joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8dc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.0052e070
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov eax, dword [ebx + 0x30]
mov esi, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x38]
mov edi, dword [ebx + 0x3c]
shld esi, eax, 3
shld edi, ecx, 3
shl eax, 3
shl ecx, 3
cmp dword [ebx + 0x168], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
jne 0x4e8e0e
cmp dword [ebx + 0x16c], 0
je 0x4e8e26
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004e95e0
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x38], ecx
mov ecx, eax
mov dword [ebx + 0x34], esi
mov eax, esi
shrd ecx, eax, 8
mov dword [ebx + 0x3c], edi
movzx eax, cl
cdq
mov ebx, eax
mov ecx, dword [esp + 0x14]
mov ebp, edx
movzx eax, cl
cdq
shld edx, eax, 8
shl eax, 8
or ebp, edx
or ebx, eax
mov eax, esi
shrd ecx, eax, 0x10
shld ebp, ebx, 8
movzx eax, cl
mov ecx, dword [esp + 0x14]
cdq
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, esi
shrd ecx, eax, 0x18
shld ebp, ebx, 8
movzx eax, cl
mov ecx, dword [esp + 0x1c]
cdq
shl ebx, 8
or ebp, edx
or ebx, eax
movzx eax, cl
cdq
shld ebp, ebx, 8
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
cdq
shld ebp, ebx, 8
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
cdq
shld ebp, ebx, 8
shr ecx, 0x18
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, edi
shld ebp, ebx, 8
shl ebx, 8
or ebx, ecx
mov ecx, dword [esp + 0x10]
shrd ecx, eax, 8
movzx eax, cl
mov ecx, dword [esp + 0x10]
cdq
mov esi, eax
mov edi, edx
movzx eax, cl
cdq
shld edx, eax, 8
shl eax, 8
or edi, edx
or esi, eax
mov eax, dword [esp + 0x18]
shld edi, esi, 8
shl esi, 8
shrd ecx, eax, 0x10
movzx eax, cl
mov ecx, dword [esp + 0x10]
cdq
or esi, eax
or edi, edx
mov eax, dword [esp + 0x18]
shrd ecx, eax, 0x18
shld edi, esi, 8
movzx eax, cl
mov ecx, dword [esp + 0x18]
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, cl
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
mov eax, ecx
shld edi, esi, 8
shr eax, 8
movzx eax, al
cdq
shl esi, 8
or edi, edx
or esi, eax
mov eax, ecx
shld edi, esi, 8
shr eax, 0x10
movzx eax, al
shl esi, 8
cdq
or esi, eax
shr ecx, 0x18
or edi, edx
shld edi, esi, 8
shl esi, 8
or esi, ecx
mov ecx, dword [esp + 0x24]
add ecx, 0x40
xor dword [ecx], ebx
mov ebx, dword [esp + 0x24]
xor dword [ecx + 4], ebp
xor dword [ebx + 0x48], esi
lea eax, [ebx + 0x60]
xor dword [ebx + 0x4c], edi
push eax
push ecx
call fcn.004e95e0
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x40]
xor dword [ecx], eax
add esp, 8
mov eax, dword [ebx + 0x24]
xor dword [ecx + 4], eax
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x4c], eax
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
test edx, edx
je 0x4e8fce
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
ja 0x4e8fce
add esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
jmp fcn.004913d0
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x4ec070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0052e070
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [ebp + 0x14]
cmp esi, ebx
jbe 0x4ec11d
mov ecx, dword [ebp + 0x18]
cmp esi, ecx
jb 0x4ec0ca
mov eax, esi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
push 0x7a
mov dword [ebp + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp + 0x40]
call fcn.00491180
add esp, 0x10
test eax, eax
jne 0x4ec0c7
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [ebp + 0x40], eax
cmp ebx, esi
jae 0x4ec11a
mov eax, ebx
shl eax, 4
mov dword [esp + 0xc], eax
mov eax, esi
mov esi, dword [esp + 0xc]
sub eax, ebx
mov dword [esp + 0x18], eax
push edi
mov ecx, dword [ebp + 0x40]
add ecx, esi
mov al, byte [ecx]
lea edi, [ecx + 0x10]
push edi
shr al, 7
movzx eax, al
push 1
push ecx
imul ebx, eax, 0x87
call fcn.004ebeb0
xor byte [edi + 0xf], bl
add esp, 0xc
add esi, 0x10
sub dword [esp + 0x1c], 1
jne 0x4ec0e4
mov esi, dword [esp + 0x20]
mov ebx, esi
pop edi
mov dword [ebp + 0x14], ebx
shl esi, 4
add esi, dword [ebp + 0x40]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4ec1f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.0052e070
mov eax, dword [0x6c0924]
xor eax, esp
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x98]
push edi
mov edi, dword [esp + 0x90]
mov dword [esp + 0x48], 0x61707865
mov eax, dword [ecx]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x74], eax
mov dword [esp + 0x4c], 0x3320646e
mov dword [esp + 0x50], 0x79622d32
mov eax, dword [ecx]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x54], 0x6b206574
test eax, eax
je 0x4ec3c7
push ebx
mov ebx, dword [esp + 0x98]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004ec3e0
add esp, 8
xor eax, eax
test esi, esi
je 0x4ec39a
cmp esi, 0x40
jb 0x4ec361
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x13]
add edx, esi
cmp edi, ecx
ja 0x4ec2f4
lea ecx, [esp + 0x14]
cmp edx, ecx
jae 0x4ec361
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x4ec301
cmp edx, ebx
jae 0x4ec361
mov edx, esi
lea ecx, [edi + 0x10]
mov ebp, ebx
and edx, 0xffffffc0
sub ebp, edi
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x14]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ebx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x24]
movups xmmword [edi + eax], xmm1
movups xmm1, xmmword [ecx + ebp - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
movups xmmword [ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + eax + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x44]
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [ebx + eax + 0x30]
add eax, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp eax, edx
jb 0x4ec310
cmp eax, esi
jae 0x4ec39a
mov ebp, ebx
lea ecx, [esp + 0x14]
sub ebp, ecx
lea edx, [esp + 0x14]
mov ecx, edi
sub ecx, edx
mov dword [esp + 0x10], ecx
mov ebx, ecx
nop dword [eax + eax]
lea edx, [esp + 0x14]
add edx, eax
inc eax
mov cl, byte [edx + ebp]
xor cl, byte [edx]
mov byte [ebx + edx], cl
cmp eax, esi
jb 0x4ec380
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
add ebx, esi
inc dword [esp + 0x84]
sub eax, esi
add edi, esi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], eax
test eax, eax
jne 0x4ec2b0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
pop edi
xor ecx, esp
call fcn.0052e057
add esp, 0x88
ret
Function at 0x4ef440
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x4ef454
mov dword [esp + 0x18], fcn.004edc20
jmp fcn.004e7720
mov dword [esp + 0x18], fcn.004ecec0
jmp fcn.004e7460
Function at 0x5054b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x5054e1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x5054e8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x5054d0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x505523
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x505523
cmp ecx, 0xfffffffd
je 0x505523
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x505523
cmp ecx, 0xfffffffe
je 0x505523
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x505523
cmp ecx, 0xffffffff
je 0x505523
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x50553e
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.00491400
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x50555d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x50555d
inc ecx
inc edx
cmp ecx, ebx
jl 0x505550
lea edx, [ebx - 1]
test edx, edx
js 0x505581
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x505581
cmp byte [eax], 0xff
jne 0x505581
dec eax
sub edx, 1
jns 0x505570
cmp ecx, edx
jl case.0x5055ad.2
jle 0x505593
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x5055ad.2
movzx eax, byte [eax + 0x505620]
jmp dword [eax*4 + 0x505600]
mov eax, 7
jmp 0x5055e3
mov eax, 6
jmp 0x5055e3
mov eax, 5
jmp 0x5055e3
mov eax, 4
jmp 0x5055e3
mov eax, 3
jmp 0x5055e3
mov eax, 2
jmp 0x5055e3
mov eax, 1
test dl, dh
jne case.0x5055ad.2
and bl, dl
cmp bl, dl
jne case.0x5055ad.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x515c10
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 0xc]
push ebp
xor ebp, ebp
test edx, edx
jle 0x515cf2
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
inc edi
nop dword [eax + eax]
movzx eax, byte [edi - 1]
cmp edx, 3
jl 0x515c83
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + 0x6788b0]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
inc esi
and ecx, 0x3f
mov ebx, esi
mov cl, byte [ecx + 0x6788b0]
mov byte [esi], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
mov ch, byte [ecx + 0x6788b0]
mov cl, byte [eax + 0x6788b0]
jmp 0x515ccc
shl eax, 0x10
cmp edx, 2
jne 0x515c93
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
lea ebx, [esi + 1]
shr ecx, 0x12
mov cl, byte [ecx + 0x6788b0]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
mov esi, ebx
and ecx, 0x3f
mov cl, byte [ecx + 0x6788b0]
mov byte [ebx], cl
cmp edx, 1
jne 0x515cbe
mov cl, 0x3d
jmp 0x515cca
shr eax, 6
and eax, 0x3f
mov cl, byte [eax + 0x6788b0]
mov ch, 0x3d
lea eax, [esi + 2]
mov byte [ebx + 1], cl
sub edx, 3
mov byte [eax], ch
add ebp, 4
lea esi, [eax + 1]
add edi, 3
test edx, edx
jg 0x515c30
pop edi
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov byte [eax], 0
mov eax, ebp
pop ebp
ret
Function at 0x52fca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6c0924]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x218], esi
test ebx, ebx
je 0x52fe70
cmp dword [ebx], 2
jne 0x52fe70
cmp dword [esi + 0x14], 8
jb 0x52fce6
mov esi, dword [esi]
mov dword [ebp - 0x218], esi
cmp dword [ebx + 0x10], 0
je 0x52fd00
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052e057
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x52fcec
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x52fd1b
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x52fcec
mov ecx, dword [ebx + 0x20]
mov eax, 0x532ae21d
push edi
mov edi, dword [ebx + 0x1c]
mov esi, 1
sub ecx, edi
mov dword [ebp - 0x210], 0
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x52fe5d
mov dword [ebp - 0x214], 0
nop dword [eax]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005b1170
mov eax, dword [ebp - 0x214]
add esp, 0xc
add eax, 4
add eax, edi
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52fda0
sub eax, edx
xor ecx, ecx
sar eax, 1
je 0x52fdde
lea ebx, [ecx + 0x5c]
nop word [eax + eax]
cmp word [ebp + ecx*2 - 0x20c], 0x2f
jne 0x52fdd3
mov word [ebp + ecx*2 - 0x20c], bx
inc ecx
cmp ecx, eax
jb 0x52fdc0
mov ebx, dword [ebp - 0x21c]
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebp - 0x214]
mov eax, dword [eax + edi]
test byte [eax + 0x26], 0x10
je 0x52fe01
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x52fe26
test esi, esi
je 0x52fe24
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
push dword [ebp - 0x210]
call fcn.0052fea0
test eax, eax
je 0x52fe24
mov esi, 1
jmp 0x52fe26
xor esi, esi
mov ecx, dword [ebx + 0x20]
add edi, 0x314
inc dword [ebp - 0x210]
mov eax, 0x532ae21d
mov dword [ebp - 0x214], edi
mov edi, dword [ebx + 0x1c]
sub ecx, edi
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [ebp - 0x210], ecx
jb 0x52fd60
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052e057
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0052e057
mov esp, ebp
pop ebp
ret
Function at 0x5300f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6c0924]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x5302d5
test edi, edi
je 0x5302d5
mov ecx, dword [esi + 0x20]
mov eax, 0x532ae21d
sub ecx, dword [esi + 0x1c]
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x5302d5
imul eax, ebx, 0x314
mov ebx, dword [esi + 0x1c]
mov ebx, dword [eax + ebx]
test byte [ebx + 0x26], 0x10
jne 0x5302d5
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x18], eax
ja 0x5302d5
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x2a]
movzx eax, word [edx + esi + 0x1c]
movzx ecx, word [edx + esi + 0x1a]
add eax, edx
add ecx, eax
lea eax, [esi + 0x1e]
add eax, ecx
movzx ecx, word [ebx + 0xa]
mov dword [ebp - 8], eax
test cx, cx
jne 0x5302ea
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x5301dd
test eax, eax
je 0x5301a9
cmp ecx, esi
jb 0x5301a9
push esi
push eax
push edi
call fcn.005b0670
add esp, 0xc
jmp 0x5301dd
push ecx
push 0
push edi
call fcn.005b1170
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x5301c8
call fcn.005b4bb2
mov dword [eax], 0x16
jmp 0x5301d8
cmp dword [ebp - 0xc], esi
jae 0x5301dd
call fcn.005b4bb2
mov dword [eax], 0x22
call fcn.005b4ad9
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x5302ce
or eax, 0xffffffff
cmp edx, 8
jb 0x5302a6
mov esi, edx
shr esi, 3
nop dword [eax]
movzx ecx, byte [edi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
movzx ecx, byte [edi + 7]
add edi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
sub esi, 1
jne 0x530200
test edx, edx
je 0x5302ca
nop word [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67c2f8]
sub edx, 1
jne 0x5302b0
not eax
jmp 0x5302d0
xor eax, eax
cmp eax, dword [ebx + 0x10]
je 0x530316
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052e057
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 8
jne 0x5302d5
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebx + 0x14]
push eax
call fcn.00532ed0
add esp, 0x14
test eax, eax
je 0x5302d5
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x10]
jne 0x5302d5
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052e057
mov esp, ebp
pop ebp
ret 0xc
Function at 0x530370
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612f5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c0924]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.0052e0d3
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x5303c7
push 0x58
push 0
push esi
call fcn.005b1170
add esp, 0xc
mov ecx, esi
call fcn.0052f550
mov esi, eax
jmp 0x5303c9
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x5303db
mov edi, dword [edi]
test edi, edi
je 0x530478
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x530478
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x530478
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x530478
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x530478
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x530478
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.0052f800
test eax, eax
je 0x530478
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x53048e
mov ecx, esi
call fcn.0052f670
push 0x58
push esi
call fcn.0052dbb4
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x530970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x530a6f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x530a6f
or eax, 0xffffffff
cmp esi, 8
jb 0x530a47
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
sub edi, 1
jne 0x5309a0
pop edi
test esi, esi
je 0x530a6a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x67db40]
sub esi, 1
jne 0x530a50
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5337f0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613099
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6c0924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov dword [ebp - 0x34], eax
mov word [edi], cx
mov eax, dword [eax + 0x10]
add eax, 5
mov dword [ebp - 4], ecx
push 0x6cac06
push eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x2c], eax
call fcn.0052e41d
push dword [ebp - 0x2c]
mov esi, eax
push 0
push esi
call fcn.005b1170
mov eax, dword [ebp - 0x34]
add esp, 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x53387c
mov eax, dword [eax]
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
push 1
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x5339e6
test esi, esi
je 0x533989
cmp byte [esi], 0
je 0x533989
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x34], eax
test eax, eax
jg 0x5338d5
push 0x628ac0
lea ecx, [ebp - 0x4c]
call fcn.0040d080
jmp 0x5339ab
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052e0c5
mov ecx, eax
add esp, 4
mov dword [ebp - 0x30], ecx
test ecx, ecx
jne 0x53390a
push 0x628ac0
lea ecx, [ebp - 0x4c]
call fcn.0040d080
jmp 0x5339ab
mov eax, dword [ebp - 0x34]
lea eax, [eax*2 + 2]
push eax
push 0
push ecx
call fcn.005b1170
add esp, 0xc
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jg 0x533956
push dword [ebp - 0x30]
call fcn.0052e0ce
add esp, 4
lea ecx, [ebp - 0x4c]
push 0x628ac0
call fcn.0040d080
jmp 0x5339ab
mov eax, dword [ebp - 0x30]
xor edx, edx
push eax
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x28]
call fcn.0040d080
push dword [ebp - 0x30]
call fcn.0052e0ce
add esp, 4
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0040cf10
lea ecx, [ebp - 0x28]
call fcn.0040df90
jmp 0x5339ab
xor eax, eax
mov dword [ebp - 0x3c], 0
push eax
push 0x628ac0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
call fcn.00413a60
lea eax, [ebp - 0x4c]
cmp edi, eax
je 0x5339de
mov ecx, edi
call fcn.004134e0
movups xmm0, xmmword [ebp - 0x4c]
xor eax, eax
mov word [ebp - 0x4c], ax
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
lea ecx, [ebp - 0x4c]
call fcn.0040df90
push esi
call fcn.0052e0ce
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052e057
mov esp, ebp
pop ebp
ret