joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x5de00c]
xor eax, esp
mov dword [esp + 0x44], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
mov ecx, edx
push esi
push edi
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
lea esi, [ecx + 2]
mov dword [esp + 0x34], 0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f7380
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00403d10
cmp dword [esp + 0x34], 8
lea edi, [esp + 0x20]
mov esi, dword [esp + 0x20]
mov edx, 0x811c9dc5
mov eax, dword [esp + 0x30]
cmovae edi, esi
xor ecx, ecx
add eax, eax
je 0x4f73d5
mov esi, eax
nop dword [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4f73c0
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406250
mov edi, dword [eax + 4]
test edi, edi
jne 0x4f73f7
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x34]
cmp eax, 8
jb 0x4f7431
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x4f7427
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4f7427
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0052d747
add esp, 8
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp edi, dword [ecx + 4]
mov ecx, dword [esp + 0x4c]
pop edi
setne al
pop esi
xor ecx, esp
call fcn.0052d3c5
mov esp, ebp
pop ebp
ret 4
Function at 0x4f78c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x4f7a34
cmp dword [ecx + 0x1c], 8
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
jb 0x4f78fd
mov edx, dword [edx]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4f7921
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4f7910
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00403990
push 0x2c
push edi
call fcn.0052d747
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x4f7991
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x4f7940
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x4f7a28
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
jne 0x4f79a7
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x4f79ab
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x30]
cmp esi, eax
je 0x4f7a28
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4f79c4
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4f79e1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4f79d0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00403990
push 0x2c
push edi
call fcn.0052d747
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
je 0x4f7a3b
cmp esi, eax
jne 0x4f79f8
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4f79b6
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x4f7a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push ebp
lea ebp, [eax + 8]
mov dword [esp + 8], ecx
push esi
push edi
mov edi, ebp
jb 0x4f7a8e
mov edi, dword [ebp]
xor edx, edx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4f7ab1
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4f7aa0
mov ebx, dword [esp + 0x10]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4f7adf
cmp esi, eax
jne 0x4f7ad6
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4f7ae8
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4f7ae8
cmp esi, eax
jne 0x4f7aec
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
mov ecx, ebp
dec dword [ebx + 8]
mov edx, dword [eax + 4]
mov dword [edx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.00403990
push 0x2c
push dword [esp + 0x20]
call fcn.0052d747
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x51dad0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax + eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x51daf0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
ret 4
Function at 0x51e0f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
xorps xmm1, xmm1
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x51e142
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x51e105
mov eax, dword [esi]
jmp 0x51e225
cmp eax, 0x4e0
jb 0x51e225
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x51e160
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x51e1b0
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [esi + 0x1384]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
pop esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5c7480]
cvtpd2ps xmm0, xmm0
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x5c6e50]
