joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48eb34
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x613811
call fcn.0060cc48
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0048ee8d
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
call dword [0x615364]
test eax, eax
jne 0x48ecad
mov ebx, dword [ebp - 0x10]
lea ecx, [edi + 0x18]
push ecx
call dword [0x615388]
lea eax, [ebp - 0x14]
lea ecx, [edi + 0x30]
cmp eax, ecx
je 0x48eb9b
mov eax, esi
mov esi, dword [ecx]
mov dword [ecx], eax
mov eax, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ecx + 4], eax
push dword [edi + 0xc]
call dword [0x615270]
lea eax, [edi + 0x18]
push eax
call dword [0x615384]
test ebx, ebx
je 0x48ec92
cmp dword [edi + 4], 0
jne 0x48ebd6
push 0x6a0c84
push dword [edi + 0x14]
call fcn.005e972e
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x48ec92
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
add eax, 8
cmp ecx, eax
je 0x48ebff
push 0xffffffffffffffff
push 0
push eax
call fcn.00409916
mov esi, dword [esi]
dec ebx
push 0
push 1
mov dword [ebp - 0x10], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.004097fa
push 0x20
push 1
push esi
call fcn.00403f7c
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 4], 0
je 0x48ec60
push dword [edi + 4]
push dword [ebp - 0x1c]
push 1
push eax
call fcn.005f3369
push dword [edi + 4]
push 2
push 1
push 0x696ef0
call fcn.005f3369
add esp, 0x20
mov esi, dword [ebp - 0x14]
test ebx, ebx
jne 0x48ebe9
cmp dword [edi + 4], 0
je 0x48ec7a
push dword [edi + 4]
call fcn.005e5e1d
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004097fa
mov esi, dword [ebp - 0x14]
jmp 0x48eb73
cmp dword [edi], 0
jne 0x48ecad
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [0x615364]
lea ecx, [edi + 0x18]
test eax, eax
je 0x48eb76
lea ecx, [ebp - 0x14]
call fcn.0048edd5
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48f79e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6138c3
call fcn.0060cc48
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x694da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], 0x6a0e14
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x49008e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [0x615388]
mov ecx, edi
call fcn.0049006f
test al, al
je 0x4900b5
or esi, 0xffffffff
jmp 0x490120
push ebx
push 8
call fcn.00431ddf
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4900c8
push 0xfffffffffffffffa
jmp 0x49011e
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x49039c
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f4880
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x490112
lea ebx, [edi + 0x14]
jmp 0x4900fc
call dword [0x615384]
push 1
call dword [0x61540c]
push ebx
call dword [0x615388]
cmp byte [edi + 4], 0
push ebx
je 0x4900ee
call dword [0x615384]
jmp 0x49011f
push 8
push ebx
call fcn.0049a82c
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [0x615384]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x490133
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6138c3
call fcn.0060cc48
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], 0x6a0e14
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x494d7e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x494df6
cmp dword [ebp + 0xc], esi
je 0x494df6
cmp dword [edi + 0x10], esi
je 0x494db5
push esi
push dword [edi + 0x10]
call dword [0x615364]
test eax, eax
jne 0x494db0
push dword [edi + 0x10]
call dword [0x61544c]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x494df6
mov ebx, dword [edi]
push 0x18
call fcn.00431ddf
pop ecx
mov ecx, eax
test ecx, ecx
je 0x494dea
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48e6f4
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f4880
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x494df8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4aecc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x4aed43
cmp dword [edi + 0x1b0], 0
je 0x4aed0d
push esi
push 1
push edi
call fcn.004a09c0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004a09c0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4aed43
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x618d50
push 2
push eax
call fcn.005f3369
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005f3369
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4b12a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.004b12c0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.005fe1d9

Function at 0x4b32c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b32de
cmp dword [esi + 0x78], 0
je 0x4b32de
push 2
push 3
push esi
call fcn.004b2890
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004b2ca0
add esp, 4
test esi, esi
je 0x4b32fe
cmp dword [esi + 0x78], 0
je 0x4b32fe
push 3
push esi
call fcn.004b28d0
add esp, 8
pop esi
pop ebp
ret
Function at 0x4c0da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.005f4880
add esp, 0x18
test eax, eax
je 0x4c0dc2
cmp eax, 0xffffffff
jne 0x4c0dc4
xor eax, eax
pop ebp
ret

Function at 0x4c4200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x6bc00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6c6725], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
jne 0x4c4236
call fcn.004c4a90
test al, al
je 0x4c4247
mov byte [0x6c6725], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b637
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x4c4268
push 0x400
push eax
call fcn.005278e0
add esp, 8
call fcn.004c4a90
test al, al
jne 0x4c4236
push esi
push edi
nop word [eax + eax]
mov esi, 2
mov dword [ebp - 0x154], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x150], eax
nop
lea eax, [ebp - 0x18c]
push eax
call fcn.004b2910
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x17c], xmm0
movups xmmword [ebp - 0x16c], xmm0
call fcn.004bbfd0
movups xmm1, xmmword [ebp - 0x17c]
add esp, 0xc
lea ecx, [esi - 1]
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push ecx
call fcn.0060c150
imul esi, dword [ebp - 0x164]
mov edi, eax
lea eax, [ebp - 0x19c]
mov ebx, edx
push eax
mov dword [ebp - 0x158], esi
call fcn.004b2910
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1ac]
push eax
call fcn.004b2910
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, esi
cdq
add eax, dword [ecx]
push 0
push dword [ebp - 0x14c]
adc edx, dword [ecx + 4]
push edx
push eax
call fcn.0060c150
shld edx, eax, 8
shl eax, 8
xor ebx, edx
xor edi, eax
mov dword [ebp - 0x168], ebx
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x16c], edi
push eax
call fcn.004b2910
lea esi, [eax + 8]
lea eax, [ebp - 0x1cc]
push eax
call fcn.004b2910
add esp, 8
mov ecx, dword [eax]
add ecx, dword [esi]
mov eax, dword [ebp - 0x148]
mov esi, dword [ebp - 0x14c]
add eax, 2
imul ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x148], esi
shl ecx, 0x10
xor eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x150]
movups xmm0, xmmword [ebp - 0x16c]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x154], 1
mov dword [ebp - 0x150], eax
jne 0x4c4290
movsd xmm0, qword [0x61d2a0]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.00526bf0
add esp, 0x10
call fcn.004c4a90
test al, al
je 0x4c4270
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.00527730
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x4c442c
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.005278e0
add esp, 8
call fcn.004c4a90
test al, al
jne 0x4c4236
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x15c]
call fcn.004aee10
add esp, 8
call fcn.004c4a90
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b637
mov esp, ebp
pop ebp
ret
Function at 0x4d5130
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x4d5162
push str.Couldnt_set_desired_mode
push esi
call fcn.004aed50
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4d5179
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.004aee10
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4d5192
push ebx
push esi
call fcn.004d4df0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4d51a7
push esi
call fcn.004d3e20
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4d51bc
push esi
call fcn.004d4dd0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4d51cc
push esi
call fcn.004d5010
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e1d40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6bc08c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e1d6d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4e1db4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4e1dba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e1e1b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4e1de0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4e1e47
mov eax, dword [esi + 4]
push 1
push 0x621f48
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x621f49
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4e1e20
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51afd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x51affc
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x51affc
push dword [eax + 0x24]
push 1
push dword [ebp + 0x10]
push ecx
call fcn.005f3369
add esp, 0x10
test eax, eax
cmovne eax, dword [ebp + 0x10]
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x51dd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
cmp edx, ebx
je 0x51de7c
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
push esi
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, dword [ebx + 4]
xor eax, ecx
dec esi
and eax, esi
mov dword [ebp - 8], esi
xor ecx, eax
mov dword [edx + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, esi
and eax, esi
pshufd xmm3, xmm0, 0
xor ecx, eax
mov dword [edx + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, esi
mov esi, dword [ebp + 0x14]
and eax, 4
xor ecx, eax
mov dword [edx + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test esi, esi
jle 0x51de7b
push edi
cmp esi, 8
jb 0x51de52
mov edi, dword [edx]
lea edx, [esi - 1]
mov ecx, dword [ebx]
lea edx, [ecx + edx*4]
mov dword [ebp + 0x10], edx
lea edx, [esi - 1]
lea edx, [edi + edx*4]
cmp ecx, edx
mov edx, dword [ebp + 0xc]
ja 0x51dda6
cmp dword [ebp + 0x10], edi
jae 0x51de52
cmp ecx, ebx
ja 0x51ddb3
cmp dword [ebp + 0x10], ebx
jae 0x51de52
cmp ecx, edx
ja 0x51ddc0
cmp dword [ebp + 0x10], edx
jae 0x51de52
lea ecx, [esi - 1]
lea ecx, [edi + ecx*4]
cmp edi, ebx
ja 0x51ddd2
cmp ecx, ebx
jae 0x51de52
cmp edi, edx
ja 0x51ddda
cmp ecx, edx
jae 0x51de52
mov ecx, esi
and ecx, 0x80000007
jns 0x51dde9
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp + 0x10], esi
sub dword [ebp + 0x10], ecx
mov ecx, dword [ebx]
movups xmm1, xmmword [edi + eax*4]
movups xmm0, xmmword [ecx + eax*4]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edi + eax*4], xmm0
movups xmm0, xmmword [ecx + eax*4]
pxor xmm2, xmm0
movups xmmword [ecx + eax*4], xmm2
movups xmm1, xmmword [edi + eax*4 + 0x10]
movups xmm0, xmmword [ecx + eax*4 + 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edi + eax*4 + 0x10], xmm0
movups xmm0, xmmword [ecx + eax*4 + 0x10]
pxor xmm2, xmm0
movups xmmword [ecx + eax*4 + 0x10], xmm2
add eax, 8
cmp eax, dword [ebp + 0x10]
jl 0x51ddf1
cmp eax, esi
jge 0x51de7a
mov ecx, dword [edx]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [ebp - 8]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
mov edx, dword [ebp + 0xc]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [ebp + 0x14]
jl 0x51de56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5278e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0x6bc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x538], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x53c], edi
test esi, esi
jne 0x52791d
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b637
mov esp, ebp
pop ebp
ret
push ebx
push 0x694620
push edi
call fcn.00553c80
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x52794a
push 0x62
push str.....crypto_rand_randfile.c
push 0x79
push 0x6f
push 0x24
call fcn.00529800
push edi
jmp 0x527a8f
lea eax, [ebp - 0x534]
push eax
push ebx
call fcn.005f310b
add esp, 4
push eax
call fcn.005fcb55
add esp, 8
test eax, eax
jns 0x5279a3
push 0x69
push str.....crypto_rand_randfile.c
push 0x71
push 0x6f
push 0x24
call fcn.00529800
push edi
push str.Filename
push 2
call fcn.005290e0
push ebx
call fcn.005e5e1d
add esp, 0x24
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b637
mov esp, ebp
pop ebp
ret
test esi, esi
jns 0x5279bd
test dword [ebp - 0x52e], 0x8000
mov esi, 0x100
cmovne esi, dword [ebp - 0x520]
push 0
push ebx
call fcn.005fd39a
add esp, 8
test esi, esi
jle 0x5279dc
cmp esi, 0x500
mov eax, 0x400
cmovle eax, esi
jmp 0x5279e1
mov eax, 0x500
push ebx
push eax
lea eax, [ebp - 0x504]
push 1
push eax
call fcn.005eed27
push ebx
mov edi, eax
call fcn.005e5d7c
add esp, 0x14
test eax, eax
je 0x527a19
call fcn.005f169c
cmp dword [eax], 4
jne 0x527a19
push ebx
call fcn.005fd2ea
add esp, 4
test edi, edi
je 0x5279c8
jmp 0x527a1d
test edi, edi
je 0x527a51
movd xmm0, edi
lea eax, [ebp - 0x504]
cvtdq2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push eax
call fcn.00526bf0
add dword [ebp - 0x538], edi
add esp, 0x10
test esi, esi
jle 0x5279dc
sub esi, edi
test esi, esi
jg 0x5279cc
lea eax, [ebp - 0x504]
push 0x500
push eax
call fcn.00538750
push ebx
call fcn.005e5e1d
add esp, 0xc
call fcn.00526da0
test eax, eax
jne 0x527ab2
push 0xa6
push str.....crypto_rand_randfile.c
push 0x76
push 0x6f
push 0x24
call fcn.00529800
push dword [ebp - 0x53c]
push str.Filename
push 2
call fcn.005290e0
add esp, 0x20
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b637
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x538]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0049b637
mov esp, ebp
pop ebp
ret

Function at 0x52ea70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call fcn.005e26d0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x532d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x532dd0
mov al, byte [esi]
test al, al
je 0x532dd0
push edi
mov edi, 0x100
nop dword [eax]
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x532da0
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x533040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x53309a
mov al, byte [edi]
test al, al
je 0x53309a
push ebx
mov ebx, 0x100
nop word [eax + eax]
movsx eax, al
push eax
call fcn.00553fb0
or eax, ebx
lea edi, [edi + 1]
mov ecx, eax
add esp, 4
shr ecx, 2
add ebx, 0x100
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
mov al, byte [edi]
test al, al
jne 0x533060
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x540fd0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.005b39d0
mov esi, eax
push esi
call fcn.0052ea70
add esp, 8
test eax, eax
jne 0x540fee
pop esi
pop ebp
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp fcn.005d4c00
Function at 0x547540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, dword [eax + 0x60]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [edx + 0x70]
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
test esi, esi
je 0x5475a8
test edi, edi
je 0x547588
nop dword [eax]
cmp esi, 0x40
jae 0x547588
mov al, byte [esi + edx + 0x30]
inc esi
xor al, byte [ebx]
inc ebx
mov byte [ecx], al
inc ecx
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x547570
mov dword [edx + 0x70], esi
test edi, edi
je 0x547657
cmp esi, 0x40
jne 0x5475a8
mov dword [edx + 0x70], 0
add dword [edx + 0x20], 1
jne 0x5475a8
inc dword [edx + 0x24]
mov eax, edi
lea esi, [edx + 0x20]
and eax, 0x3f
mov dword [ebp - 0x10], esi
sub edi, eax
mov dword [ebp - 8], eax
mov eax, dword [esi]
cmp edi, 0x40
jb 0x54760d
nop
mov esi, edi
shr esi, 6
add eax, esi
mov dword [ebp - 0xc], eax
cmp eax, esi
jae 0x5475d7
sub esi, eax
mov dword [ebp - 0xc], 0
lea eax, [edx + 0x20]
shl esi, 6
push eax
push edx
push esi
push ebx
push ecx
call fcn.00588c00
mov ecx, dword [ebp + 8]
sub edi, esi
mov eax, dword [ebp - 0xc]
add ecx, esi
mov edx, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 0x10]
add esp, 0x14
mov dword [ebp + 8], ecx
mov dword [esi], eax
test eax, eax
jne 0x547608
inc dword [edx + 0x24]
cmp edi, 0x40
jae 0x5475c0
cmp dword [ebp - 8], 0
je 0x547657
push 0x40
lea edi, [edx + 0x30]
push 0
push edi
call fcn.005e26d0
push esi
mov esi, dword [ebp - 4]
push esi
push 0x40
push edi
push edi
call fcn.00588c00
mov eax, dword [ebp - 8]
add esp, 0x20
xor edi, edi
test eax, eax
je 0x547654
mov edx, dword [ebp + 8]
sub ebx, edx
nop
lea ecx, [edi + edx]
mov al, byte [ebx + ecx]
xor al, byte [esi + edi + 0x30]
inc edi
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp edi, eax
jb 0x547640
mov dword [esi + 0x70], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret