joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov eax, edi
or eax, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
je 0x537184
mov eax, edi
xor esi, esi
and eax, 1
mov dword [ebp - 0x20], esi
or eax, esi
jne 0x537053
nop
inc esi
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x537030
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
mov dword [ebp - 0xc], 0
xor ecx, ecx
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
jne 0x5370a6
mov esi, eax
nop dword [eax]
inc dword [ebp - 0xc]
dec esi
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x537080
mov esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0xc]
mov eax, esi
cdq
sub eax, edx
mov edi, eax
sar edi, 1
test edi, edi
jle 0x537184
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], 0
mov ecx, dword [ecx + 0x24]
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call fcn.0052add0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x537186
add edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], edi
jge 0x537131
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push ebx
mov eax, dword [eax + 0x14]
call eax
mov esi, eax
add esp, 0x18
test esi, esi
je 0x5370f1
mov eax, dword [ebp - 0x20]
push ebx
mov eax, dword [eax + 0x10]
call eax
add esp, 4
test esi, esi
je 0x537159
cmp esi, 0x65
je 0x537159
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp esi, 0x65
sete al
sub eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
test eax, eax
jle 0x537184
mov ecx, dword [ebp - 0x24]
movq xmm1, qword [ebp - 0x34]
movd xmm0, eax
psrlq xmm1, xmm0
add dword [ecx], eax
mov eax, dword [ebp - 0x28]
movq qword [eax], xmm1
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x539290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
movaps xmm0, xmmword [0x79c570]
mov eax, ecx
movups xmmword [ebp - 0x13c], xmm0
mov ecx, 0xf79e
mov dword [ebp - 0xd4], eax
movaps xmm0, xmmword [0x79c580]
movups xmmword [ebp - 0x12c], xmm0
push ebx
movaps xmm0, xmmword [0x79c5a0]
xor ebx, ebx
movups xmmword [ebp - 0x11c], xmm0
shl eax, 3
movaps xmm0, xmmword [str.usthaeoy]
or eax, 7
movups xmmword [ebp - 0x10c], xmm0
push esi
movaps xmm0, xmmword [0x79c590]
mov esi, 0x64
movups xmmword [ebp - 0xfc], xmm0
push edi
movaps xmm0, xmmword [0x79c560]
xor edi, edi
mov dword [ebp - 0xcc], 0x7050000
mov dword [ebp - 0xc8], 0x7430738
mov dword [ebp - 0xc4], 0x7880763
mov dword [ebp - 0xc0], 0x7cb0794
mov dword [ebp - 0xbc], 0x7f807e8
mov dword [ebp - 0xb8], 0x83e080c
mov dword [ebp - 0xb4], 0x89e0878
mov dword [ebp - 0xb0], 0x8ee08d8
mov dword [ebp - 0xac], 0x94f0928
mov dword [ebp - 0xa8], 0x9b809a8
mov dword [ebp - 0xa4], 0xa2409d4
mov dword [ebp - 0xa0], 0xaac0a6c
mov dword [ebp - 0x9c], 0xb1a0ade
mov dword [ebp - 0x98], 0xb8a0b4e
mov dword [ebp - 0x94], 0xbb80ba8
mov dword [ebp - 0x90], 0xd080bd4
mov dword [ebp - 0x8c], 0xe700d80
mov dword [ebp - 0x88], 0xe900e80
mov dword [ebp - 0x84], 0xf380ea0
mov dword [ebp - 0x80], 0xf580f48
mov dword [ebp - 0x7c], 0xfa80f80
mov dword [ebp - 0x78], 0x100a0fc8
mov dword [ebp - 0x74], 0x104a102a
mov dword [ebp - 0x70], 0x108a106a
mov dword [ebp - 0x6c], 0x10c810aa
mov dword [ebp - 0x68], 0x10f810d8
mov dword [ebp - 0x64], 0x11481138
mov dword [ebp - 0x60], 0x11981178
mov dword [ebp - 0x5c], 0x18361804
mov dword [ebp - 0x58], 0x18881878
mov dword [ebp - 0x54], 0x191d18d8
mov dword [ebp - 0x50], 0x19811969
mov dword [ebp - 0x4c], 0xf01cf008
mov dword [ebp - 0x48], 0xf098f05e
mov dword [ebp - 0x44], 0xf0f8f0ca
mov dword [ebp - 0x40], 0xf11ef108
mov dword [ebp - 0x3c], 0xf168f158
mov dword [ebp - 0x38], 0xf1b8f18c
mov dword [ebp - 0x34], 0xf1fcf1da
mov dword [ebp - 0x30], 0xf2aaf22e
mov dword [ebp - 0x2c], 0xf2f8f2ca
mov dword [ebp - 0x28], 0xf35ef30a
mov dword [ebp - 0x24], 0xf3eaf39c
mov dword [ebp - 0x20], 0xf448f40e
mov dword [ebp - 0x1c], 0xf478f45a
mov dword [ebp - 0x18], 0xf4b0f48c
mov dword [ebp - 0x14], 0xf4c0f4b8
mov dword [ebp - 0x10], 0xf50af4c8
mov dword [ebp - 0xc], 0xf64af5cc
mov dword [ebp - 8], 0xf72af66a
mov word [ebp - 4], cx
movups xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xdc], 0x756f6965
mov byte [ebp - 0xd8], 0x79
mov dword [ebp - 0xd0], eax
nop
lea eax, [edi + esi]
cdq
sub eax, edx
sar eax, 1
movzx ecx, word [ebp + eax*2 - 0xcc]
cmp dword [ebp - 0xd0], ecx
jb 0x5394df
mov ebx, eax
lea edi, [eax + 1]
jmp 0x5394e2
lea esi, [eax - 1]
cmp esi, edi
jge 0x5394c0
movzx ecx, word [ebp + ebx*2 - 0xcc]
mov eax, ecx
and ecx, 7
shr eax, 3
add eax, ecx
mov ecx, dword [ebp - 0xd4]
cmp ecx, eax
mov eax, ecx
jg 0x53950c
movsx eax, byte [ebp + ebx - 0x13c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x539520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0x80
jge 0x539548
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x5395ed
lea eax, [esi + 0x20]
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x10000
jge 0x5395df
push ebx
push edi
mov edi, 0xa2
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
lea eax, [ebx + edi]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
movzx ecx, word [eax*4 + 0x78b0b8]
sub edx, ecx
js 0x539584
mov ecx, eax
lea ebx, [eax + 1]
mov dword [ebp - 4], ecx
jmp 0x53958a
mov ecx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, ebx
jge 0x539564
pop edi
pop ebx
test ecx, ecx
js 0x5395cd
movzx edx, word [ecx*4 + 0x78b0b8]
movzx eax, byte [ecx*4 + 0x78b0bb]
add eax, edx
cmp esi, eax
jge 0x5395cd
movzx eax, byte [ecx*4 + 0x78b0ba]
xor edx, esi
and edx, eax
test edx, 1
jne 0x5395cd
shr eax, 1
movzx eax, word [eax*2 + 0x78a6e8]
add eax, esi
movzx esi, ax
cmp dword [ebp - 8], 0
je 0x5395ed
mov ecx, esi
call fcn.00539290
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10400]
cmp eax, 0x27
lea eax, [esi + 0x28]
jbe 0x5395ef
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53d9e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xorps xmm0, xmm0
push edi
mov dword [ebp - 0xc], esi
mov edi, ecx
movlpd qword [ebp - 0x18], xmm0
push dword [esi + 0x20]
push dword [esi + 0x1c]
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call fcn.004b66e0
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x53da32
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 8]
mov edx, eax
push ecx
push 0
push 1
push 0xffffffffffffffff
mov ecx, edi
call fcn.005038c0
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x53da94
push dword [ebp - 8]
call fcn.004d6c20
add esp, 4
cmp eax, 0x64
jne 0x53da7f
push ebx
push dword [ebp - 8]
call fcn.004d74e0
add esp, 8
mov esi, eax
mov edi, edx
push dword [ebp - 8]
call fcn.004d5f90
add esp, 4
mov ebx, eax
jmp 0x53daad
push dword [ebp - 8]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
call fcn.004d5f90
add esp, 4
mov ebx, eax
jmp 0x53daad
cmp ebx, 7
je 0x53daa7
xor ebx, ebx
mov dword [esi + 0x28], 0x100000
mov dword [esi + 0x2c], ebx
jmp 0x53dae1
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
test ebx, ebx
jne 0x53dae1
mov eax, esi
or eax, edi
jne 0x53dac6
mov esi, dword [ebp - 0xc]
mov dword [esi + 0x28], 0x100000
mov dword [esi + 0x2c], eax
jmp 0x53dae1
test edi, edi
jl 0x53dad1
jg 0x53dad8
cmp esi, 0x64
ja 0x53dad8
mov esi, 0x64
xor edi, edi
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], edi
push dword [ebp - 0x1c]
call fcn.004b4670
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret

Function at 0x53dcc0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x53dd2b
push dword [esi + 0x1c]
mov dword [ebp + 8], 0
push str.PRAGMA__Q.page_size
call fcn.004b66e0
mov ebx, eax
mov ecx, edi
lea eax, [ebp + 8]
mov edx, ebx
push eax
call fcn.0053dc30
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x53dd54
movzx ecx, byte [esi + 0x16]
mov edx, dword [ebp + 8]
imul ecx, ecx, 0x33
add edx, 0xffffffc0
mov dword [esi + 0x10], edx
add ecx, 4
cmp ecx, edx
jge 0x53dd6d
push ebx
mov dword [esi + 0x10], ecx
call fcn.004b4670
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x20]
push dword [esi + 0x1c]
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.004b66e0
mov ebx, eax
mov ecx, edi
lea eax, [esi + 0x10]
mov edx, ebx
push eax
call fcn.0053dc30
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x53dd6d
push edi
call fcn.005216a0
push eax
push 0x792294
call fcn.004b66e0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ecx], eax
push ebx
call fcn.004b4670
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53eb50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 0x28], edx
mov ebx, dword [edi + 0x1c]
sub ebx, 6
mov dword [ebp - 0x34], ebx
test ebx, ebx
jle 0x53eb88
mov ecx, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
xor esi, esi
test ebx, ebx
jle 0x53ebd2
mov ecx, 8
mov dword [ebp - 0x30], ecx
cmp edx, dword [edi + 0x1c]
ja 0x53ed14
cmp esi, ebx
jge 0x53ebbe
cmp eax, 4
jge 0x53ebbb
lea edx, [ecx + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc esi
mov dword [edi + edx*4], ecx
mov ecx, dword [ebp - 0x30]
inc eax
cmp esi, ebx
jl 0x53eba3
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x53ebce
inc edx
add ecx, eax
mov dword [ebp - 0x28], edx
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp esi, ebx
jl 0x53eb96
cmp edx, dword [edi + 0x1c]
ja 0x53ed14
mov esi, 0x78b948
movzx ecx, byte [ebp + ebx*4 - 0x27]
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + str.cw]
mov byte [ebp - 0x24], dl
mov edx, 1
movzx ecx, byte [ebp + ebx*4 - 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + ebx*4 - 0x25]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + ebx*4 - 0x28]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
movzx ecx, byte [esi]
add esi, 4
xor byte [ebp - 0x24], cl
mov dword [ebp - 0x30], esi
cmp ebx, 8
je 0x53ec50
cmp ebx, edx
jle 0x53ecae
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, ebx
jl 0x53ec40
jmp 0x53ecae
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 4
jl 0x53ec50
movzx ecx, byte [ebp - 0x18]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x14], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x13], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x12], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x11], cl
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 8
jl 0x53eca0
xor esi, esi
test ebx, ebx
jle 0x53ed05
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
lea edi, [edx*4 + 8]
cmp edx, dword [ecx + 0x1c]
ja 0x53ed02
cmp esi, ebx
jge 0x53ecf1
nop word [eax + eax]
cmp eax, 4
jge 0x53eceb
mov ebx, dword [ebp - 0x2c]
lea edx, [edi + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [ebx + edx*4], ecx
mov ebx, dword [ebp - 0x34]
cmp esi, ebx
jl 0x53ecd0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x53ecfe
inc edx
add edi, eax
mov dword [ebp - 0x28], edx
xor eax, eax
cmp esi, ebx
jl 0x53ecc1
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmp ecx, dword [edi + 0x1c]
jbe 0x53ebe0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x53ed30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
mov ebx, 1
cmp dword [edi + 0x1c], ebx
jbe 0x53ee1a
lea eax, [edi + 0x32]
push esi
nop word [eax + eax]
movzx ecx, byte [eax + 1]
lea eax, [eax + 0x10]
movzx edx, byte [eax - 0x11]
inc ebx
mov esi, dword [ecx*4 + 0x81f888]
xor esi, dword [edx*4 + 0x81eb10]
movzx ecx, byte [eax - 0x10]
xor esi, dword [ecx*4 + 0x81ccf8]
movzx ecx, byte [eax - 0x12]
xor esi, dword [ecx*4 + 0x81fc88]
mov dword [eax - 0x12], esi
movzx ecx, byte [eax - 0xb]
movzx edx, byte [eax - 0xc]
mov esi, dword [ecx*4 + 0x81f888]