ret
Function at 0x5232b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
cmp edi, 8
jl 0x52335f
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5bb900]
xor edx, dword [eax*4 + 0x5bb500]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x5bbd00]
movzx eax, byte [esi + 6]
xor edx, dword [eax*4 + 0x5ba500]
movzx eax, byte [esi + 5]
xor edx, dword [eax*4 + 0x5ba900]
movzx eax, byte [esi + 7]
xor edx, dword [eax*4 + 0x5ba100]
movzx eax, byte [esi + 4]
add esi, 8
xor edx, dword [eax*4 + 0x5bad00]
movzx eax, cl
xor edx, dword [eax*4 + 0x5bb100]
mov ecx, edx
sub ebx, 1
jne 0x5232d0
pop ebx
test edi, edi
je 0x52337f
movzx eax, byte [esi]
lea esi, [esi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
xor ecx, dword [edx*4 + 0x5ba100]
sub edi, 1
jne 0x523363
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x524ae0
Capabilities:
Hash data with md5

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00524a60
test eax, eax
je 0x524b46
mov eax, dword [esi + 4]
cmp dword [eax], 0
je 0x524b0f
mov edi, dword [esi]
lea ecx, [edi + 0x20]
call fcn.005298d0
cmp dword [edi + 0x20], 0
je 0x524b0f
mov dword [edi + 0x1b4], 1
mov eax, dword [esi + 4]
cmp dword [eax + 0xe2c], 0
jne 0x524b4b
push 0
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
cmp dword [edi + 0x34], eax
je 0x524b46
mov eax, dword [edi + 8]
test eax, eax
je 0x524b55
push dword [edi + 0x30]
push 0
push 0
push esi
call eax
add esp, 0x10
cmp eax, 1
jne 0x524b55
pop edi
xor eax, eax
pop esi
ret
mov dword [eax + 0xe2c], 0
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi + 4]
mov dword [eax + 0xf8], 0
mov eax, dword [esi + 4]
push dword [eax + 0x1c4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 0x1c4], 0
mov eax, dword [esi + 4]
pop edi
mov dword [eax + 0xfc], 0
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0x1c]
mov dword [ecx + 0xe28], eax
mov eax, dword [esi + 4]
mov dword [eax + 0xe8], 0
mov eax, dword [esi + 4]
mov dword [eax + 0xe4], 0
mov eax, dword [esi + 4]
mov dword [eax + 0xe74], 0x67452301
mov dword [eax + 0xe78], 0xefcdab89
mov dword [eax + 0xe7c], 0x98badcfe
mov dword [eax + 0xe80], 0x10325476
mov dword [eax + 0xe84], 0
mov dword [eax + 0xe88], 0
mov dword [eax + 0xe8c], 0
mov dword [eax + 0xe90], 0
mov eax, dword [esi + 4]
mov dword [eax + 0x17f8], 0
mov dword [eax + 0x17fc], 0
mov eax, dword [esi + 4]
pop esi
mov dword [eax + 0x1808], 0
mov eax, 1
ret
Function at 0x528af0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov ecx, dword [esi + 0x1c]
mov ebp, ecx
mov edi, dword [esi + 0x10]
cmp edi, ecx
jbe 0x528b69
mov edx, dword [esi + 0x20]
test edx, edx
je 0x528b71
mov eax, dword [esi]
lea ebp, [ecx + 1]
mov ebx, dword [esi + 0x18]
mov eax, dword [eax + ecx*4]
mov dword [esi + 0x1c], ebp
cmp edx, 0x20
jae 0x528b5f
mov esi, eax
mov ecx, 0x18
sub ecx, edx
cmp ecx, 0x20
jae 0x528b3a
mov eax, esi
shr eax, cl
movzx ecx, al
jmp 0x528b3c
xor ecx, ecx
mov eax, ebx
add edx, 8
shr eax, 8
xor eax, ecx
movzx ebx, bl
shl ebx, 8
movzx ecx, word [eax*2 + 0x5bc1e0]
xor ebx, ecx
cmp edx, 0x20
jb 0x528b25
mov esi, dword [esp + 0x14]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], 0
cmp edi, ebp
jbe 0x528c78
mov eax, dword [esi]
sub edi, ebp
movzx edx, word [esi + 0x18]
lea ebp, [eax + ebp*4]
mov dword [esp + 0x10], ebp
cmp edi, 2
jb 0x528c29
mov esi, dword [esp + 0x10]
mov ebp, edi
shr ebp, 1
mov ebx, dword [esi]
sub edi, 2
movzx eax, dx
mov edx, dword [esi + 4]
shr ebx, 0x10
xor ebx, eax
mov eax, dword [esi]
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
movzx eax, al
mov cx, word [ecx*2 + 0x5bcbe0]
xor cx, word [eax*2 + 0x5bc5e0]
mov eax, edx
shr eax, 8
movzx eax, al
xor cx, word [eax*2 + 0x5bc3e0]
mov eax, ebx
shr eax, 8
xor cx, word [eax*2 + 0x5bcfe0]
mov eax, edx
shr eax, 0x18
xor cx, word [eax*2 + 0x5bc7e0]
movzx eax, bl
xor cx, word [eax*2 + 0x5bcde0]
movzx eax, dl
xor cx, word [eax*2 + 0x5bc1e0]
mov eax, dword [esi]
add esi, 8
movzx eax, al
xor cx, word [eax*2 + 0x5bc9e0]
movzx edx, cx
sub ebp, 1
jne 0x528b91
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
test edi, edi
je 0x528c72
mov ebx, dword [ebp]
movzx eax, dx
shr ebx, 0x10
xor ebx, eax
mov eax, dword [ebp]
shr eax, 8
mov ecx, ebx
movzx eax, al
shr ecx, 8
mov dx, word [eax*2 + 0x5bc3e0]
xor dx, word [ecx*2 + 0x5bc7e0]
movzx eax, bl
xor dx, word [eax*2 + 0x5bc5e0]
mov eax, dword [ebp]
movzx eax, al
xor dx, word [eax*2 + 0x5bc1e0]
movzx edx, dx
movzx eax, dx
mov dword [esi + 0x18], eax
pop edi
mov dword [esi + 0x1c], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x52dff9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x52e038
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52e038
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52e038
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x52e038
cmp dword [ecx + 0x74], 0xe
jbe 0x52e038
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x535a20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x5de00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.005350c0
mov esi, eax
add esp, 8
test esi, esi
je 0x535a87
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov eax, 0x13
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052d3c5
mov esp, ebp
pop ebp
ret
push 0x5a50d0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x535ab8
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x535aba
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052d3c5
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.00535050
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x535b5b
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x535ae7
sub edx, eax
cmp edx, 0xc8
ja 0x535aa5
test esi, esi
je 0x535aa5
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x535b06
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00535050
mov esi, eax
add esp, 0xc
test esi, esi
je 0x535aa5
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x535aa5
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov eax, 3
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.0052d3c5
mov esp, ebp
pop ebp
ret
Function at 0x535ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [ebp + 8]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7301], 8
je 0x535cf3
nop
mov al, byte [ecx + 1]
inc ecx
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7301], 8
jne 0x535ce0
mov al, byte [ebp + 0xb]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x535d06
mov dword [ebp - 0xc], 1
jmp 0x535d0e
cmp al, 0x2b
mov dword [ebp - 0xc], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x535e44
mov al, byte [edx + 1]
cmp al, 0x78
je 0x535d26
cmp al, 0x58
jne 0x535e44
movsd xmm2, qword [0x5c7068]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov byte [ebp + 0xb], al
cmp ecx, dword [ebp - 0x10]
jne 0x535d4e
cmp dword [ebp - 4], 0
jne 0x535da0
mov dword [ebp - 4], 1
inc edx
jmp 0x535d31
movzx eax, al
test byte [eax + 0x5a7301], 0x10
je 0x535da0
test edi, edi
jne 0x535d69
cmp byte [ebp + 0xb], 0x30
jne 0x535d69
inc dword [ebp - 8]
jmp 0x535d96
inc edi
cmp edi, 0x1e
jg 0x535d95
test byte [ecx + 0x5a7301], 2
je 0x535d7d
add ecx, 0xffffffd0
jmp 0x535d83
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x535d96
inc esi
cmp dword [ebp - 4], 0
je 0x535d9d
dec esi
inc edx
jmp 0x535d31
mov eax, dword [ebp - 8]
add eax, edi
je 0x535e44
mov eax, dword [ebp + 0xc]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x535dbd
cmp al, 0x50
jne 0x535e1f
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [ebp + 0xb], al
cmp al, 0x2d
jne 0x535dd1
lea edi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x535ddd
xor eax, eax
xor edi, edi
cmp byte [ebp + 0xb], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7301], 2
je 0x535e44
movsx eax, byte [ebp + 0xb]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7301], 2
jne 0x535df0
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
cmp dword [ebp - 0xc], 0
je 0x535e2c
xorps xmm1, xmmword [0x5c74d0]
push esi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53a550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
xor eax, dword [ebp + 0x10]
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x53a58c
push ebx
mov ebx, dword [ebp + 8]
nop dword [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x53a570
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x53a590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx + 6], 0
jne 0x53a5ee
mov edx, dword [ebx + 8]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edi
shr esi, 5
xor edx, edi
inc esi
cmp edi, esi
jb 0x53a5de
lea eax, [ebx + 0xf]
add eax, edi
mov ebx, eax
nop dword [eax]
mov ecx, edx
mov eax, edx
shl ecx, 5
sub edi, esi
shr eax, 2
add ecx, eax
movzx eax, byte [ebx]
add ecx, eax
sub ebx, esi
xor edx, ecx
cmp edi, esi
jae 0x53a5c0
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov dword [ebx + 8], edx
mov eax, edx
mov byte [ebx + 6], 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53a8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
cmp ebx, 0x28
ja 0x53aa4d
mov eax, dword [ebp + 8]
mov esi, ebx
shr esi, 5
mov edx, ebx
inc esi
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x38]
xor edi, ebx
mov dword [ebp - 4], edi
cmp ebx, esi
jb 0x53a929
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [ebx + edx - 1]
mov eax, edi
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, edi
shr eax, 2
add ecx, eax
xor edi, ecx
cmp edx, esi
jae 0x53a905
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edi
mov edx, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
lea ecx, [edx - 1]
and ecx, edi
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp + 0x10], eax
test edi, edi
je 0x53a9ad
movzx eax, byte [edi + 7]
cmp ebx, eax
jne 0x53a9a3
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 0x10]
mov esi, ebx
sub esi, 4
jb 0x53a971
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x53a976
add ecx, 4
add edx, 4
sub esi, 4
jae 0x53a960
cmp esi, 0xfffffffc
je 0x53a9e0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x53a9a3
cmp esi, 0xfffffffd
je 0x53a9e0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x53a9a3
cmp esi, 0xfffffffe
je 0x53a9e0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x53a9a3
cmp esi, 0xffffffff
je 0x53a9e0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x53a9e0
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x53a944
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp dword [edi + 0x1c], edx
jl 0x53aa02
cmp edx, 0x3fffffff
jg 0x53aa02
lea eax, [edx + edx]
push eax
push dword [ebp + 8]
call fcn.0053ab30
mov ecx, dword [edi + 0x20]
add esp, 8
mov esi, dword [ebp - 4]
dec ecx
mov eax, dword [edi + 0x18]
and ecx, esi
lea eax, [eax + ecx*4]
mov dword [ebp + 0x10], eax
jmp 0x53aa05
mov eax, dword [ebp - 8]
mov cl, byte [edi + 5]
xor cl, 3
mov al, byte [eax + 0x3c]
xor al, 3
test cl, al
jne 0x53aa88
mov byte [edi + 5], cl
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
lea eax, [ebx + 0x11]
push eax
push 4
push dword [ebp + 8]
call fcn.00538a50
mov edi, eax
push ebx
push dword [ebp + 0xc]
lea eax, [edi + 0x10]
mov dword [edi + 8], esi
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov byte [edi + 7], bl
mov ecx, dword [eax]
mov dword [edi + 0xc], ecx
mov dword [eax], edi
mov eax, dword [ebp - 8]
inc dword [eax + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xffffffef
jae 0x53aa91
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov esi, dword [eax + 0x38]
lea eax, [ebx + 0x11]
push eax
push 0x14
push ecx
call fcn.00538a50
mov edi, eax
push ebx
push dword [ebp + 0xc]
lea ecx, [edi + 0x10]
mov dword [edi + 8], esi
mov byte [edi + 6], 0
mov byte [edi + ebx + 0x10], 0
push ecx
mov dword [edi + 0xc], ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call fcn.0053fbc0
int3
Function at 0x544440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.00531990
mov edi, dword [ebp + 0x10]
add esp, 4
sub eax, edi
je 0x544514
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.00532a90
add esp, 8
cmp eax, 3
jne 0x5444e4
push edi
push ebx
call fcn.00531ad0
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x5444a1
call fcn.00532890
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.00528ac0
add esp, 0x1c
jmp 0x5444bc
call fcn.00532980
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.00528ac0
add esp, 0x10
test esi, esi
je 0x5444c4
test eax, eax
jg 0x54450d
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x544463
test esi, esi
jne 0x544514
push esi
push esi
push ebx
call fcn.00533530
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.00533140
add esp, 0xc
test esi, esi
je 0x5444c4
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x5444c4
mov esi, 1
jmp 0x5444c6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret