joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x14
mov dword [ebp - 8], edi
lea esi, [edi + 0x5c]
sub ebx, esi
pop edi
movss xmm0, dword [ebx + esi]
mulss xmm0, dword [0x6195a4]
cvttss2si eax, xmm0
mov dword [esi], eax
lea esi, [esi + 4]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
cmovge eax, ecx
mov ecx, eax
sub edi, 1
jne 0x55d625
test ecx, ecx
je 0x55d65b
bsr eax, ecx
mov dword [ebp + 8], eax
xor eax, 0x1f
jmp 0x55d65e
push 0x20
pop eax
mov edi, dword [ebp - 8]
mov edx, 0x10000
push 0x10
pop ebx
push 9
pop ecx
mov dword [edi + 0xac], ebx
cmp eax, ecx
jge 0x55d6a0
sub ecx, eax
mov eax, ebx
sub eax, ecx
mov dword [edi + 0xac], eax
xor eax, eax
movd xmm1, ecx
movups xmm0, xmmword [edi + eax*4 + 0x5c]
psrad xmm0, xmm1
movups xmmword [edi + eax*4 + 0x5c], xmm0
add eax, 4
cmp eax, 0x14
jl 0x55d688
sar edx, cl
mov ecx, dword [edi + 0xa4]
mov eax, dword [edi + 0x90]
sub ecx, edx
or ecx, dword [edi + 0xa0]
or ecx, dword [edi + 0x9c]
or ecx, dword [edi + 0x98]
or eax, dword [edi + 0x7c]
or ecx, dword [edi + 0xa8]
or eax, dword [edi + 0x68]
or eax, ecx
mov ebx, dword [edi + 0xac]
je 0x55d6fb
cmp ebx, 0x10
mov eax, 0x55cfe8
mov edx, 0x55cf6e
cmove eax, edx
mov dword [edi + 0x58], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [edi + 0xb0], eax
jmp 0x55d77b
mov dword [edi + 0xb0], 3
mov ecx, dword [edi + 0x8c]
mov eax, dword [edi + 0x74]
sub ecx, edx
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x5c]
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x88]
or eax, dword [edi + 0x84]
or eax, dword [edi + 0x78]
or eax, dword [edi + 0x70]
or eax, dword [edi + 0x64]
or eax, dword [edi + 0x60]
je 0x55d741
mov eax, 0x55ce9b
mov ecx, 0x55ce3f
jmp 0x55d76c
test ecx, ecx
je 0x55d751
mov eax, 0x55d0b8
mov ecx, 0x55d079
jmp 0x55d76c
mov eax, dword [edi + 0x94]
or eax, dword [edi + 0x80]
or eax, dword [edi + 0x6c]
je 0x55d777
mov eax, 0x55ce09
mov ecx, 0x55cddb
cmp ebx, 0x10
cmove eax, ecx
mov dword [edi + 0x58], eax
jmp 0x55d77b
and dword [edi + 0x58], 0
cmp dword [edi + 0x58], 0
je 0x55d79e
xor eax, eax
lea ecx, [ebx - 1]
inc eax
shl eax, cl
add dword [edi + 0x6c], eax
add dword [edi + 0x80], eax
add dword [edi + 0x94], eax
add dword [edi + 0xa8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x561eda
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push esi
push edi
test ebx, ebx
je 0x561f78
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x56202e
movzx edi, byte [esi + ebx]
test edi, edi
je 0x561f6d
mov eax, dword [ebp + 8]
movzx eax, word [eax + esi*2]
push eax
call fcn.00561e42
push dword [ebp - 4]
mov dword [ebp + 0x14], eax
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + esi*4]
call fcn.00504b8e
add esp, 0x10
mov edx, eax
cmp edi, 0xff
jae 0x561f47
mov ecx, edi
shr ecx, 7
add ecx, edi
push ecx
push dword [ebp + 0x14]
push edx
call fcn.00504b8e
add esp, 0xc
mov edx, eax
mov ecx, edx
mov eax, edx
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edx, 3
or ecx, eax
and edx, 0x1f
mov eax, dword [ebp + 8]
or ecx, edx
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x561efd
jmp 0x56202e
xor edi, edi
mov dword [ebp + 0x14], edi
cmp dword [ebp + 0x10], edi
jle 0x56202e
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.00561e42
mov esi, eax
mov eax, dword [ebp + 0xc]
pop ecx
mov edx, dword [eax + edi*4]
mov edi, esi
shr edi, 8
mov ecx, edx
shr ecx, 8
mov eax, 0xffff00ff
and ecx, eax
and edi, eax
imul ecx, dword [ebp - 4]
mov eax, edx
imul edi, ebx
and eax, 0xff00ff
imul eax, dword [ebp - 4]
shr edx, 8
add edi, ecx
mov ecx, esi
and ecx, 0xff00ff
shr esi, 8
imul ecx, ebx
add ecx, eax
mov eax, 0xff00ff
and esi, eax
shr ecx, 8
and edx, eax
imul esi, ebx
imul edx, dword [ebp - 4]
xor edi, ecx
and edi, eax
add esi, edx
xor edi, esi
mov ecx, edi
mov eax, edi
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edi, 3
or ecx, eax
and edi, 0x1f
mov eax, dword [ebp + 8]
or ecx, edi
mov edi, dword [ebp + 0x14]
mov word [eax + edi*2], cx
inc edi
mov dword [ebp + 0x14], edi
cmp edi, dword [ebp + 0x10]
jl 0x561f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x562037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ecx + 8]
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test edx, edx
je 0x5620ab
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x56213f
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
movzx ebx, byte [edi + edx]
test ebx, ebx
je 0x56209d
push ecx
push dword [esi]
push dword [eax + esi]
call fcn.00504b8e
add esp, 0xc
cmp ebx, 0xff
jae 0x562092
mov ecx, ebx
shr ecx, 7
add ecx, ebx
push ecx
push dword [esi]
push eax
call fcn.00504b8e
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 8]
inc edi
add esi, 4
cmp edi, dword [ebp + 0x10]
jl 0x562061
jmp 0x56213f
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x56213f
mov edx, dword [ebp + 0xc]
mov eax, 0x100
sub eax, ecx
mov ecx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], edx
mov edx, dword [ecx + edx]
mov edi, dword [ecx]
mov esi, edi
shr esi, 8
mov ecx, 0xffff00ff
and esi, ecx
imul esi, eax
mov eax, edx
shr eax, 8
and eax, ecx
mov ecx, edi
imul eax, dword [ebp - 4]
and ecx, 0xff00ff
imul ecx, dword [ebp + 0x10]
shr edi, 8
add esi, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
xor esi, ecx
mov ecx, 0xff00ff
and edi, ecx
and edx, ecx
imul edx, dword [ebp - 4]
and esi, ecx
mov ecx, dword [ebp + 0x14]
imul edi, eax
add edi, edx
mov edx, dword [ebp + 8]
xor esi, edi
mov dword [ecx], esi
add ecx, 4
mov dword [ebp + 0x14], ecx
sub ebx, 1
jne 0x5620ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x57eda4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0xc]
inc ecx
mov eax, ecx
xor eax, esi
cmp eax, 3
cmove eax, ecx
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 3
jl 0x57edb8
mov eax, dword [ebp - 0xc]
movsd xmm1, qword [ebx + 8]
push ecx
push ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
mov eax, dword [ebp - 8]
subsd xmm1, xmm4
movsd qword [ebp - 0x24], xmm3
movsd qword [ebp - 0x14], xmm4
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
mulsd xmm1, xmm0
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [ebx]
subsd xmm0, xmm3
movsd qword [ebp - 0x2c], xmm2
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x34], xmm1
movsd qword [esp], xmm1
call fcn.00526e91
pop ecx
pop ecx
test al, al
jne 0x57ee96
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
cmp eax, 3
jge 0x57eeac
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
subsd xmm1, qword [ebp - 0x14]
subsd xmm0, qword [ebp - 0x24]
mulsd xmm1, qword [ebp - 0x1c]
mulsd xmm0, qword [ebp - 0x2c]
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, qword [ebp - 0x34]
comisd xmm0, xmmword [0x5f6ef0]
jbe 0x57ee90
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.00530a80
pop ecx
pop ecx
test al, al
je 0x57ee96
mov eax, dword [ebp - 4]
inc eax
add edi, 0x10
jmp 0x57ee40
inc esi
add ebx, 0x10
cmp esi, 3
jl 0x57edb2
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
jmp 0x57eea5
Function at 0x580d7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x66f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x580d9d
xor ecx, ecx
cmp ecx, 3
jge 0x580edf
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x5f6ef0]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x580e1b
ucomisd xmm2, qword [0x5f6ef0]
lahf
test ah, 0x44
jnp 0x580db4
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.00526e91
pop ecx
pop ecx
test al, al
jne 0x580ece
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x5f6ef0]
jbe 0x580eba
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.00530a80
pop ecx
pop ecx
test al, al
je 0x580ece
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x580e66
mov ecx, dword [ebp - 0x18]
jmp 0x580db4
inc esi
add edi, 0x10
cmp esi, 4
jl 0x580d97
xor al, al
jmp 0x580ee1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422909
mov esp, ebp
pop ebp
ret

Function at 0x584571
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x5845ab
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x58458a
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x5845d6
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x5845c9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x59bda5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005a77af
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x59bdd2
xor eax, eax
jmp 0x59bece
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4a3d8e
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.0059ce50
push esi
push eax
call fcn.004a3da0
add esp, 0x14
test eax, eax
je 0x59be0d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005a795a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0059ce32
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0059e551
add esp, 0x28
test eax, eax
jne 0x59be44
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x59be85
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005a792b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x59be80
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x59beb5
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005a7880
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005a7838
add esp, 0x14
jmp 0x59bdcb
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.005a76fe
push dword [ebp - 4]
call fcn.0059bf78
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x59e2f7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x59e32d
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x59e320
push eax
call fcn.005a7824
push 2
call fcn.005a779b
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004a20a0
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x59f722
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005a77af
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x59f74f
xor eax, eax
jmp 0x59f8f3
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4a3d8e
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.0059ce50
push esi
push eax
call fcn.004a3da0
add esp, 0x14
test eax, eax
je 0x59f79c
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005a795a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0059ce32
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0059e551
add esp, 0x28
test eax, eax
jne 0x59f7d3
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x59f80f
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005a792b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x59f80f
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x59e623
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.0059e672
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x59f88f
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.005aeda0
add esp, 0xc
cmp eax, 0xfffffffa
je 0x59f878
cmp eax, 0xfffffffc
je 0x59f871
cmp eax, 0xfffffffe
je 0x59f86a
test eax, eax
je 0x59f88a
push str.Unknown_zlib_error
jmp 0x59f87d
push str.zlib_stream_error
jmp 0x59f87d
push str.zlib_memory_error
jmp 0x59f87d
push str.zlib_version_error
push dword [ebp - 4]
call fcn.0059ce6c
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x59f8bf
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005a7880
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005a7838
add esp, 0x14
jmp 0x59f748
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.005a46f6
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ad3a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x5ad441
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004a1a70
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x5ad3f6
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x5ad41d
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x5ad566
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x5ad46e
xor eax, eax
jmp 0x5ad4ba
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5ad48b
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.005b0a5b
jmp 0x5ad49b
cmp eax, 2
jne 0x5ad4a4
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.005aef71
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.004a1a70
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x5ad4e2
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x5ad4f7
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x5ad3b3
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x5ad566
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x5ad536
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.004a20a0
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x5ad566
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x5ad566
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.004a20a0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5aef71
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5aef7e
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005aef84

Function at 0x5b3f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x694980], ecx
inc eax
cmp eax, 0x100
jb 0x5b3f92
cmp eax, 0x800
jae 0x5b4063
nop
mov edx, dword [eax*4 + 0x694580]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x694980]
mov dword [eax*4 + 0x694980], edx
inc eax
cmp eax, 0x800
jb 0x5b4040
mov dword [0x694910], 0x5b4e00
call fcn.005b4c30
mov ecx, dword [0x694910]
test eax, eax
mov edx, 0x5b4ea0
cmove ecx, edx
mov dword [0x694910], ecx
ret
Function at 0x5b5180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x5b51a0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x5b51d2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x5b51cf
inc esi
cmp esi, edx
jb 0x5b51c0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x5b52fc
cmp ecx, 3
jbe 0x5b5212
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x5b5250
cmp cl, 0xff
je 0x5b5250
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x5b51b4
dec ecx
shl eax, cl
and eax, 7
je 0x5b51ea
movzx ecx, byte [eax + 0x636a28]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x636a20], 0
mov cl, byte [edx + 4]
je 0x5b523a
test cl, cl
je 0x5b523a
cmp cl, 0xff
jne 0x5b51ea
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x5b51b4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x5b527e
lea edx, [edi + ebx]
add edx, esi
jmp 0x5b5284
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x5b52c2
movzx edi, byte [eax + 0x636a28]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x5b52ae
cmp cl, 0xff
jne 0x5b52c2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x5b5271
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x5b51b4
pop edi
pop esi
cmp ecx, 3
jbe 0x5b5311
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b7c30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x66f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5b7c80
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x5b7c7a
shr eax, 8
cmp al, 2
jne 0x5b7c7a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422909
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00422909
mov esp, ebp
pop ebp
ret