xor esi, dword [edx*4 + 0x81ccf8]
movzx ecx, byte [eax - 0xd]
xor esi, dword [ecx*4 + 0x81eb10]
movzx ecx, byte [eax - 0xe]
xor esi, dword [ecx*4 + 0x81fc88]
mov dword [eax - 0xe], esi
movzx ecx, byte [eax - 7]
movzx edx, byte [eax - 8]
mov esi, dword [ecx*4 + 0x81f888]
xor esi, dword [edx*4 + 0x81ccf8]
movzx ecx, byte [eax - 9]
xor esi, dword [ecx*4 + 0x81eb10]
movzx ecx, byte [eax - 0xa]
xor esi, dword [ecx*4 + 0x81fc88]
mov dword [eax - 0xa], esi
movzx ecx, byte [eax - 3]
movzx edx, byte [eax - 4]
mov esi, dword [ecx*4 + 0x81f888]
movzx ecx, byte [eax - 5]
xor esi, dword [edx*4 + 0x81ccf8]
xor esi, dword [ecx*4 + 0x81eb10]
movzx ecx, byte [eax - 6]
xor esi, dword [ecx*4 + 0x81fc88]
mov dword [eax - 6], esi
cmp ebx, dword [edi + 0x1c]
jb 0x53ed50
pop esi
pop edi
pop ebx
ret
Function at 0x53fe70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
xor eax, eax
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jl 0x53fe83
mov ebx, dword [ebp - 4]
xor esi, esi
xor edx, edx
nop dword [eax]
movzx ecx, byte [ebp + edx - 0x108]
mov eax, edx
and eax, reloc.WS2_32.dll_ntohs
jns 0x53feb6
dec eax
or eax, 0xfffffff0
inc eax
movzx eax, byte [eax + ebx]
add eax, ecx
add esi, eax
and esi, 0x800000ff
jns 0x53fece
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [ebp + esi - 0x108]
mov byte [ebp + edx - 0x108], al
inc edx
mov byte [ebp + esi - 0x108], cl
cmp edx, 0x100
jl 0x53fea0
mov esi, dword [ebp + 0x14]
mov ebx, edi
sub dword [ebp + 0xc], esi
mov dword [ebp - 4], 0x20
nop dword [eax + eax]
inc edi
and edi, 0x800000ff
jns 0x53ff11
dec edi
or edi, 0xffffff00
inc edi
movzx edx, byte [ebp + edi - 0x108]
add ebx, edx
and ebx, 0x800000ff
jns 0x53ff2b
dec ebx
or ebx, 0xffffff00
inc ebx
movzx eax, byte [ebp + ebx - 0x108]
mov byte [ebp + edi - 0x108], al
mov byte [ebp + ebx - 0x108], dl
movzx ecx, byte [ebp + edi - 0x108]
add ecx, edx
movzx eax, cl
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + eax - 0x108]
xor al, byte [ecx + esi]
mov byte [esi], al
inc esi
sub dword [ebp - 4], 1
jne 0x53ff00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53ff70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 8], eax
lea ecx, [edx + 1]
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
push ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
push esi
mov esi, dword [ebp + 8]
sub ecx, eax
jns 0x53ffaf
add ecx, 0x7fffff07
mov eax, ecx
mov byte [ebp - 0x18], cl
sar eax, 8
mov byte [ebp - 0x17], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x16], al
mov eax, ecx
sar eax, 0x18
mov byte [ebp - 0x15], al
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
sub ecx, eax
jns 0x53fff1
add ecx, 0x7fffff07
mov eax, ecx
imul ebx, ecx, 0x9ef4
sar eax, 8
mov byte [ebp - 0x13], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x12], al
mov eax, ecx
sar eax, 0x18
mov byte [ebp - 0x11], al
mov eax, 0x4f7a09cd
imul ecx
mov byte [ebp - 0x14], cl
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
sub ebx, eax
jns 0x540033
add ebx, 0x7fffff07
mov eax, 0x4f7a09cd
mov byte [ebp - 0x10], bl
imul ebx
mov ecx, ebx
sar ecx, 8
mov byte [ebp - 0xf], cl
mov ecx, ebx
sar ecx, 0x10
sar edx, 0xe
mov byte [ebp - 0xe], cl
mov eax, edx
shr eax, 0x1f
mov ecx, ebx
sar ecx, 0x18
add eax, edx
mov byte [ebp - 0xd], cl
imul eax, eax, 0x7fffff07
imul ecx, ebx, 0x9ef4
sub ecx, eax
jns 0x540075
add ecx, 0x7fffff07
mov eax, ecx
mov byte [ebp - 0xc], cl
sar eax, 8
lea edx, [ebp - 0x18]
mov byte [ebp - 0xb], al
mov eax, ecx
sar ecx, 0x18
sar eax, 0x10
mov byte [ebp - 9], cl
lea ecx, [ebp - 0x74]
push 0x10
mov byte [ebp - 0xa], al
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
call fcn.0053f6b0
add esp, 4
lea edx, [ebp - 0x74]
mov ecx, esi
call fcn.0053f600
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x5400f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x90], eax
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
sete al
mov dword [ebp - 0x10], 0x546c4173
mov dword [ebp - 0x98], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edi
mov edi, ecx
mov byte [ebp - 0x14], bl
push 0x18
movups xmm0, xmmword [eax]
mov eax, ebx
mov dword [ebp - 0x8c], 0x67452301
sar eax, 8
lea ecx, [ebp - 0x8c]
mov byte [ebp - 0x13], al
mov eax, ebx
sar eax, 0x10
mov byte [ebp - 0x12], al
mov eax, ebx
sar eax, 0x18
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x11], al
mov dword [ebp - 0x88], 0xefcdab89
mov dword [ebp - 0x84], 0x98badcfe
mov dword [ebp - 0x80], 0x10325476
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
call fcn.0053f6b0
add esp, 4
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x1c]
call fcn.0053f600
lea eax, [ebp - 0x34]
mov edx, ebx
push eax
call fcn.0053ff70
add esp, 4
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, dword [edi + 0x2c]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x98]
call fcn.0053e3a0
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov edx, dword [ebp - 0x94]
mov ecx, dword [edi + 0x2c]
shl eax, 3
cmp dword [ebp + 8], 0
push dword [ebp - 0x90]
push eax
je 0x540205
call fcn.0053e470
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
call fcn.0053e7f0
mov ecx, dword [ebp - 8]
add esp, 8
xor ecx, ebp
pop edi
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x5403e0
Capabilities:
Encode data using xor
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ecx, 0x20
xor esi, esi
cmp dword [ebp + 8], ecx
push edi
cmovle ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test ecx, ecx
jle 0x54041b
mov esi, ecx
lea eax, [ebp - 0x54]
push esi
push edx
push eax
call fcn.006e6940
add esp, 0xc
xor ecx, ecx
cmp esi, 0x20
jge 0x540438
cmp ecx, 0x20
jge 0x540438
mov al, byte [ecx + 0x789c28]
inc ecx
mov byte [ebp + esi - 0x54], al
inc esi
cmp esi, 0x20
jl 0x540422
xor ecx, ecx
cmp ecx, 0x20
jge 0x54044f
mov al, byte [ecx + 0x789c28]
mov byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x20
jl 0x54043f
push 0x20
lea edx, [ebp - 0x34]
mov dword [ebp - 0xc0], 0x67452301
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
call fcn.0053f6b0
add esp, 4
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x14]
call fcn.0053f600
mov esi, 0x32
push 0x10
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc0], 0x67452301
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
call fcn.0053f6b0
add esp, 4
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x14]
call fcn.0053f600
sub esi, 1
jne 0x5404b1
movups xmm0, xmmword [ebp - 0x54]
xor ebx, ebx
movups xmm1, xmmword [ebp - 0x14]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
movsx eax, bl
lea edx, [ebp - 0x64]
movd xmm0, eax
lea eax, [ebp - 0x34]
punpcklbw xmm0, xmm0
push eax
punpcklwd xmm0, xmm0
push ecx
pshufd xmm0, xmm0, 0
push eax
pxor xmm0, xmm1
push ecx
movups xmmword [ebp - 0x64], xmm0
call fcn.0053fe70
inc ebx
add esp, 0x10
cmp ebx, 0x14
jl 0x540530
push 0x20
lea edx, [ebp - 0x54]
mov dword [ebp - 0xc0], 0x67452301
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
call fcn.0053f6b0
push 0x20
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0xc0]
call fcn.0053f6b0
add esp, 8
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x14]
call fcn.0053f600
mov esi, 0x32
nop word [eax + eax]
push 0x10
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc0], 0x67452301
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
call fcn.0053f6b0
add esp, 4
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x14]
call fcn.0053f600
sub esi, 1
jne 0x5405e0
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
movups xmmword [edi], xmm0
pop edi
pop esi
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret