 0x514a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514bbc
lea eax, [ebp - 0x134]
mov edx, 9
call fcn.0040576c
lea eax, [ebp - 4]
call fcn.00405748
ret
Function at 0x514bd0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x514bd9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x514df1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00405748
xor edx, edx
push ebp
push 0x514d9c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x514e0c
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0050fb30
test al, al
jne 0x514c39
mov eax, dword [ebp + 8]
call fcn.00405748
call fcn.00405168
jmp 0x514dae
lea edx, [ebp - 4]
mov eax, 0x514e20
call fcn.0050fc74
mov eax, dword [ebp - 4]
call fcn.00406b54
cmp ebx, eax
jle 0x514c5c
mov eax, dword [ebp - 4]
call fcn.00406b54
mov ebx, eax
cmp byte [ebp - 0x12], 0
je 0x514c6e
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00406b54
jmp 0x514c72
mov esi, ebx
mov eax, ebx
mov ebx, esi
mov esi, eax
sub esi, ebx
jl 0x514d6d
inc esi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, ebx
test edi, edi
jns 0x514c94
call fcn.00404710
mov ecx, edi
mov edx, 0x514e40
mov eax, dword [ebp - 4]
call fcn.0050f4d4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x514e50
call fcn.0040bea8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.0050fc74
push 0
lea eax, [ebp - 0xc]
push eax
test ebx, ebx
jns 0x514cd6
call fcn.00404710
mov ecx, edi
mov edx, 0x514e9c
mov eax, dword [ebp - 4]
call fcn.0050f4d4
mov edx, 0x514eb0
mov eax, dword [ebp - 0xc]
call fcn.0040a158
test al, al
jne 0x514d52
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405a24
cmp byte [ebp - 0x11], 0
je 0x514d3d
push dword [ebp - 0x10]
push 0x514ec0
push 0
lea eax, [ebp - 0x28]
push eax
test ebx, ebx
jns 0x514d1e
call fcn.00404710
mov ecx, edi
mov edx, 0x514ed0
mov eax, dword [ebp - 4]
call fcn.0050f4d4
push dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405adc
cmp byte [ebp - 0x12], 0
je 0x514d65
lea eax, [ebp - 0x10]
mov edx, 0x514ee0
call fcn.00405a24
jmp 0x514d65
cmp byte [ebp - 0x12], 0
jne 0x514d65
lea eax, [ebp - 0x10]
mov edx, 0x514eec
call fcn.004057e0
inc ebx
dec esi
jne 0x514c7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514da3
call fcn.0050ffd8
lea eax, [ebp - 4]
mov edx, dword [0x50f4a8]
call fcn.004064a4
lea eax, [ebp - 8]
mov edx, dword [0x50f4a8]
call fcn.004064a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514df8
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040576c
lea eax, [ebp - 0x18]
call fcn.00405748
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040576c
lea eax, [ebp - 8]
mov edx, dword [0x50f4a8]
mov ecx, 2
call fcn.004063b8
ret
Function at 0x530268
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 9]
dec eax
test eax, eax
jl 0x5302b7
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + ecx*8]
mov ecx, dword [ebp - 0x14]
xor byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x530291
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x53027c
mov esp, ebp
pop ebp
ret
Function at 0x5309a8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x200]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x5309e4
sub eax, 0x40
je 0x5309ed
sub eax, 0x40
je 0x5309f6
jmp 0x5309ff
mov dword [ebp - 0x18], 4
jmp 0x530a0b
mov dword [ebp - 0x18], 6
jmp 0x530a0b
mov dword [ebp - 0x18], 8
jmp 0x530a0b
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x530afe
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.005301ec
sub eax, 0x80
je 0x530a32
sub eax, 0x40
je 0x530a3b
sub eax, 0x40
je 0x530a44
jmp 0x530a4d
mov dword [ebp - 0x1c], 0xa
jmp 0x530a59
mov dword [ebp - 0x1c], 0xc
jmp 0x530a59
mov dword [ebp - 0x1c], 0xe
jmp 0x530a59
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x530afe
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.00530268
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jle 0x530ac4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.0053037c
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.005302c4
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005303e0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.00530268
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x530a7c
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.0053037c
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.005302c4
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.00530268
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4