joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457180
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x45739d
cmp eax, 0x7c
je 0x45739d
cmp eax, 0x29
jne 0x4571bc
cmp dword [esi + 0x10], 0
jne 0x45739d
test dword [esi + 0x50], 0x10000000
je 0x4573b4
cmp eax, 0x2e
jne 0x4571d0
push 5
lea ecx, [esi + 0x24]
call fcn.00457070
jmp 0x457381
cmp eax, 0x5c
jne 0x457235
mov ecx, esi
call fcn.00457120
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x457202
cmp byte [esi + 0x48], 0x62
jne 0x457202
push 4
lea ecx, [esi + 0x24]
call fcn.00457070
mov ecx, esi
call fcn.00457120
jmp 0x45738f
test eax, eax
je 0x457229
cmp byte [esi + 0x48], 0x42
jne 0x457229
push 4
lea ecx, [esi + 0x24]
call fcn.00457070
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00457120
jmp 0x45738f
mov ecx, esi
call fcn.00458b40
jmp 0x457388
cmp eax, 0x5b
jne 0x4572e8
mov ecx, esi
call fcn.00457120
lea ecx, [esi + 0x24]
call fcn.0045b1b0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x457266
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00457120
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x4572d2
cmp eax, 0x5d
jne 0x4572d2
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x457290
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x4572b6
push 0x20
call fcn.00471313
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.00457120
mov ecx, esi
call fcn.0045ac10
cmp dword [esi + 0x4c], 0x5d
jne 0x4573ad
jmp 0x457381
cmp eax, 0x28
jne 0x457314
mov ecx, esi
call fcn.00457120
mov ecx, esi
call fcn.00458cd0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4573b4
mov ecx, esi
call fcn.00457120
test bl, bl
je 0x45738f
jmp 0x457388
cmp eax, 0x5e
jne 0x45732c
push 2
lea ecx, [esi + 0x24]
call fcn.00457070
mov ecx, esi
call fcn.00457120
jmp 0x45738f
cmp eax, 0x24
jne 0x457344
push 3
lea ecx, [esi + 0x24]
call fcn.00457070
mov ecx, esi
call fcn.00457120
jmp 0x45738f
cmp eax, 0x2a
je 0x4573a6
cmp eax, 0x2b
je 0x4573a6
cmp eax, 0x3f
je 0x4573a6
cmp eax, 0x7b
je 0x4573a6
cmp eax, 0x7d
jne 0x457366
test dword [esi + 0x50], 0x10000000
je 0x4573bb
cmp eax, 0x5d
jne 0x457374
test dword [esi + 0x50], 0x10000000
je 0x4573ad
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00458f30
mov ecx, esi
call fcn.00457120
mov ecx, esi
call fcn.00458dd0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x457197
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.00455940
push 4
call fcn.00455940
push 5
call fcn.00455940
push 6
call fcn.00455940
int3
Function at 0x457e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push ebx
push esi
push edi
lea edi, [eax + 8]
mov dword [ebp - 8], ecx
lea esi, [edi + 4]
xor ebx, ebx
cmp esi, edi
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
cmp edi, esi
ja 0x457ec3
mov esi, ecx
nop dword [eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, edx
inc ebx
imul edx, ecx, 0x1000193
cmp ebx, esi
jne 0x457eb0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x457efc
cmp ecx, eax
jne 0x457ef4
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x457f04
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x457f04
cmp ecx, eax
jne 0x457f04
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.00453380
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x462d2b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x462d4d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x462d4f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x462dd3
jg 0x462d64
test esi, esi
je 0x462dd3
test ecx, ecx
jl 0x462dad
jg 0x462d6e
test eax, eax
je 0x462dad
cmp edi, ecx
jg 0x462d82
jl 0x462d78
cmp esi, eax
jae 0x462d82
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00488cb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x462db0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x462dd3
jg 0x462dba
test esi, esi
je 0x462dd3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x462dd3
push eax
push esi
push 1
push edx
call fcn.0049b111
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x462df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x462e1b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451470
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x462e3d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x462e3f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x462ede
jg 0x462e5c
test esi, esi
je 0x462ede
test ecx, ecx
jl 0x462ea9
jg 0x462e66
test eax, eax
je 0x462ea9
cmp ebx, ecx
jg 0x462e7a
jl 0x462e70
cmp esi, eax
jae 0x462e7a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00488cb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x462eb0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x462ede
jg 0x462eba
test esi, esi
je 0x462ede
cmp dword [edi + 0x4c], 0
je 0x462ede
mov ecx, edi
call fcn.00463530
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0049cded
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4631f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x46320c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x46323e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x46323e
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x463311
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x463266
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46328f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0049c154
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x463311
cmp eax, 1
jle 0x4632e4
cmp eax, 3
jne 0x463311
push dword [esi + 0x4c]
movsx eax, byte [ebp - 1]
push eax
call fcn.0049c154
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x463301
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0049b111
add esp, 0x10
cmp edi, eax
jne 0x463311
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x463233
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x463560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4635df
cmp byte [esi + 0x3d], 0
je 0x4635df
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4635a9
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4635b1
sub eax, 1
je 0x4635b5
sub eax, 2
je 0x4635df
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4635d2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0049b111
add esp, 0x10
cmp edi, eax
jne 0x4635a9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x463e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov ecx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
or eax, 1
bsr edx, esi
mov dword [ebp - 0x80], 0x10001
mov dword [ebp - 0x7c], 0x20001
mov dword [ebp - 0x78], 0x20002
mov dword [ebp - 0x74], 0x30003
mov dword [ebp - 0x70], 0x40003
mov dword [ebp - 0x6c], 0x40004
mov dword [ebp - 0x68], 0x50004
mov dword [ebp - 0x64], 0x50005
mov dword [ebp - 0x60], 0x60006
mov dword [ebp - 0x5c], 0x70006
mov dword [ebp - 0x58], 0x70007
mov dword [ebp - 0x54], 0x80007
mov dword [ebp - 0x50], 0x80008
mov dword [ebp - 0x4c], 0x90009
mov dword [ebp - 0x48], 0xa0009
mov dword [ebp - 0x44], 0xa000a
mov dword [ebp - 0x40], 0xb000a
mov dword [ebp - 0x3c], 0xb000b
mov dword [ebp - 0x38], 0xc000c
mov dword [ebp - 0x34], 0xd000c
mov dword [ebp - 0x30], 0xd000d
mov dword [ebp - 0x2c], 0xe000d
mov dword [ebp - 0x28], 0xe000e
mov dword [ebp - 0x24], 0xf000f
mov dword [ebp - 0x20], 0x10000f
mov dword [ebp - 0x1c], 0x100010
mov dword [ebp - 0x18], 0x110010
mov dword [ebp - 0x14], 0x110011
mov dword [ebp - 0x10], 0x120012
mov dword [ebp - 0xc], 0x130012
mov dword [ebp - 8], 0x130013
mov dword [ebp - 4], 0x140013
mov dword [ebp - 0x84], 0
je 0x463f29
lea eax, [edx + 0x20]
jmp 0x463f2c
bsr eax, eax
xor eax, 0x3f
mov dword [ebp - 0x120], 0xa
xor eax, 0x3f
mov dword [ebp - 0x11c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0x64
movlpd qword [ebp - 0x130], xmm0
movlpd qword [ebp - 0x128], xmm0
movzx eax, word [ebp + eax*2 - 0x80]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0x3e8
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0x2710
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0x186a0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0xf4240
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0x989680
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0x5f5e100
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0x3b9aca00
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0x540be400
mov dword [ebp - 0xd4], 2
mov dword [ebp - 0xd0], 0x4876e800
mov dword [ebp - 0xcc], 0x17
mov dword [ebp - 0xc8], 0xd4a51000
mov dword [ebp - 0xc4], 0xe8
mov dword [ebp - 0xc0], 0x4e72a000
mov dword [ebp - 0xbc], 0x918
mov dword [ebp - 0xb8], 0x107a4000
mov dword [ebp - 0xb4], 0x5af3
mov dword [ebp - 0xb0], 0xa4c68000
mov dword [ebp - 0xac], 0x38d7e
mov dword [ebp - 0xa8], 0x6fc10000
mov dword [ebp - 0xa4], 0x2386f2
mov dword [ebp - 0xa0], 0x5d8a0000
mov dword [ebp - 0x9c], 0x1634578
mov dword [ebp - 0x98], 0xa7640000
mov dword [ebp - 0x94], 0xde0b6b3
mov dword [ebp - 0x90], 0x89e80000
mov dword [ebp - 0x8c], 0x8ac72304
cmp esi, dword [ebp + eax*8 - 0x12c]
ja 0x4640e6
jb 0x4640da
cmp ecx, dword [ebp + eax*8 - 0x130]
jae 0x4640e6
mov ecx, 1
sub eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
sub eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x473062
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4a7526
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a739c

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x5b9830
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5d1e24]
add eax, 0xe9a
mov dword [0x5d1e24], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x5b98b2
mov eax, dword [ebp - 0x14]
add esp, 0x24
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x5b9906
jmp 0x5b9952
mov eax, dword [0x5d1e28]
add eax, 0x26b1
mov dword [0x5d1e28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x5b9937
jmp 0x5b9952
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x5b98df
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x5b98b2
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x5b9952
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x5b9873
jmp 0x5b9952
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x21], dl
mov al, byte [ebp - 0x21]
test al, 1
jne 0x5b9922
jmp 0x5b9952
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x5b988b
jmp 0x5b9952
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
je 0x5b986b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x5b986b
Function at 0x5b99f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x5d1e30], 0
mov byte [0x5d1e34], 0
mov dword [0x5d1e24], 0xcd2
mov dword [0x5d1e2c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x5b9b11
xor eax, eax
mov dword [0x5d1e2c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x5d1e38], 0
mov edx, dword [0x5d1e24]
mov esi, edx
add esi, 0xfffff4ea
mov dword [0x5d1e24], esi
mov esi, dword [0x5d1e30]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 0x28], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x5d1e38], ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffff1c3
mov dword [0x5d1e24], edx
mov eax, ebx
cdq
idiv ecx
mov dword [0x5d1e30], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [edi + ecx]
mov byte [0x5d1e34], cl
mov dword [0x5d1e28], 0x17dd
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov dword [0x5d1e24], 0x742
mov cl, byte [0x5d1e34]
mov ebx, dword [0x5d1e30]
mov byte [edi + ebx], cl
mov ebx, dword [0x5d1e2c]
add ebx, 1
mov dword [0x5d1e2c], ebx
cmp ebx, 0x100
mov dword [ebp - 0x20], ebx
jl 0x5b9a49
jmp 0x5b9b46
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x5d1e24], 0x11d2
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x5d1e2c]
add eax, 1
mov dword [0x5d1e2c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x5b9b11
jmp 0x5b9a3a
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ba510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x5d1e24], 0x26fd
mov dword [0x5d1e2c], 0
mov dword [0x5d1e30], 0
mov dword [0x5d1e3c], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x5ba6a1
jmp 0x5ba56b
jmp 0x5ba6a1
xor eax, eax
mov ecx, 0x26fd
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x5ba5a4
mov eax, dword [0x5d1e24]
mov ecx, dword [0x5d1e2c]
mov edx, dword [0x5d1e30]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 0x78a
mov dword [0x5d1e24], ecx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x5d1e2c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x5d1e30], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x5d1e34], cl
mov dword [0x5d1e24], 0xb52
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x5d1e34]
mov edx, dword [0x5d1e30]
mov byte [edi + edx], cl
mov edx, dword [0x5d1e2c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x5d1e30]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x5d1e24], 0x1ac5
and ebx, 0xff
mov dword [0x5d1e3c], ebx
mov dword [0x5d1e28], 0xe6b
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x5d1e41]
mov byte [0x5d1e40], dl
mov byte [0x5d1e41], ch
mov byte [0x5d1e42], cl
mov dword [0x5d1e24], 0x120f
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x30], ebx
je 0x5ba566
jmp 0x5ba584
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5bafb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
call fcn.00401080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x5bb041
jmp 0x5bb120
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x5d1e24], 0x7ac
mov dword [esp + 0x1c], eax
jmp 0x5bb0e4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x38]
mov dword [esp + 0x68], ecx
mov dword [0x5d1e24], 0x1606
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.005baa00
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x5bb118
lea eax, [esp + 0x38]
mov ecx, dword [0x5d1e24]
add ecx, 0xfffffa3e
mov dword [0x5d1e28], ecx
mov dword [esp + 0xc], eax
call fcn.005b9830
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x5bb118
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.005ba160
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x70], ecx
mov dword [esp + 8], eax
lea eax, [0x5ba080]
mov dword [esp + 0x7c], 0x133800
mov ecx, dword [0x5d1e10]
mov dword [esp + 0x54], ecx
mov ecx, dword [0x5d1e14]
mov dword [esp + 0x8c], ecx
mov ecx, dword [0x5d1e18]
mov dword [esp + 0x38], ecx
mov ecx, dword [0x5d1e1c]
mov dword [esp + 0x64], ecx
mov ecx, dword [0x5d1e20]
mov dword [esp + 0x3c], ecx
mov dword [0x5d1e24], 0x260
mov dword [0x5d1e28], 0xfffff7c0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
jne 0x5bafd3
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x5baff4
jmp 0x5bafd3
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret