joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dbe33
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa4
push ebx
push esi
push edi
mov edi, dword [0x401014]
lea eax, [ebp + 0x6c]
push eax
xor ebx, ebx
push 0x403a90
push 0x80000001
mov dword [ebp + 0x68], 0x1e
mov dword [ebp + 0x60], 0x50
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x6c], ebx
call edi
cmp eax, ebx
jne 0x5dbf1d
lea eax, [ebp + 0x70]
push eax
push 0x403a7c
push dword [ebp + 0x6c]
call edi
cmp eax, ebx
jne 0x5dbf1d
lea eax, [ebp + 0x74]
push eax
mov esi, 0x403a6c
push esi
push dword [ebp + 0x70]
call edi
cmp eax, 2
jne 0x5dbeb3
lea eax, [ebp + 0x74]
push eax
push esi
push dword [ebp + 0x70]
call dword [0x40101c]
cmp eax, ebx
jne 0x5dbf1d
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x64]
push eax
push ebx
push 0x40b68c
push dword [ebp + 0x74]
mov dword [ebp + 0x48], 1
call dword [0x401010]
cmp eax, ebx
jne 0x5dbf1d
cmp dword [ebp + 0x64], 4
jne 0x5dbfdc
cmp dword [ebp + 0x74], ebx
mov eax, dword [ebp - 0x2c]
mov edi, dword [fcn.0040100c]
mov dword [0x57ef1c], eax
je 0x5dbeff
push dword [ebp + 0x74]
call edi
cmp dword [ebp + 0x70], ebx
je 0x5dbf09
push dword [ebp + 0x70]
call edi
cmp dword [ebp + 0x6c], ebx
je 0x5dbf13
push dword [ebp + 0x6c]
call edi
mov eax, dword [0x57ef1c]
jmp 0x5dc01f
mov esi, dword [0x4010f4]
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
call esi
mov dword [ebp + 0x4c], eax
lea eax, [ebp + 0x24]
push eax
call dword [0x4010a8]
cmp dword [ebp + 0x3c], 0x182
jne 0x5dbf53
mov dword [ebp + 0x68], 0xa
jmp 0x5dbfd7
cmp dword [ebp + 0x3c], 0x1e6
jne 0x5dbf65
mov dword [ebp + 0x68], 0x1e
jmp 0x5dbfd7
push eax
push ebx
push ecx
push edx
pushfd
pop eax
mov ecx, eax
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
xor eax, ecx
je 0x5dbf84
lea edi, [ebp + 0x58]
rdtsc
mov dword [edi], eax
mov dword [edi + 4], edx
pop edx
pop ecx
pop ebx
pop eax
mov eax, dword [ebp + 0x58]
or eax, dword [ebp + 0x5c]
je 0x5dbfd5
mov ebx, 0x1f4
push ebx
call dword [0x4010fc]
lea edi, [ebp + 0x50]
rdtsc
mov dword [edi], eax
mov dword [edi + 4], edx
call esi
cmp eax, dword [ebp + 0x4c]
jne 0x5dbfb3
and dword [ebp + 0x4c], 0
mov eax, ebx
sub eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x50]
mov edx, dword [ebp + 0x54]
imul eax, eax, 0x3e8
sub ecx, dword [ebp + 0x58]
push 0
sbb edx, dword [ebp + 0x5c]
push eax
push edx
push ecx
call fcn.005d0180
mov dword [ebp + 0x68], eax
xor ebx, ebx
cmp dword [ebp + 0x48], ebx
je 0x5dbff3
push 4
lea eax, [ebp + 0x68]
push eax
push 4
push ebx
push 0x40b68c
push dword [ebp + 0x74]
call dword [0x401018]
cmp dword [ebp + 0x74], ebx
mov edi, dword [fcn.0040100c]
je 0x5dc003
push dword [ebp + 0x74]
call edi
cmp dword [ebp + 0x70], ebx
je 0x5dc00d
push dword [ebp + 0x70]
call edi
cmp dword [ebp + 0x6c], ebx
je 0x5dc017
push dword [ebp + 0x6c]
call edi
mov eax, dword [ebp + 0x68]
mov dword [0x57ef1c], eax
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x5e351b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
push 8
pop edx
mov bl, byte [eax]
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [ecx], bl
mov bl, byte [eax + 2]
mov byte [edi], bl
mov bl, byte [eax + 3]
mov byte [ecx + 1], bl
mov bl, byte [eax + 4]
mov byte [esi + 1], bl
mov bl, byte [eax + 5]
mov byte [ecx + 2], bl
mov bl, byte [eax + 6]
mov byte [edi + 1], bl
mov bl, byte [eax + 7]
mov byte [ecx + 3], bl
mov bl, byte [eax + 8]
mov byte [esi + 2], bl
mov bl, byte [eax + 9]
mov byte [ecx + 4], bl
mov bl, byte [eax + 0xa]
mov byte [edi + 2], bl
mov bl, byte [eax + 0xb]
mov byte [ecx + 5], bl
mov bl, byte [eax + 0xc]
mov byte [esi + 3], bl
mov bl, byte [eax + 0xd]
mov byte [ecx + 6], bl
mov bl, byte [eax + 0xe]
mov byte [edi + 3], bl
mov bl, byte [eax + 0xf]
mov byte [ecx + 7], bl
mov bl, byte [eax + 0x10]
mov byte [esi + 4], bl
mov bl, byte [eax + 0x11]
mov byte [ecx + 8], bl
mov bl, byte [eax + 0x12]
mov byte [edi + 4], bl
mov bl, byte [eax + 0x13]
mov byte [ecx + 9], bl
mov bl, byte [eax + 0x14]
mov byte [esi + 5], bl
mov bl, byte [eax + 0x15]
mov byte [ecx + 0xa], bl
mov bl, byte [eax + 0x16]
mov byte [edi + 5], bl
mov bl, byte [eax + 0x17]
mov byte [ecx + 0xb], bl
mov bl, byte [eax + 0x18]
mov byte [esi + 6], bl
mov bl, byte [eax + 0x19]
mov byte [ecx + 0xc], bl
mov bl, byte [eax + 0x1a]
mov byte [edi + 6], bl
mov bl, byte [eax + 0x1b]
mov byte [ecx + 0xd], bl
mov bl, byte [eax + 0x1c]
mov byte [esi + 7], bl
mov bl, byte [eax + 0x1d]
mov byte [ecx + 0xe], bl
mov bl, byte [eax + 0x1e]
mov byte [edi + 7], bl
mov bl, byte [eax + 0x1f]
mov byte [ecx + 0xf], bl
add esi, 8
add edi, 8
add eax, dword [ebp + 0x10]
mov bl, byte [eax + 1]
mov byte [ecx + 0x10], bl
mov bl, byte [eax + 3]
mov byte [ecx + 0x11], bl
mov bl, byte [eax + 5]
mov byte [ecx + 0x12], bl
mov bl, byte [eax + 7]
mov byte [ecx + 0x13], bl
mov bl, byte [eax + 9]
mov byte [ecx + 0x14], bl
mov bl, byte [eax + 0xb]
mov byte [ecx + 0x15], bl
mov bl, byte [eax + 0xd]
mov byte [ecx + 0x16], bl
mov bl, byte [eax + 0xf]
mov byte [ecx + 0x17], bl
mov bl, byte [eax + 0x11]
mov byte [ecx + 0x18], bl
mov bl, byte [eax + 0x13]
mov byte [ecx + 0x19], bl
mov bl, byte [eax + 0x15]
mov byte [ecx + 0x1a], bl
mov bl, byte [eax + 0x17]
mov byte [ecx + 0x1b], bl
mov bl, byte [eax + 0x19]
mov byte [ecx + 0x1c], bl
mov bl, byte [eax + 0x1b]
mov byte [ecx + 0x1d], bl
mov bl, byte [eax + 0x1d]
mov byte [ecx + 0x1e], bl
mov bl, byte [eax + 0x1f]
add eax, dword [ebp + 0x10]
mov byte [ecx + 0x1f], bl
add ecx, 0x20
dec edx
jne 0x5e3530
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x5e3669
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
push 8
pop edx
mov bl, byte [eax]
mov byte [ecx], bl
mov bl, byte [eax + 1]
mov byte [esi], bl
mov bl, byte [eax + 2]
mov byte [ecx + 1], bl
mov bl, byte [eax + 3]
mov byte [edi], bl
mov bl, byte [eax + 4]
mov byte [ecx + 2], bl
mov bl, byte [eax + 5]
mov byte [esi + 1], bl
mov bl, byte [eax + 6]
mov byte [ecx + 3], bl
mov bl, byte [eax + 7]
mov byte [edi + 1], bl
mov bl, byte [eax + 8]
mov byte [ecx + 4], bl
mov bl, byte [eax + 9]
mov byte [esi + 2], bl
mov bl, byte [eax + 0xa]
mov byte [ecx + 5], bl
mov bl, byte [eax + 0xb]
mov byte [edi + 2], bl
mov bl, byte [eax + 0xc]
mov byte [ecx + 6], bl
mov bl, byte [eax + 0xd]
mov byte [esi + 3], bl
mov bl, byte [eax + 0xe]
mov byte [ecx + 7], bl
mov bl, byte [eax + 0xf]
mov byte [edi + 3], bl
mov bl, byte [eax + 0x10]
mov byte [ecx + 8], bl
mov bl, byte [eax + 0x11]
mov byte [esi + 4], bl
mov bl, byte [eax + 0x12]
mov byte [ecx + 9], bl
mov bl, byte [eax + 0x13]
mov byte [edi + 4], bl
mov bl, byte [eax + 0x14]
mov byte [ecx + 0xa], bl
mov bl, byte [eax + 0x15]
mov byte [esi + 5], bl
mov bl, byte [eax + 0x16]
mov byte [ecx + 0xb], bl
mov bl, byte [eax + 0x17]
mov byte [edi + 5], bl
mov bl, byte [eax + 0x18]
mov byte [ecx + 0xc], bl
mov bl, byte [eax + 0x19]
mov byte [esi + 6], bl
mov bl, byte [eax + 0x1a]
mov byte [ecx + 0xd], bl
mov bl, byte [eax + 0x1b]
mov byte [edi + 6], bl
mov bl, byte [eax + 0x1c]
mov byte [ecx + 0xe], bl
mov bl, byte [eax + 0x1d]
mov byte [esi + 7], bl
mov bl, byte [eax + 0x1e]
mov byte [ecx + 0xf], bl
mov bl, byte [eax + 0x1f]
mov byte [edi + 7], bl
add esi, 8
add edi, 8
add eax, dword [ebp + 0x10]
mov bl, byte [eax]
mov byte [ecx + 0x10], bl
mov bl, byte [eax + 2]
mov byte [ecx + 0x11], bl
mov bl, byte [eax + 4]
mov byte [ecx + 0x12], bl
mov bl, byte [eax + 6]
mov byte [ecx + 0x13], bl
mov bl, byte [eax + 8]
mov byte [ecx + 0x14], bl
mov bl, byte [eax + 0xa]
mov byte [ecx + 0x15], bl
mov bl, byte [eax + 0xc]
mov byte [ecx + 0x16], bl
mov bl, byte [eax + 0xe]
mov byte [ecx + 0x17], bl
mov bl, byte [eax + 0x10]
mov byte [ecx + 0x18], bl
mov bl, byte [eax + 0x12]
mov byte [ecx + 0x19], bl
mov bl, byte [eax + 0x14]
mov byte [ecx + 0x1a], bl
mov bl, byte [eax + 0x16]
mov byte [ecx + 0x1b], bl
mov bl, byte [eax + 0x18]
mov byte [ecx + 0x1c], bl
mov bl, byte [eax + 0x1a]
mov byte [ecx + 0x1d], bl
mov bl, byte [eax + 0x1c]
mov byte [ecx + 0x1e], bl
mov bl, byte [eax + 0x1e]
add eax, dword [ebp + 0x10]
mov byte [ecx + 0x1f], bl
add ecx, 0x20
dec edx
jne 0x5e367e
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x5e37b6
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
push 8
pop edx
mov bl, byte [eax]
mov byte [ecx], bl
mov bl, byte [eax + 1]
mov byte [edi], bl
mov bl, byte [eax + 2]
mov byte [ecx + 1], bl
mov bl, byte [eax + 3]
mov byte [esi], bl
mov bl, byte [eax + 4]
mov byte [ecx + 2], bl
mov bl, byte [eax + 5]
mov byte [edi + 1], bl
mov bl, byte [eax + 6]
mov byte [ecx + 3], bl
mov bl, byte [eax + 7]
mov byte [esi + 1], bl
mov bl, byte [eax + 8]
mov byte [ecx + 4], bl
mov bl, byte [eax + 9]
mov byte [edi + 2], bl
mov bl, byte [eax + 0xa]
mov byte [ecx + 5], bl
mov bl, byte [eax + 0xb]
mov byte [esi + 2], bl
mov bl, byte [eax + 0xc]
mov byte [ecx + 6], bl
mov bl, byte [eax + 0xd]
mov byte [edi + 3], bl
mov bl, byte [eax + 0xe]
mov byte [ecx + 7], bl
mov bl, byte [eax + 0xf]
mov byte [esi + 3], bl
mov bl, byte [eax + 0x10]
mov byte [ecx + 8], bl
mov bl, byte [eax + 0x11]
mov byte [edi + 4], bl
mov bl, byte [eax + 0x12]
mov byte [ecx + 9], bl
mov bl, byte [eax + 0x13]
mov byte [esi + 4], bl
mov bl, byte [eax + 0x14]
mov byte [ecx + 0xa], bl
mov bl, byte [eax + 0x15]
mov byte [edi + 5], bl
mov bl, byte [eax + 0x16]
mov byte [ecx + 0xb], bl
mov bl, byte [eax + 0x17]
mov byte [esi + 5], bl
mov bl, byte [eax + 0x18]
mov byte [ecx + 0xc], bl
mov bl, byte [eax + 0x19]
mov byte [edi + 6], bl
mov bl, byte [eax + 0x1a]
mov byte [ecx + 0xd], bl
mov bl, byte [eax + 0x1b]
mov byte [esi + 6], bl
mov bl, byte [eax + 0x1c]
mov byte [ecx + 0xe], bl
mov bl, byte [eax + 0x1d]
mov byte [edi + 7], bl
mov bl, byte [eax + 0x1e]
mov byte [ecx + 0xf], bl
mov bl, byte [eax + 0x1f]
mov byte [esi + 7], bl
add esi, 8
add edi, 8
add eax, dword [ebp + 0x10]
mov bl, byte [eax]
mov byte [ecx + 0x10], bl
mov bl, byte [eax + 2]
mov byte [ecx + 0x11], bl
mov bl, byte [eax + 4]
mov byte [ecx + 0x12], bl
mov bl, byte [eax + 6]
mov byte [ecx + 0x13], bl
mov bl, byte [eax + 8]
mov byte [ecx + 0x14], bl
mov bl, byte [eax + 0xa]
mov byte [ecx + 0x15], bl
mov bl, byte [eax + 0xc]
mov byte [ecx + 0x16], bl
mov bl, byte [eax + 0xe]
mov byte [ecx + 0x17], bl
mov bl, byte [eax + 0x10]
mov byte [ecx + 0x18], bl
mov bl, byte [eax + 0x12]
mov byte [ecx + 0x19], bl
mov bl, byte [eax + 0x14]
mov byte [ecx + 0x1a], bl
mov bl, byte [eax + 0x16]
mov byte [ecx + 0x1b], bl
mov bl, byte [eax + 0x18]
mov byte [ecx + 0x1c], bl
mov bl, byte [eax + 0x1a]
mov byte [ecx + 0x1d], bl
mov bl, byte [eax + 0x1c]
mov byte [ecx + 0x1e], bl
mov bl, byte [eax + 0x1e]
add eax, dword [ebp + 0x10]
mov byte [ecx + 0x1f], bl
add ecx, 0x20
dec edx
jne 0x5e37cb
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x5e3a39
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 8
mov dl, 0xfe
mov bl, byte [eax]
mov byte [esi], bl
mov bl, byte [eax + 1]
and bl, dl
mov byte [ecx], bl
mov bl, byte [eax + 2]
mov byte [edi], bl
mov bl, byte [eax + 3]
and bl, dl
mov byte [ecx + 1], bl
mov bl, byte [eax + 4]
mov byte [esi + 1], bl
mov bl, byte [eax + 5]
and bl, dl
mov byte [ecx + 2], bl
mov bl, byte [eax + 6]
mov byte [edi + 1], bl
mov bl, byte [eax + 7]
and bl, dl
mov byte [ecx + 3], bl
mov bl, byte [eax + 8]
mov byte [esi + 2], bl
mov bl, byte [eax + 9]
and bl, dl
mov byte [ecx + 4], bl
mov bl, byte [eax + 0xa]
mov byte [edi + 2], bl
mov bl, byte [eax + 0xb]
and bl, dl
mov byte [ecx + 5], bl
mov bl, byte [eax + 0xc]
mov byte [esi + 3], bl
mov bl, byte [eax + 0xd]
and bl, dl
mov byte [ecx + 6], bl
mov bl, byte [eax + 0xe]
mov byte [edi + 3], bl
mov bl, byte [eax + 0xf]
and bl, dl
mov byte [ecx + 7], bl
mov bl, byte [eax + 0x10]
mov byte [esi + 4], bl
mov bl, byte [eax + 0x11]
and bl, dl
mov byte [ecx + 8], bl
mov bl, byte [eax + 0x12]
mov byte [edi + 4], bl
mov bl, byte [eax + 0x13]
and bl, dl
mov byte [ecx + 9], bl
mov bl, byte [eax + 0x14]
mov byte [esi + 5], bl
mov bl, byte [eax + 0x15]
and bl, dl
mov byte [ecx + 0xa], bl
mov bl, byte [eax + 0x16]
mov byte [edi + 5], bl
mov bl, byte [eax + 0x17]
and bl, dl
mov byte [ecx + 0xb], bl
mov bl, byte [eax + 0x18]
mov byte [esi + 6], bl
mov bl, byte [eax + 0x19]
and bl, dl
mov byte [ecx + 0xc], bl
mov bl, byte [eax + 0x1a]
mov byte [edi + 6], bl
mov bl, byte [eax + 0x1b]
and bl, dl
mov byte [ecx + 0xd], bl
mov bl, byte [eax + 0x1c]
mov byte [esi + 7], bl
mov bl, byte [eax + 0x1d]
and bl, dl
mov byte [ecx + 0xe], bl
mov bl, byte [eax + 0x1e]
mov byte [edi + 7], bl
mov bl, byte [eax + 0x1f]
and bl, dl
mov byte [ecx + 0xf], bl
add esi, 8
add eax, dword [ebp + 0x10]
add edi, 8
mov bl, byte [eax + 1]
and bl, dl
mov byte [ecx + 0x10], bl
mov bl, byte [eax + 3]
and bl, dl
mov byte [ecx + 0x11], bl
mov bl, byte [eax + 5]
and bl, dl
mov byte [ecx + 0x12], bl
mov bl, byte [eax + 7]
and bl, dl
mov byte [ecx + 0x13], bl
mov bl, byte [eax + 9]
and bl, dl
mov byte [ecx + 0x14], bl
mov bl, byte [eax + 0xb]
and bl, dl
mov byte [ecx + 0x15], bl
mov bl, byte [eax + 0xd]
and bl, dl
mov byte [ecx + 0x16], bl
mov bl, byte [eax + 0xf]
and bl, dl
mov byte [ecx + 0x17], bl
mov bl, byte [eax + 0x11]
and bl, dl
mov byte [ecx + 0x18], bl
mov bl, byte [eax + 0x13]
and bl, dl
mov byte [ecx + 0x19], bl
mov bl, byte [eax + 0x15]
and bl, dl
mov byte [ecx + 0x1a], bl
mov bl, byte [eax + 0x17]
and bl, dl
mov byte [ecx + 0x1b], bl
mov bl, byte [eax + 0x19]
and bl, dl
mov byte [ecx + 0x1c], bl
mov bl, byte [eax + 0x1b]
and bl, dl
mov byte [ecx + 0x1d], bl
mov bl, byte [eax + 0x1d]
and bl, dl
mov byte [ecx + 0x1e], bl
mov bl, byte [eax + 0x1f]
add eax, dword [ebp + 0x10]
and bl, dl
mov byte [ecx + 0x1f], bl
add ecx, 0x20
dec dword [ebp - 4]
jne 0x5e3a55
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x5f49cb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov esi, ecx
je 0x5f4b41
cmp dword [ebp + 0xc], edi
je 0x5f4b41
cmp dword [ebp + 0x10], edi
je 0x5f4b41
cmp dword [ebp + 0x14], edi
je 0x5f4b41
cmp dword [ebp + 0x18], edi
je 0x5f4b41
cmp dword [ebp + 0x1c], edi
je 0x5f4b41
cmp dword [ebp + 0x20], edi
je 0x5f4b41
cmp dword [ebp + 0x24], edi
je 0x5f4b41
cmp dword [ebp + 0x28], edi
je 0x5f4b41
push 0x58
call fcn.005d0531
cmp eax, edi
pop ecx
je 0x5f4a67
fld qword [0x40b990]
push ecx
push ecx
fstp qword [esp]
push dword [ebp + 0x30]
mov ecx, eax
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005f460c
jmp 0x5f4a69
xor eax, eax
cmp eax, edi
mov dword [esi + 0x10], eax
jne 0x5f4a82
push 0x40b978
call fcn.005fdc7b
pop ecx
push 1
call fcn.005d13f2
mov ebx, dword [ebp + 0x38]
mov edi, dword [ebp + 0x34]
push ebx
push edi
mov ecx, eax
call fcn.005f4865
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
imul ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0x14]
imul ecx, dword [eax + 0x10]
mov eax, dword [ebp + 0x2c]
lea eax, [eax + edi - 1]
cdq
idiv edi
mov dword [esi + 0xc], ecx
mov ecx, eax
mov eax, dword [ebp + 0x30]
lea eax, [eax + ebx - 1]
cdq
idiv ebx
imul ecx, eax
mov dword [esi + 4], ecx
imul ecx, ecx, 0x70
push ecx
call fcn.005d0531
pop ecx
xor ecx, ecx
mov dword [esi], eax
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0x1c], ecx
jmp 0x5f4b3a
mov eax, dword [ebp + 0x38]
cmp dword [ebp + 0x30], eax
jge 0x5f4ae4
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x18], eax
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
cmp ebx, ecx
mov dword [ebp + 0x28], ecx
jle 0x5f4b31
mov eax, dword [ebp + 0x24]
imul eax, eax, 0x70
mov dword [ebp + 0x20], eax
jmp 0x5f4b01
mov eax, dword [ebp + 0x20]
cmp ebx, edi
mov ecx, edi
jge 0x5f4b09
mov ecx, ebx
push dword [ebp + 0x18]
push ecx
push dword [ebp + 0x1c]
mov ecx, dword [esi]
push dword [ebp + 0x28]
add ecx, eax
push dword [esi + 0x10]
call fcn.005f41b6
add dword [ebp + 0x28], edi
add dword [ebp + 0x20], 0x70
sub ebx, edi
inc dword [ebp + 0x24]
test ebx, ebx
jg 0x5f4afe
xor ecx, ecx
mov eax, dword [ebp + 0x38]
sub dword [ebp + 0x30], eax
add dword [ebp + 0x1c], eax
cmp dword [ebp + 0x30], ecx
jg 0x5f4ad9
jmp 0x5f4b4c
push 0x40b960
call fcn.005fdc7b
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x34
Function at 0x6d0cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movq mm4, qword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea esi, [edx + edx*2]
add ecx, 0x20
mov ebx, dword [eax]
movd mm1, ebx
mov ebx, dword [eax + edx]
movq mm2, mm1
movd mm1, ebx
mov ebx, dword [eax + edx*2]
movq mm0, mm4
pxor mm0, mm4
punpcklbw mm2, mm0
movq mm3, mm1
punpcklbw mm3, mm0
movd mm1, ebx
add eax, esi
mov ebx, dword [eax + edx*4]
movq mm4, mm1
punpcklbw mm4, mm0
movd mm1, ebx
mov ebx, dword [esi + eax]
movq mm5, mm1
punpcklbw mm5, mm0
movq mm1, mm2
movd mm6, ebx
mov ebx, dword [eax + edx*2]
psubw mm1, mm5
punpcklbw mm6, mm0
paddw mm2, mm5
movq mm5, mm3
psubw mm5, mm6
paddw mm3, mm6
movd mm6, ebx
mov ebx, dword [eax]
punpcklbw mm6, mm0
movq qword [esp + 0x18], mm6
movq mm7, mm4
paddw mm4, mm6
movq qword [esp + 0x10], mm4
movd mm4, ebx
mov ebx, dword [eax + edx]
movq mm6, mm4
punpcklbw mm6, mm0
psubw mm7, qword [esp + 0x18]
movq mm4, mm7
movd mm7, ebx
punpcklbw mm7, mm0
movq mm0, mm6
paddw mm6, mm7
psubw mm0, mm7
movq qword [esp + 0x20], mm6
movq qword [esp + 0x18], mm0
movq mm7, mm2
psubw mm2, mm6
movq mm0, mm2
movq mm6, qword [esp + 0x10]
movq mm2, mm3
paddw mm2, mm6
psubw mm3, mm6
paddw mm3, mm0
movq mm6, mm3
movq qword [esp + 0x10], mm2
paddw mm7, qword [esp + 0x20]
movq mm3, mm7
movq mm7, qword [0x10062d20]
psllw mm6, 2
pmulhw mm6, mm7
movq qword [esp + 0x20], mm6
paddw mm2, mm3
psubw mm3, qword [esp + 0x10]
movq mm7, mm3
movq mm6, mm0
movq mm3, mm2
punpcklwd mm2, mm7
movq qword [esp + 0x10], mm2
paddw mm0, qword [esp + 0x20]
punpckhwd mm3, mm7
movq mm2, mm3
psubw mm6, qword [esp + 0x20]
movq mm3, mm0
punpcklwd mm0, mm6
punpckhwd mm3, mm6
movq mm6, mm0
punpckldq mm0, dword [esp + 0x10]
movq qword [esp + 0x20], mm0
movq mm0, qword [esp + 0x20]
movq mm7, qword [esp + 0x18]
movq qword [ecx - 0x20], mm0
paddw mm7, mm4
punpckhdq mm6, qword [esp + 0x10]
movq mm0, mm3
punpckldq mm0, mm2
punpckhdq mm3, mm2
movq qword [ecx], mm0
movq qword [ecx + 0x10], mm3
movq qword [ecx - 0x10], mm6
psllw mm7, 2
movq mm0, mm7
movq mm2, qword [0x10062d20]
paddw mm4, mm5
psllw mm4, 2
pmulhw mm4, mm2
paddw mm5, mm1
psllw mm5, 2
movq mm2, mm5
movq mm3, qword [0x10062d18]
movq mm5, mm0
pmulhw mm5, mm3
movq mm3, mm5
movq mm5, qword [0x10062d10]
psubw mm0, mm2
pmulhw mm0, mm5
movq mm6, mm0
movq mm0, mm1
psubw mm0, mm4
paddw mm1, mm4
movq mm4, mm0
paddw mm3, mm6
movq mm5, mm1
paddw mm0, mm3
psubw mm4, mm3
movq mm3, mm0
movq mm7, qword [0x10062d28]
pmulhw mm2, mm7
paddw mm2, mm6
movq mm6, mm2
punpcklwd mm0, mm4
paddw mm1, mm6
punpckhwd mm3, mm4
movq mm2, mm3
psubw mm5, mm6
movq mm3, mm1
punpcklwd mm1, mm5
punpckhwd mm3, mm5
movq mm4, mm0
punpckldq mm0, mm1
movq qword [ecx - 0x18], mm0
punpckhdq mm4, mm1
movq mm0, mm2
punpckldq mm0, mm3
mov ebx, 4
sub ebx, esi
punpckhdq mm2, mm3
movq qword [ecx - 8], mm4
movq qword [ecx + 8], mm0
movq qword [ecx + 0x18], mm2
add eax, ebx
add ecx, 0x40
dec edi
jne 0x6d0cf3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x70eb2b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x70eb59
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x70eb60
cmp ebx, dword [eax + 4]
jae 0x70eb60
xor eax, eax
jmp 0x70ed50
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x70eb71
xor eax, eax
inc eax
jmp 0x70ed4f
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x70eb87
cmp ecx, edx
jae 0x70eccc
cmp dword [eax + 4], 0
je 0x70eb90
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x70eb78
cmp dword [ebp + 8], 0
je 0x70ebb2
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x70eccc
cmp eax, esi
jae 0x70eccc
mov eax, dword [0x10090f80]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x70ebd7
cmp dword [esi*4 + 0x10090f88], edi
je 0x70ecd0
inc esi
cmp esi, eax
jl 0x70ebc5
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x1005e080]
test eax, eax
je 0x70ed4c
cmp dword [ebp - 8], 0x1000000
jne 0x70ed4c
test byte [ebp - 0xc], 0xcc
je 0x70ec55
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x70ed4c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x70ed4c
cmp word [eax + 0x18], 0x10b
jne 0x70ed4c
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x70ed4c
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x70ec55
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x70ec55
test byte [ecx + 0x27], 0x80
jne 0x70eccc
push 1
push 0x10090fc8
call dword [0x1005e07c]
test eax, eax
jne 0x70eb69
mov ecx, dword [0x10090f80]
test ecx, ecx
mov edx, ecx
jle 0x70ec89
lea eax, [ecx*4 + 0x10090f84]
cmp dword [eax], edi
je 0x70ec89
dec edx
sub eax, 4
test edx, edx
jg 0x70ec7d
test edx, edx
jne 0x70ecba
push 0xf
pop ebx
cmp ecx, ebx
jg 0x70ec96
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x70ecae
lea eax, [edx*4 + 0x10090f88]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x70ec9c
cmp ecx, 0x10
jge 0x70ecba
inc ecx
mov dword [0x10090f80], ecx
push 0
push 0x10090fc8
call dword [0x1005e07c]
jmp 0x70eb69
xor eax, eax
jmp 0x70ed4f
test esi, esi
jle 0x70eb69
mov ebx, dword [0x1005e07c]
push 1
push 0x10090fc8
call ebx
test eax, eax
jne 0x70eb69
cmp dword [esi*4 + 0x10090f88], edi
je 0x70ed26
mov eax, dword [0x10090f80]
lea esi, [eax - 1]
test esi, esi
jl 0x70ed14
cmp dword [esi*4 + 0x10090f88], edi
je 0x70ed10
dec esi
jns 0x70ed04
test esi, esi
jge 0x70ed24
cmp eax, 0x10
jge 0x70ed1f
inc eax
mov dword [0x10090f80], eax
lea esi, [eax - 1]
jmp 0x70ed26
je 0x70ed3e
xor ecx, ecx
test esi, esi
jl 0x70ed3e
lea eax, [ecx*4 + 0x10090f88]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x70ed2c
push 0
push 0x10090fc8
call ebx
jmp 0x70eb69
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret