joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51dee0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x20
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov esi, dword [esp + 0x2c]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
test byte [esi + 0x44], 1
jne 0x51df09
mov dword [esi], 0x100
cmp dword [esi + 0x38], ebx
jne 0x51df15
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], ebx
jne 0x51df21
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], ebx
jne 0x51df2d
mov dword [esi + 8], 3
push dword [esi + 0x84]
call fcn.005221d0
add esp, 4
test eax, eax
jne 0x51dfca
test dword [esi], 0x200
je 0x51df62
pop edi
pop esi
mov eax, 0x1a
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472272
add esp, 0x20
ret
push 0x7f000001
mov dword [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00520690
add esp, 0x14
test eax, eax
jne 0x51e0f4
push eax
push dword [esp + 0x10]
push esi
call fcn.00520e90
push dword [esp + 0x18]
mov ebx, eax
call fcn.00521bc0
add esp, 0x10
test ebx, ebx
je 0x51dfca
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472272
add esp, 0x20
ret
push ebp
cmp dword [esi + 0x28], edi
jne 0x51e097
mov ebp, 0x40
mov dword [esi + 0x28], edi
push ebp
mov dword [esp + 0x18], ebp
call dword [0x1341f50]
mov edi, eax
add esp, 4
test edi, edi
jne 0x51e006
lea eax, [ebp - 0x31]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472272
add esp, 0x20
ret
push ebp
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x51e03f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x51e043
mov eax, dword [esp + 0x14]
add ebp, ebp
add eax, eax
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [0x1341f54]
add esp, 8
test eax, eax
je 0x51e069
mov edi, eax
jmp 0x51e006
test eax, eax
je 0x51e046
mov byte [edi], 0
push 0x2e
push edi
call fcn.004f33e0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x51e097
push 4
call dword [0x1341f50]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
jne 0x51e070
mov ebx, 0xf
jmp 0x51e0e3
lea eax, [ebp + 1]
push eax
call fcn.005228c0
mov ecx, dword [esi + 0x24]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
jne 0x51e090
mov ebx, 0xf
jmp 0x51e0e3
mov dword [esi + 0x28], 1
cmp dword [esi + 0x30], 0
jne 0x51e0a4
mov dword [esi + 0x2c], 0
cmp dword [esi + 0x34], 0
jne 0x51e0c4
push 0x576a04
call fcn.005228c0
add esp, 4
mov dword [esi + 0x34], eax
test eax, eax
mov ecx, 0xf
cmove ebx, ecx
test dword [esi + 0x44], 0x800000
jne 0x51e0e3
mov eax, 0xa
mov dword [esi + 0xd4], 0x1388
mov word [esi + 0xd0], ax
test edi, edi
je 0x51e0f1
push edi
call dword [0x1341f58]
add esp, 4
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00472272
add esp, 0x20
ret
Function at 0x521a00
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x521a6b
mov edi, dword [esp + 0xc]
test edi, edi
je 0x521a6b
push esi
push 0x14
call fcn.0051dad0
mov esi, eax
add esp, 4
test esi, esi
jne 0x521a2a
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebx
ret
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x521a80
push 0
push 0
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x521a63
push esi
call dword [0x1341f58]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
pop edi
mov eax, 2
pop ebx
ret

Function at 0x522b20
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
xor esi, esi
sub eax, 1
je 0x522c10
sub eax, 1
je 0x522b5a
sub eax, 2
jne 0x522b94
push ebx
lea eax, [edi + 8]
push ebp
push eax
call fcn.00522d40
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
push dword [edi + 8]
push ebx
push 1
push ebp
call fcn.00501151
add esp, 0x10
test eax, eax
je 0x522b94
nop dword [eax]
add esi, eax
cmp esi, ebx
je 0x522c17
push dword [edi + 8]
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + ebp]
push 1
push eax
call fcn.00501151
add esp, 0x10
test eax, eax
jne 0x522b70
mov eax, dword [edi]
sub eax, 2
jne 0x522ba6
push dword [edi + 8]
call fcn.004f637d
add esp, 4
mov eax, dword [edi + 4]
mov dword [edi + 0x210], 0
test al, 1
jne 0x522bc2
mov dword [edi], 1
jmp 0x522b30
test al, 2
jne 0x522bf9
push 0x553d54
push 0x576ba0
mov dword [edi], 2
call fcn.004f62f0
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x522bf9
push 0
push 4
push 0
push eax
call fcn.0054c8ee
add esp, 0x10
jmp 0x522b30
lea eax, [edi + 8]
mov dword [edi], 4
push eax
call fcn.00522cb0
add esp, 4
jmp 0x522b30
push ebx
push ebp
call sub.ADVAPI32.dll_SystemFunction036
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x523630
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push dword [esp + 0x20]
mov dword [esp + 0x18], 0
push dword [esp + 0x20]
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x523668
cmp eax, 0xea
jne 0x5236c5
mov eax, dword [esp + 4]
test eax, eax
je 0x5236c5
inc eax
push eax
call dword [0x1341f50]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x5236c5
