joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501bd0
Capabilities:
Enumerate files on windows
Get common file path
Get disk information
Resolve function by parsing pe exports

Disassembly:
jmp 0x5055d0
sub esp, 0x410
mov ecx, 0xd6354c
call fcn.00504bf0
lea eax, [esp]
push eax
push 0x410
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x505671
mov al, byte [esp]
cmp al, 0x5c
jne 0x505655
cmp byte [esp + 1], 0x5c
je 0x505660
lea eax, [esp]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505610
sub eax, edx
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, 0x8f1e08
call fcn.00401470
mov eax, 0x886c00
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505631
sub eax, edx
push eax
push 0x886c00
mov ecx, 0x8f1e08
call fcn.0042a1b0
add esp, 0x410
jmp fcn.00505300
cmp al, 0x2f
jne 0x505603
cmp byte [esp + 1], 0x2f
jne 0x505603
mov eax, 0x87059c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505668
jmp 0x505687
mov eax, 0x87059c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505680
sub eax, edx
push eax
mov ecx, 0x8f1e08
push 0x87059c
call fcn.00401470
add esp, 0x410
jmp fcn.00505300
Function at 0x5056b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x87059c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5056b8
sub eax, edx
push eax
mov eax, dword [0x8f1e1c]
push 0x87059c
push eax
push 0
mov ecx, 0x8f1e08
call fcn.00502550
test eax, eax
je 0x505725
cmp dword [0x8f1e20], 0x10
mov eax, dword [0x8f1e0c]
jae 0x5056f0
mov eax, 0x8f1e0c
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x505725
mov eax, 0x87059c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505704
sub eax, edx
push eax
push 0x87059c
mov ecx, 0x8f1e08
call fcn.00401470
call fcn.00505300
xor eax, eax
ret
mov eax, 1
ret

Function at 0x508c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x902834]
test eax, eax
je 0x508c37
cmp dword [0xd920d4], 1
jne 0x508c37
jmp fcn.00517410
ret
Function at 0x50a520
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [edx + 0x90]
mov eax, dword [edx + 0x94]
xor eax, ecx
mov ecx, eax
sar ecx, 0xd
sar eax, 0x15
and ecx, 0xf
and eax, 0xf
add ecx, 8
add eax, 0x20
test ecx, ecx
push edi
mov edi, eax
jle 0x50a56b
push ebx
lea eax, [edx + 0x20]
push esi
mov edi, edi
mov esi, dword [edx + edi*4 + 4]
mov ebx, dword [eax]
sub ebx, esi
mov dword [eax], ebx
mov esi, ebx
mov ebx, dword [edx + edi*4]
xor ebx, esi
mov dword [eax], ebx
add eax, 4
dec ecx
jne 0x50a550
pop esi
pop ebx
pop edi
ret
Function at 0x50b730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ebx, ebx
jne 0x50b763
fld dword [edx]
fcomp dword [0x879dc4]
fnstsw ax
test ah, 0x44
jp 0x50b763
fld dword [edx + 4]
fcomp dword [0x879dc4]
fnstsw ax
test ah, 0x44
jp 0x50b763
fld dword [edx + 8]
fcomp dword [0x879dc4]
fnstsw ax
test ah, 0x44
jnp 0x50b7cb
lea eax, [edi + ecx*4]
add ecx, eax
mov eax, dword [esp + 4]
lea eax, [eax + ecx*2]
mov ecx, dword [edx]
lea eax, [eax + eax*2]
shl eax, 4
mov dword [eax + 0xe748b0], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0xe748b4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 0xe748b8], edx
push ebp
lea ecx, [eax + 0xe748c0]
mov edx, esi
mov ebp, dword [edx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [ecx + 4], ebp
mov ebp, dword [edx + 8]
mov dword [ecx + 8], ebp
mov edx, dword [edx + 0xc]
mov byte [eax + 0xe748a1], bl
push esi
lea eax, [eax + 0xe748b0]
push eax
push edi
mov dword [ecx + 0xc], edx
call fcn.005bc0d0
add esp, 0xc
pop ebp
jmp fcn.00417980
ret

Function at 0x50eef0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov cl, byte [esi + 4]
xor eax, eax
test cl, cl
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], eax
jle 0x50ef31
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 4]
mov edx, dword [eax + ecx*8]
lea eax, [eax + ecx*8]
mov eax, dword [eax + 4]
push edi
push ebx
push edx
push eax
call ebp
mov eax, dword [esp + 0x14]
movsx ecx, byte [esi + 4]
add esp, 0x10
inc eax
cmp eax, ecx
mov dword [esp + 4], eax
jl 0x50ef05
xor eax, eax
mov cl, byte [esi + 5]
test cl, cl
mov dword [esp + 4], eax
jle 0x50ef77
mov dword [esp + 8], eax
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 8]
mov ecx, dword [eax + edx + 4]
add eax, edx
mov edx, dword [eax + 8]
push edi
push ebx
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 0x44
mov dword [esp + 0x18], ecx
movsx ecx, byte [esi + 5]
add esp, 0x10
inc eax
cmp eax, ecx
mov dword [esp + 4], eax
jl 0x50ef40
xor eax, eax
mov cl, byte [esi + 6]
test cl, cl
mov dword [esp + 4], eax
jle 0x50efc7
mov dword [esp + 8], eax
jmp 0x50ef90
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 8]
mov ecx, dword [eax + edx + 4]
add eax, edx
mov edx, dword [eax + 8]
push edi
push ebx
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 0x14
mov dword [esp + 0x18], ecx
movsx ecx, byte [esi + 6]
add esp, 0x10
inc eax
cmp eax, ecx
mov dword [esp + 4], eax
jl 0x50ef90
xor eax, eax
mov cl, byte [esi + 7]
test cl, cl
mov dword [esp + 4], eax
jle 0x50f00a
mov dword [esp + 8], eax
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 8]
mov ecx, dword [eax + edx]
add eax, edx
mov edx, dword [eax + 8]
push edi
push ebx
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 0xc
mov dword [esp + 0x18], ecx
movsx ecx, byte [esi + 7]
add esp, 0x10
inc eax
cmp eax, ecx
mov dword [esp + 4], eax
jl 0x50efd6
pop ebp
add esp, 8
ret
Function at 0x50f090
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
mov cl, byte [edi + 4]
xor eax, eax
test cl, cl
mov dword [esp + 0x10], eax
jle 0x50f0fb
lea ebx, [ebx]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [eax + ecx*8]
mov ebp, dword [eax + ecx*8 + 4]
lea eax, [eax + ecx*8]
push 1
push esi
push ebx
push ebp
call fcn.005bedf0
push esi
push ebx
push ebp
call fcn.005bee40
add esp, 0x1c
test eax, eax
je 0x50f0e8
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], ecx
mov eax, dword [esp + 0x10]
movsx edx, byte [edi + 4]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x50f0b0
xor eax, eax
mov cl, byte [edi + 5]
test cl, cl
mov dword [esp + 0x10], eax
jle 0x50f166
mov dword [esp + 0x18], eax
lea ebx, [ebx]
mov eax, dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [eax + ecx + 4]
mov ebp, dword [eax + ecx + 8]
add eax, ecx
push 1
push esi
push ebx
push ebp
call fcn.005bedf0
push esi
push ebx
push ebp
call fcn.005bee40
add esp, 0x1c
test eax, eax
je 0x50f148
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, 0x44
mov dword [esp + 0x18], edx
movsx edx, byte [edi + 5]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x50f110
xor eax, eax
mov cl, byte [edi + 6]
test cl, cl
mov dword [esp + 0x10], eax
jle 0x50f1cb
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x18]
mov ebx, dword [eax + ecx + 4]
mov ebp, dword [eax + ecx + 8]
add eax, ecx
push 1
push esi
push ebx
push ebp
call fcn.005bedf0
push esi
push ebx
push ebp
call fcn.005bee40
add esp, 0x1c
test eax, eax
je 0x50f1ad
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, 0x14
mov dword [esp + 0x18], edx
movsx edx, byte [edi + 6]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x50f175
xor eax, eax
mov cl, byte [edi + 7]
test cl, cl
mov dword [esp + 0x10], eax
jle 0x50f233
mov dword [esp + 0x18], eax
lea ebx, [ebx]
mov eax, dword [edi + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [eax + ecx]
mov ebp, dword [eax + ecx + 8]
add eax, ecx
push 1
push esi
push ebx
push ebp
call fcn.005bedf0
push esi
push ebx
push ebp
call fcn.005bee40
add esp, 0x1c
test eax, eax
je 0x50f217
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, 0xc
mov dword [esp + 0x18], edx
movsx edx, byte [edi + 7]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x50f1e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x513bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0082e470
movzx eax, al
add eax, 0xfffffff9
cmp eax, 0xc
ja case.0x513bc7.10
movzx eax, byte [eax + 0x513cb0]
jmp dword [eax*4 + 0x513ca8]
test byte [0xd99608], 0x40
je case.0x513bc7.10
call fcn.00526560
mov eax, dword [0xd99608]
test ah, 2
je 0x513beb
call fcn.00524fc0
mov eax, dword [0xd99608]
test ah, 4
je 0x513bfa
call fcn.00524d20
test byte [0xd99608], 0x20
je 0x513c08
call fcn.005277a0
test byte [0xd99608], 8
je 0x513c16
call fcn.0052e5b0
test byte [0xd99608], 0x10
je 0x513c24
call fcn.0052e5e0
test byte [0xd99608], 2
je 0x513c32
call fcn.0052e610
test byte [0xd99608], 4
je 0x513c40
call fcn.0052ad00
test byte [0xd99608], 1
je 0x513c4e
call fcn.0052c540
test byte [0xd99608], 0x40
je 0x513c5c
call fcn.005268c0
mov eax, dword [0xd99608]
test ah, 1
je 0x513c6b
call fcn.00525410
mov eax, dword [0xd99608]
test ah, 8
je 0x513c7a
call fcn.00524570
mov eax, dword [0xd99608]
test ah, 0x10
je 0x513c89
call fcn.005223b0
mov eax, dword [0xd99608]
test ah, 0x20
je 0x513c98
call fcn.00523b50
mov eax, dword [0xd99608]
test ah, 0x40
je 0x513ca7
jmp fcn.00523490
ret
Function at 0x520f40
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov al, byte [esi + 4]
push edi
xor ebx, ebx
xor edi, edi
cmp al, bl
jle 0x520f65
push edi
push esi
call fcn.00520d60
movsx eax, byte [esi + 4]
add esp, 8
inc edi
cmp edi, eax
jl 0x520f52
push esi
call fcn.00520c70
mov al, byte [esi + 6]
add esp, 4
xor edi, edi
cmp al, bl
jle 0x520f8a
push edi
push esi
call fcn.00521ac0
movsx ecx, byte [esi + 6]
add esp, 8
inc edi
cmp edi, ecx
jl 0x520f77
mov al, byte [esi + 5]
xor edi, edi
cmp al, bl
jle 0x520fa6
push edi
push esi
call fcn.00509d80
movsx edx, byte [esi + 5]
add esp, 8
inc edi
cmp edi, edx
jl 0x520f93
mov al, byte [esi + 7]
xor edi, edi
cmp al, bl
jle 0x520fc3
nop
push edi
push esi
call fcn.00521be0
movsx eax, byte [esi + 7]
add esp, 8
inc edi
cmp edi, eax
jl 0x520fb0
mov ecx, dword [esi + 0xc]
push ecx
call fcn.00412d90
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 0xc], ebx
call fcn.00412d90
mov eax, dword [esi + 0x14]
push eax
mov dword [esi + 0x10], ebx
mov byte [esi + 4], bl
call fcn.00412d90
mov ecx, dword [esi + 0x18]
push ecx
mov dword [esi + 0x14], ebx
mov byte [esi + 5], bl
call fcn.00412d90
mov edx, dword [esi + 0x1c]
push edx
mov dword [esi + 0x18], ebx
mov byte [esi + 6], bl
call fcn.00412d90
add esp, 0x14
pop edi
mov dword [esi + 0x1c], ebx
mov byte [esi + 7], bl
pop esi
pop ebx
ret
Function at 0x542e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], fcn.00540320
mov dword [esp + 0x18], fcn.00540320
mov dword [esp + 0x1c], fcn.00540320
mov dword [esp + 0x20], fcn.00540320
mov dword [esp + 0x24], fcn.00540320
mov dword [esp + 0x28], 0x55b200
mov dword [esp + 0x2c], 0x55b200
mov dword [esp + 0x30], 0x55b200
mov dword [esp + 0x34], 0x55b200
mov dword [esp + 0x38], 0x55b200
mov dword [esp + 0x3c], 0x551ab0
mov dword [esp + 0x40], 0x551ab0
mov dword [esp + 0x44], 0x551ab0
mov dword [esp + 0x48], 0x551ab0
mov dword [esp + 0x4c], 0x551ab0
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], 0x55a060
mov dword [esp + 0x90], 0x55a060
mov dword [esp + 0x94], 0x55a060
mov dword [esp + 0x98], 0x55a060
mov dword [esp + 0x9c], 0x55a060
mov dword [esp + 0xa0], 0x559040
mov dword [esp + 0xa4], 0x559040
mov dword [esp + 0xa8], 0x559040
mov dword [esp + 0xac], 0x559040
mov dword [esp + 0xb0], 0x559040
call fcn.00532580
mov edi, eax
call fcn.00532750
mov ebp, dword [edi + 0x1c]
mov ebx, eax
mov al, byte [edi + 0x20]
mov byte [esp + 0x13], al
call fcn.005325d0
cmp eax, 1
jne 0x542fd6
mov ecx, dword [esp + 0xb8]
push ebx
push edi
push ecx
call fcn.00540320
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
movzx eax, byte [esp + 0x13]
lea edx, [ebp + ebp*4]
add edx, eax
mov eax, dword [esp + edx*4 + 0x14]
cmp eax, esi
je 0x543003
mov ecx, dword [esp + 0xb8]
push ebx
push edi
push ecx
call eax
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
add esp, 0xa4
ret
Function at 0x543020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa0
push esi
xor esi, esi
push edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x55b210
mov dword [esp + 0x20], 0x55b210
mov dword [esp + 0x24], 0x55b210
mov dword [esp + 0x28], 0x55b210
mov dword [esp + 0x2c], 0x55b210
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], 0x55a070
mov dword [esp + 0x84], 0x55a070
mov dword [esp + 0x88], 0x55a070
mov dword [esp + 0x8c], 0x55a070
mov dword [esp + 0x90], 0x55a070
mov dword [esp + 0x94], 0x559050
mov dword [esp + 0x98], 0x559050
mov dword [esp + 0x9c], 0x559050
mov dword [esp + 0xa0], 0x559050
mov dword [esp + 0xa4], 0x559050
call fcn.00532580
mov edi, eax
call fcn.00532750
mov dl, byte [edi + 0x20]
mov ecx, dword [edi + 0x1c]
movzx edx, dl
lea ecx, [ecx + ecx*4]
add ecx, edx
mov ecx, dword [esp + ecx*4 + 8]
cmp ecx, esi
je 0x543155
push eax
mov eax, dword [esp + 0xb0]
push edi
push eax
call ecx
add esp, 0xc
pop edi
pop esi
add esp, 0xa0
ret
Function at 0x543230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
mov al, byte [esi + 0x20]
push ebx
push ebp
mov ebp, dword [esi + 0x1c]
push edi
mov dword [esp + 0x10], fcn.00541600
mov dword [esp + 0x14], fcn.00541600
mov dword [esp + 0x18], fcn.00541600
mov dword [esp + 0x1c], fcn.00541600
mov dword [esp + 0x20], fcn.00541600
mov dword [esp + 0x24], 0x55b520
mov dword [esp + 0x28], 0x55b520
mov dword [esp + 0x2c], 0x55b520
mov dword [esp + 0x30], 0x55b520
mov dword [esp + 0x34], 0x55b520
mov dword [esp + 0x38], 0x552410
mov dword [esp + 0x3c], 0x552410
mov dword [esp + 0x40], 0x552410
mov dword [esp + 0x44], 0x552410
mov dword [esp + 0x48], 0x552410
mov dword [esp + 0x4c], 0x553650
mov dword [esp + 0x50], 0x553650
mov dword [esp + 0x54], 0x553650
mov dword [esp + 0x58], 0x553650
mov dword [esp + 0x5c], 0x553650
mov dword [esp + 0x60], 0x555630
mov dword [esp + 0x64], 0x555630
mov dword [esp + 0x68], 0x555630
mov dword [esp + 0x6c], 0x555630
mov dword [esp + 0x70], 0x555630
mov dword [esp + 0x74], 0x55c0a0
mov dword [esp + 0x78], 0x55c0a0
mov dword [esp + 0x7c], 0x55c0a0
mov dword [esp + 0x80], 0x55c0a0
mov dword [esp + 0x84], 0x55c0a0
mov dword [esp + 0x88], 0x55a920
mov dword [esp + 0x8c], 0x55a920
mov dword [esp + 0x90], 0x55a920
mov dword [esp + 0x94], 0x55a920
mov dword [esp + 0x98], 0x55a920
mov dword [esp + 0x9c], 0x559790
mov dword [esp + 0xa0], 0x559790
mov dword [esp + 0xa4], 0x559790
mov dword [esp + 0xa8], 0x559790
mov dword [esp + 0xac], 0x559790
mov byte [esp + 0xf], al
lea edi, [esi + 0x48]
xor ebx, ebx
call fcn.005072d0
cmp al, 1
jne 0x5433c1
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa4
ret
push esi
call fcn.005328c0
push esi
call fcn.00532950
movzx eax, al
add esp, 8
sub eax, 0
je 0x5433e0
dec eax
je 0x5433f3
jmp 0x5434a7
push 3
push edi
call fcn.005556a0
push 1
push esi
call fcn.00532910
add esp, 0x10
mov al, byte [0x91cfe1]
test al, al
je 0x54341a
call fcn.005556c0
cmp eax, 4
je 0x54340b
call fcn.00837d70
call fcn.00637410
call fcn.006373c0
jmp 0x5434a7
mov eax, dword [esi + 0x24]
test eax, eax
jle 0x543437
cmp eax, 3
jg 0x543437
mov dword [edi + 0x170], 0
mov ebx, 1
jmp 0x5434a7
call fcn.005325d0
cmp eax, 1
jne 0x543461
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0xb8]
mov eax, dword [esp + 0xb4]
push ecx
push edx
push eax
push esi
call fcn.00541600
jmp 0x54348f
movzx edx, byte [esp + 0xf]
lea ecx, [ebp + ebp*4]
add ecx, edx
mov eax, dword [esp + ecx*4 + 0x10]
test eax, eax
je 0x543430
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0xb8]
push edx
push ecx
push esi
call eax
add esp, 0x10
test eax, eax
je 0x5434a2
mov byte [0x91cfe0], 0
mov ebx, 1
call fcn.0053c8e0
push esi
call fcn.005328d0
add esp, 4
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xa4
ret
Function at 0x546360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd8
or eax, 0xffffffff
mov ecx, 0x170095
push ebx
push edi
mov edi, 0x170094
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0xac], ecx
mov dword [esp + 0xc4], ecx
mov ecx, 0x6c0029
mov dword [esp + 0x2c], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0xbc], edi
mov edi, dword [esi + 0x38]
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], ecx
mov dword [esp + 0xdc], ecx
xor ecx, ecx
mov edx, 0x17008b
test edi, edi
sete cl
mov ebx, 0x17008f
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x88], edx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xb8], edx
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx*2]
test ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xa8], ebx
mov ebx, 0x17008a
lea edi, [ecx + ecx*2]
mov dword [esp + 8], 0x170097
mov dword [esp + 0xc], 0x170091
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd8], eax
lea edi, [esp + edi*8 + 8]
jne 0x5464ed
mov ecx, dword [esi + 0x60]
mov cl, byte [ecx]
cmp cl, 2
jbe 0x5464e3
movzx edx, byte [edx + esi + 0x40]
movzx ebx, cl
dec ebx
cmp edx, ebx
je 0x5464e5
mov dword [edi], eax
cmp cl, 0x32
jb 0x5464ed
mov dword [edi + 4], eax
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x5464fb
lea edi, [esp + 0xc8]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
push eax
mov eax, dword [edi + 8]
push ecx
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi]
push eax
push ecx
push edx
call fcn.00862d90
add esp, 0x18
pop edi
pop ebx
add esp, 0xd8
ret
Function at 0x555dc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x1a
jmp 0x555dd0
mov byte [eax + 0xeb648d], 0xff
mov byte [eax + 0xeb6480], 0xff
mov byte [eax + 0xeb6482], 0xff
mov byte [eax + 0xeb6489], 0xff
mov byte [eax + 0xeb6481], 0xff
add eax, 0x1a
cmp eax, 0xd0
jb 0x555dd0
push ebx
xor ebx, ebx
push esi
push edi
mov byte [0xeb6482], bl
mov byte [0xeb6489], 1
mov byte [0xeb6481], bl
mov byte [0xeb6550], bl
mov byte [0xeb6551], 0xff
call fcn.006361c0
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x18]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xb
inc eax
mov ecx, eax
imul ecx, ecx, 0x4c0
lea edx, [eax + 0xb]
add ecx, 0xd92230
cmp eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
jae 0x555f04
lea eax, [ecx + 0x291]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + edi]
xor esi, esi
xor ecx, ecx
cmp edx, ebx
jbe 0x555eda
mov edi, dword [ebp - 0xc]
movzx edi, byte [edi + ecx]
cmp dword [ebp - 4], edi
jne 0x555e84
mov esi, 1
inc ecx
cmp ecx, edx
jb 0x555e73
xor ebx, ebx
cmp esi, 1
jne 0x555eda
mov byte [eax - 0x290], 1
mov byte [eax - 0x1b7], bl
mov word [eax - 0x1b5], bx
mov byte [eax], bl
mov byte [eax + 1], bl
mov dword [eax - 0xe1], ebx
mov dword [eax - 0xdd], ebx
mov dword [eax - 0xd9], ebx
mov word [eax + 0x7b], bx
mov word [eax + 0x7d], bx
mov dword [eax + 0x3f], ebx
mov dword [eax + 0x43], ebx
mov dword [eax + 0x47], ebx
mov dword [eax - 0x1b1], ebx
mov dword [eax - 0x1ad], ebx
jmp 0x555ee7
mov byte [eax - 0x290], bl
mov byte [eax - 0x1b7], 0xff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
add eax, 0x4c0
inc ecx
cmp ecx, edx
mov dword [ebp - 4], ecx
jb 0x555e64
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc esi
add ecx, 0xb
cmp esi, 2
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
jb 0x555e35
cmp dword [ebp + 0xc], 1
jne 0x555fbf
cmp byte [edi], bl
jbe 0x555fbf
mov eax, 0xfffffffe
sub eax, edi
lea esi, [edi + 2]
mov dword [ebp - 0x10], eax
lea esp, [esp]
mov al, byte [esi + 0x16]
cmp al, 0xff
je 0x555f54
movzx eax, al
cdq
mov ecx, 0x17
idiv ecx
jmp 0x555f59
mov edx, 1
imul edx, edx, 0x4c0
add edx, 0xd92230
mov dword [ebp + 0xc], edx
call fcn.00532640
test eax, eax
mov edx, dword [0x91cfa8]
push ebx
jne 0x555f93
mov al, byte [edx]
movzx edx, byte [esi]
cmp al, 0x41
sbb ecx, ecx
inc ecx
push ecx
movzx eax, al
push edx
push eax
push ebx
call fcn.00533ac0
add esp, 0x14
jmp 0x555fa4
movzx ecx, byte [esi]
movzx eax, byte [edx]
push ecx
push eax
push ebx
call fcn.00533b60
add esp, 0x10
call fcn.00555d10
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ecx + 0xd6], al
movzx eax, byte [edi]
inc esi
add edx, esi
cmp edx, eax
jb 0x555f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x571310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
mov al, byte [ebx + 0xd8]
movzx ecx, al
xor ecx, 1
imul ecx, ecx, 0x2970
mov edx, dword [ecx + 0xed5a7c]
push ebp
xor al, 1
push esi
push edi
push edx
push eax
call fcn.00616ca0
movzx esi, byte [ebx + 0xd8]
xor esi, 1
add esp, 8
imul esi, esi, 0xc5
mov ebp, eax
xor edi, edi
lea ecx, [ecx]
movzx eax, byte [edi + esi + 0xeda9e1]
cmp eax, ebp
jne 0x571383
movzx esi, byte [ebx + 0xd8]
xor esi, 1
imul esi, esi, 0xc5
call fcn.00616d20
movzx edx, byte [edi + esi + 0xeda9e3]
movzx ecx, al
add edx, 0xa
cmp edx, ecx
jg 0x571391
add edi, 0xc
cmp edi, 0x54
jl 0x571350
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebp
ret