lea ecx, [esp + 4]
push ecx
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5236b4
mov ecx, dword [esp + 4]
cmp ecx, 1
je 0x5236b4
mov eax, dword [esi]
pop esi
mov byte [ecx + eax], 0
mov eax, 1
pop ecx
ret
push dword [esi]
call dword [0x1341f58]
add esp, 4
mov dword [esi], 0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x525a90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
je 0x525b73
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x525b73
push esi
push edi
push 0x553d54
push eax
call fcn.004f62f0
mov edi, eax
add esp, 8
test edi, edi
jne 0x525add
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
mov ecx, 1
cmp ecx, eax
pop edi
sbb esi, esi
and esi, 0xa
add esi, 4
mov eax, esi
pop esi
pop ebx
ret
push 2
push 0
push edi
call fcn.005014d6
add esp, 0xc
test eax, eax
je 0x525b02
push edi
mov esi, 0xe
call fcn.004f637d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00502227
mov esi, eax
add esp, 4
test esi, esi
js 0x525aee
push 0
push 0
push edi
call fcn.005014d6
add esp, 0xc
test eax, eax
jne 0x525aee
test esi, esi
je 0x525b62
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push ebx
call fcn.00525190
add esp, 8
test eax, eax
jne 0x525b4e
push edi
lea esi, [eax + 0xf]
call fcn.004f637d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
push esi
push 1
push eax
call fcn.00501151
add esp, 0x10
cmp eax, esi
jne 0x525aee
add dword [ebx + 4], esi
xor esi, esi
push edi
call fcn.004f637d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, 2
pop ebx
ret
Function at 0x526d10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x224]
mov dword [esi], ecx
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x526d50
push eax
call fcn.005228c0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x526d85
cmp dword [esp + 0x220], 0
je 0x526da0
test ecx, ecx
je 0x526d68
push ecx
call dword [0x1341f58]
add esp, 4
push 0x576dbc
call fcn.005163ea
push eax
call fcn.005228c0
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x526e94
mov eax, 0xf
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472272
add esp, 0x214
ret
test ecx, ecx
jne 0x526e94
push 0x104
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004f3280
add esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x576bc4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x526dfe
mov eax, 4
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472272
add esp, 0x214
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x114]
push eax
push 0
push 0
push 0x576dc8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x526e45
mov eax, dword [0x576dd8]
mov dword [ecx], eax
mov ax, word [0x576ddc]
mov word [ecx + 4], ax
mov al, byte [0x576dde]
mov byte [ecx + 6], al
lea eax, [esp + 0xc]
push eax
call fcn.005228c0
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x526e94
lea eax, [ecx + 0xf]
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472272
add esp, 0x214
ret
mov dword [esi], ecx
xor eax, eax
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.00472272
add esp, 0x214
ret

Function at 0x528fb0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 2
jne 0x528fbe
lea ecx, [eax + 2]
jmp 0x528fc6
cmp eax, 0x17
jne 0x529029
lea ecx, [eax - 7]
push esi
sub eax, 2
je 0x528ff1
sub eax, 0x15
je 0x528fe1
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x529009
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00528ec0
jmp 0x528fff
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00528b60
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x529018
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x529018
xor eax, eax
pop esi
ret
xor eax, eax
cmp esi, 0xffffffff
pop esi
setg al
lea eax, [eax*2 - 1]
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
ret
Function at 0x529d00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
movzx ecx, word [ebx]
mov eax, ecx
sub eax, 2
je 0x529d22
sub eax, 0x15
je 0x529d18
xor eax, eax
pop ebx
ret
mov dword [esp + 0xc], 0x1c
jmp 0x529d2a
mov dword [esp + 0xc], 0x10
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x11
push 2
push ecx
push edi
call fcn.0052d970
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x529d60
call fcn.0050156a
pop edi
pop esi
pop ebx
mov eax, dword [eax]
sub eax, 0x273f
neg eax
sbb eax, eax
ret
push dword [esp + 0x14]
push ebx
push esi
push edi
call fcn.0052d5a0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x529d91
call fcn.0050156a
cmp dword [eax], 0x2714
je 0x529d60
push esi
push edi
call fcn.0052d560
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push edi
test eax, eax
je 0x529db6
call fcn.0052d560
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
call fcn.0052d560
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x52d5a0
Capabilities:
Connect socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52d5cd
mov eax, dword [eax + 8]
test eax, eax
je 0x52d5cd
push dword [ecx + 0xb8]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
add esp, 0x10
ret
invalid
invalid
Function at 0x52d9b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52d9e3
mov eax, dword [eax + 0xc]
test eax, eax
je 0x52d9e3
push dword [ecx + 0xb8]
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
ret

Function at 0x52da00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52da39
mov eax, dword [eax + 0xc]
test eax, eax
je 0x52da39
push dword [ecx + 0xb8]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
ret

Function at 0x52da60
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52daa2
mov edx, dword [eax + 0x10]
test edx, edx
je 0x52daa2
push dword [ecx + 0xb8]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 1
push eax
push dword [esp + 0x1c]
call edx
add esp, 0x10
add esp, 8
ret
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
ret
Function at 0x52dac0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x24
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, dword [ebx + 0x88]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x52dafc
cmp dword [eax], 0
je 0x52dafc
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00472272
add esp, 0x24
ret
push ebp
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [esi + 0x1c], 0
lea eax, [esi + 0x1c]
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
jle 0x52db43
push 4
push eax
push 0x1001
push 0xffff
push edi
call ebp
cmp eax, 0xffffffff
je 0x52dc39
cmp dword [esi + 0x20], 0
lea eax, [esi + 0x20]
jle 0x52db65
push 4
push eax
push 0x1002
push 0xffff
push edi
call ebp
cmp eax, 0xffffffff
je 0x52dc39
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x52db97
cmp dword [esi + 0x68], 0
je 0x52db97
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x14], ax
push dword [esi + 0x68]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
mov eax, 0x10
jmp 0x52dc28
cmp eax, 0x17
jne 0x52dbc6
cmp dword [ebx + 0x5c], 0
jne 0x52dbc6
lea eax, [esi + 0x6c]
mov edx, 0x576e48
mov dword [esp + 0x10], eax
mov ecx, eax
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x52dbf7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x52dbb5
cmp dword [ebx + 4], 0x17
jne 0x52dbe2
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x1b
push 0x29
push edi
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00472272
add esp, 0x24
ret
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
movups xmmword [esp + 0x14], xmm0
mov eax, 0x17
movq qword [esp + 0x24], xmm0
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x10]
movups xmm0, xmmword [eax]
mov eax, 0x1c
movups xmmword [esp + 0x1c], xmm0
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x52dbc6
mov ecx, dword [esp + 0x30]
or eax, 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.00472272
add esp, 0x24
ret
Function at 0x52e510
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x52e536
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x52e524
pop edi
mov eax, edx
pop esi
ret

Function at 0x52e540
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x18]
test ebx, ebx
je 0x52e574
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
push eax
call fcn.00522820
movzx eax, al
inc esi
xor eax, edi
add esp, 4
imul edi, eax, 0x1000193
cmp esi, ebx
jb 0x52e556
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x539510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov ecx, dword [esp + 0x44]
mov eax, ecx
mov edx, dword [esp + 0x30]
sub eax, edx
push ebx
mov dword [esp + 0x14], eax
mov ebx, ecx
mov eax, dword [esp + 0x44]
sub ebx, eax
inc eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
cmp eax, 1
jle 0x53965c
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x3c]
sub eax, ebx
push esi
push edi
lea edi, [ebx + 4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], edi
mov esi, dword [eax + edi]
mov ebx, ecx
sub ebx, dword [esp + 0x10]
mov ecx, edx
mov eax, dword [eax + edi + 4]
sub ecx, ebx
mov dword [esp + 0x2c], eax
cmp ecx, dword [esp + 0x1c]
jb 0x539614
mov ebp, dword [edi]
and ecx, 0x1f
mov dword [esp + 0x24], ebp
mov ebp, 1
mov dword [esp + 0x50], ebp
shl dword [esp + 0x50], cl
mov ecx, dword [esp + 0x20]
add ecx, ebx
cmp ecx, ebp
cmovl ecx, ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x30], ecx
cmp esi, eax
je 0x539637
mov edi, dword [esp + 0x3c]
imul eax, ebx, 0x34
add eax, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
lea edi, [edi + eax*4]
nop dword [eax + eax]
movzx eax, byte [esi + ebp]
push eax
push dword [esp + 0x58]
push dword [esp + 0x50]
push ebp
push dword [esp + 0x28]
push ecx
push dword [esp + 0x40]
push ebx
push edx
push edi
call fcn.005398b0
mov ecx, dword [esp + 0x78]
inc esi
mov edx, dword [esp + 0x68]
add esp, 0x28
lea eax, [ecx*4]
mov ecx, dword [esp + 0x30]
add edi, eax
cmp esi, dword [esp + 0x2c]
jne 0x5395d0
mov edi, dword [esp + 0x14]
jmp 0x539637
mov ecx, dword [esp + 0x3c]
add eax, ebp
push 1
push 0
push edx
push ebx
push eax
lea eax, [esi + ebp]
push eax
mov eax, dword [edi]
lea eax, [ecx + eax*4]
push eax
call fcn.00539670
mov edx, dword [esp + 0x5c]
add esp, 0x1c
mov eax, dword [esp + 0x10]
add edi, 4
mov ecx, dword [esp + 0x54]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], edi
jl 0x539562
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x53a260
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x24]
cmp ebp, 8
jb 0x53a320
mov ecx, ebp
shr ecx, 3
mov dword [esp + 0x10], ecx
cmp eax, 1
jne 0x53a2a9
movq xmm0, qword [esi]
movq qword [esp + 0x14], xmm0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x53a2ae
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push 0xc2b2ae3d
push 0x27d4eb4f
push ecx
push eax
call fcn.00472c40
mov ecx, eax
add esi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00472c40
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00472c40
mov ebx, eax
mov edi, edx
mov eax, dword [esp + 0x30]
add ebx, 0xc2b2ae63
adc edi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x53a290
cmp ebp, 4
jb 0x53a373
push 0x9e3779b1
push 0x85ebca87
cmp eax, 1
mov eax, dword [esi]
push 0
push eax
add esi, 4
call fcn.00472c40
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.00472c40
mov ebx, eax
mov edi, edx
add ebx, 0x9e3779f9
adc edi, 0x165667b1
sub ebp, 4
test ebp, ebp
je 0x53a3b7
movzx eax, byte [esi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00472c40
xor ebx, eax
lea esi, [esi + 1]
xor edi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, edi, 0xb
push 0x85ebca87
shld edi, ebx, 0xb
push edi
push eax
call fcn.00472c40
mov ebx, eax
mov edi, edx
sub ebp, 1
jne 0x53a377
push 0xc2b2ae3d
xor ecx, ecx
mov esi, edi
push 0x27d4eb4f
xor ecx, edi
shr esi, 1
push ecx
xor esi, ebx
push esi
call fcn.00472c40
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00472c40
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x5435a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x74]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0x10], 0
mov dword [esp + 0x84], 0
lea eax, [edi + ecx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7c]
add eax, esi
mov dword [esp + 0x7c], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
push dword [eax + 0x6858]
mov ebx, dword [eax + 0x685c]
lea edx, [eax + 0x1808]
mov ebp, dword [eax + 0x6860]
push ecx
mov dword [esp + 0x28], edx
lea ecx, [eax + 0x1004]
lea edx, [eax + 0x1004]
mov dword [esp + 0x88], ebx
push edi
push ecx
mov dword [esp + 0x2c], edx
lea ecx, [eax + 0x1808]
mov edx, dword [eax + 0x6814]
add ebp, ebx
push ecx
push eax
mov dword [esp + 0x3c], edx
mov edx, dword [eax + 0x6818]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 0x681c]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x44], edx
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.00542d10
add esp, 0x24
cmp eax, 0xffffff88
ja 0x5437df
lea edx, [eax + edi]
mov edi, dword [esp + 0x84]
test edi, edi
je 0x54379d
mov ecx, dword [esp + 0x7c]
xorps xmm0, xmm0
mov eax, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x18]
sub eax, edx
movq qword [esp + 0x30], xmm0
push eax
push edx
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 1
push eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], 1
call fcn.005402c0
add esp, 0xc
cmp eax, 0xffffff88
jbe 0x5436d6
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
push dword [esp + 0x74]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00540e60
push dword [esp + 0x28]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00540e60
push dword [esp + 0x38]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.00540e60
lea eax, [esp + 0x60]
push eax
call fcn.005475f0
add esp, 0x28
cmp eax, 2
jg 0x543795
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x5437bf
lea eax, [esp + 0x3c]
dec edi
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00543070
movq xmm0, qword [esp + 0x38]
lea eax, [esp + 0x88]
add esp, 8
push dword [esp + 0x28]
push dword [esp + 0x30]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x4c]
sub esp, 0xc
mov ecx, esp
push dword [esp + 0x34]
movq qword [ecx], xmm0
push esi
mov dword [ecx + 8], eax
call fcn.00543a90
add esp, 0x28
cmp eax, 0xffffff88
ja 0x5437df
add esi, eax
lea eax, [esp + 0x3c]
push eax
call fcn.005475f0
add esp, 4
cmp eax, 2
jle 0x543725
mov ebx, dword [esp + 0x80]
test edi, edi
jne 0x5436c9
mov eax, ebp
sub eax, ebx
cmp ebx, ebp
ja 0x5436c9
lea edi, [eax + esi]
cmp edi, dword [esp + 0x14]
jbe 0x5437c8
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov ebx, dword [esp + 0x80]
jmp 0x54379d
test eax, eax
je 0x5437d9
push eax
push ebx
push esi
call fcn.004f3650
add esp, 0xc
mov esi, edi
sub esi, dword [esp + 0x78]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret