joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e040
Capabilities:
Get hostname

Disassembly:
sub esp, 0x20
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov esi, dword [esp + 0x2c]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
test byte [esi + 0x44], 1
jne 0x51e069
mov dword [esi], 0x100
cmp dword [esi + 0x38], ebx
jne 0x51e075
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], ebx
jne 0x51e081
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], ebx
jne 0x51e08d
mov dword [esi + 8], 3
push dword [esi + 0x84]
call fcn.00522350
add esp, 4
test eax, eax
jne 0x51e12a
test dword [esi], 0x200
je 0x51e0c2
pop edi
pop esi
mov eax, 0x1a
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472312
add esp, 0x20
ret
push 0x7f000001
mov dword [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.005207f0
add esp, 0x14
test eax, eax
jne 0x51e254
push eax
push dword [esp + 0x10]
push esi
call fcn.00520ff0
push dword [esp + 0x18]
mov ebx, eax
call fcn.00521d20
add esp, 0x10
test ebx, ebx
je 0x51e12a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472312
add esp, 0x20
ret
push ebp
cmp dword [esi + 0x28], edi
jne 0x51e1f7
mov ebp, 0x40
mov dword [esi + 0x28], edi
push ebp
mov dword [esp + 0x18], ebp
call dword [0x1341f50]
mov edi, eax
add esp, 4
test edi, edi
jne 0x51e166
lea eax, [ebp - 0x31]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472312
add esp, 0x20
ret
push ebp
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x51e19f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x51e1a3
mov eax, dword [esp + 0x14]
add ebp, ebp
add eax, eax
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [0x1341f54]
add esp, 8
test eax, eax
je 0x51e1c9
mov edi, eax
jmp 0x51e166
test eax, eax
je 0x51e1a6
mov byte [edi], 0
push 0x2e
push edi
call fcn.004f3560
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x51e1f7
push 4
call dword [0x1341f50]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
jne 0x51e1d0
mov ebx, 0xf
jmp 0x51e243
lea eax, [ebp + 1]
push eax
call fcn.00522a50
mov ecx, dword [esi + 0x24]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
jne 0x51e1f0
mov ebx, 0xf
jmp 0x51e243
mov dword [esi + 0x28], 1
cmp dword [esi + 0x30], 0
jne 0x51e204
mov dword [esi + 0x2c], 0
cmp dword [esi + 0x34], 0
jne 0x51e224
push 0x576ab4
call fcn.00522a50
add esp, 4
mov dword [esi + 0x34], eax
test eax, eax
mov ecx, 0xf
cmove ebx, ecx
test dword [esi + 0x44], 0x800000
jne 0x51e243
mov eax, 0xa
mov dword [esi + 0xd4], 0x1388
mov word [esi + 0xd0], ax
test edi, edi
je 0x51e251
push edi
call dword [0x1341f58]
add esp, 4
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00472312
add esp, 0x20
ret
Function at 0x521b60
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x521bcb
mov edi, dword [esp + 0xc]
test edi, edi
je 0x521bcb
push esi
push 0x14
call fcn.0051dc30
mov esi, eax
add esp, 4
test esi, esi
jne 0x521b8a
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebx
ret
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x521be0
push 0
push 0
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x521bc3
push esi
call dword [0x1341f58]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
pop edi
mov eax, 2
pop ebx
ret

Function at 0x522cb0
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
xor esi, esi
sub eax, 1
je 0x522da0
sub eax, 1
je 0x522cea
sub eax, 2
jne 0x522d24
push ebx
lea eax, [edi + 8]
push ebp
push eax
call fcn.00522ed0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
push dword [edi + 8]
push ebx
push 1
push ebp
call fcn.005012d1
add esp, 0x10
test eax, eax
je 0x522d24
nop dword [eax]
add esi, eax
cmp esi, ebx
je 0x522da7
push dword [edi + 8]
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + ebp]
push 1
push eax
call fcn.005012d1
add esp, 0x10
test eax, eax
jne 0x522d00
mov eax, dword [edi]
sub eax, 2
jne 0x522d36
push dword [edi + 8]
call fcn.004f651d
add esp, 4
mov eax, dword [edi + 4]
mov dword [edi + 0x210], 0
test al, 1
jne 0x522d52
mov dword [edi], 1
jmp 0x522cc0
test al, 2
jne 0x522d89
push 0x553d54
push 0x576c50
mov dword [edi], 2
call fcn.004f6490
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x522d89
push 0
push 4
push 0
push eax
call fcn.0054ca2e
add esp, 0x10
jmp 0x522cc0
lea eax, [edi + 8]
mov dword [edi], 4
push eax
call fcn.00522e40
add esp, 4
jmp 0x522cc0
push ebx
push ebp
call sub.ADVAPI32.dll_SystemFunction036
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5237c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push dword [esp + 0x20]
mov dword [esp + 0x18], 0
push dword [esp + 0x20]
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5237f8
cmp eax, 0xea
jne 0x523855
mov eax, dword [esp + 4]
test eax, eax
je 0x523855
inc eax
push eax
call dword [0x1341f50]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x523855
lea ecx, [esp + 4]
push ecx
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x523844
mov ecx, dword [esp + 4]
cmp ecx, 1
je 0x523844
mov eax, dword [esi]
pop esi
mov byte [ecx + eax], 0
mov eax, 1
pop ecx
ret
push dword [esi]
call dword [0x1341f58]
add esp, 4
mov dword [esi], 0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x525c20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
je 0x525d03
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x525d03
push esi
push edi
push 0x553d54
push eax
call fcn.004f6490
mov edi, eax
add esp, 8
test edi, edi
jne 0x525c6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
mov ecx, 1
cmp ecx, eax
pop edi
sbb esi, esi
and esi, 0xa
add esi, 4
mov eax, esi
pop esi
pop ebx
ret
push 2
push 0
push edi
call fcn.005016d7
add esp, 0xc
test eax, eax
je 0x525c92
push edi
mov esi, 0xe
call fcn.004f651d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00502427
mov esi, eax
add esp, 4
test esi, esi
js 0x525c7e
push 0
push 0
push edi
call fcn.005016d7
add esp, 0xc
test eax, eax
jne 0x525c7e
test esi, esi
je 0x525cf2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push ebx
call fcn.00525330
add esp, 8
test eax, eax
jne 0x525cde
push edi
lea esi, [eax + 0xf]
call fcn.004f651d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
push esi
push 1
push eax
call fcn.005012d1
add esp, 0x10
cmp eax, esi
jne 0x525c7e
add dword [ebx + 4], esi
xor esi, esi
push edi
call fcn.004f651d
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, 2
pop ebx
ret
Function at 0x526ea0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x224]
mov dword [esi], ecx
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x526ee0
push eax
call fcn.00522a50
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x526f15
cmp dword [esp + 0x220], 0
je 0x526f30
test ecx, ecx
je 0x526ef8
push ecx
call dword [0x1341f58]
add esp, 4
push 0x576e74
call fcn.00516549
push eax
call fcn.00522a50
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x527024
mov eax, 0xf
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472312
add esp, 0x214
ret
test ecx, ecx
jne 0x527024
push 0x104
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004f3400
add esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x576c74
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x526f8e
mov eax, 4
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472312
add esp, 0x214
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x114]
push eax
push 0
push 0
push 0x576e80
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x526fd5
mov eax, dword [0x576e90]
mov dword [ecx], eax
mov ax, word [0x576e94]
mov word [ecx + 4], ax
mov al, byte [0x576e96]
mov byte [ecx + 6], al
lea eax, [esp + 0xc]
push eax
call fcn.00522a50
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x527024
lea eax, [ecx + 0xf]
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00472312
add esp, 0x214
ret
mov dword [esi], ecx
xor eax, eax
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.00472312
add esp, 0x214
ret

Function at 0x529130
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 2
jne 0x52913e
lea ecx, [eax + 2]
jmp 0x529146
cmp eax, 0x17
jne 0x5291a9
lea ecx, [eax - 7]
push esi
sub eax, 2
je 0x529171
sub eax, 0x15
je 0x529161
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x529189
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00529040
jmp 0x52917f
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00528ce0
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x529198
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x529198
xor eax, eax
pop esi
ret
xor eax, eax
cmp esi, 0xffffffff
pop esi
setg al
lea eax, [eax*2 - 1]
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
ret
Function at 0x529e80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
movzx ecx, word [ebx]
mov eax, ecx
sub eax, 2
je 0x529ea2
sub eax, 0x15
je 0x529e98
xor eax, eax
pop ebx
ret
mov dword [esp + 0xc], 0x1c
jmp 0x529eaa
mov dword [esp + 0xc], 0x10
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x11
push 2
push ecx
push edi
call fcn.0052daf0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x529ee0
call fcn.0050176b
pop edi
pop esi
pop ebx
mov eax, dword [eax]
sub eax, 0x273f
neg eax
sbb eax, eax
ret
push dword [esp + 0x14]
push ebx
push esi
push edi
call fcn.0052d720
add esp, 0x10
cmp eax, 0xffffffff
jne 0x529f11
call fcn.0050176b
cmp dword [eax], 0x2714
je 0x529ee0
push esi
push edi
call fcn.0052d6e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push edi
test eax, eax
je 0x529f36
call fcn.0052d6e0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
call fcn.0052d6e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x52d720
Capabilities:
Connect socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52d74d
mov eax, dword [eax + 8]
test eax, eax
je 0x52d74d
push dword [ecx + 0xb8]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
add esp, 0x10
ret
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_connect]
ret
Function at 0x52db30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52db63
mov eax, dword [eax + 0xc]
test eax, eax
je 0x52db63
push dword [ecx + 0xb8]
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
ret

Function at 0x52db80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52dbb9
mov eax, dword [eax + 0xc]
test eax, eax
je 0x52dbb9
push dword [ecx + 0xb8]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
ret

Function at 0x52dbe0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x52dc22
mov edx, dword [eax + 0x10]
test edx, edx
je 0x52dc22
push dword [ecx + 0xb8]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 1
push eax
push dword [esp + 0x1c]
call edx
add esp, 0x10
add esp, 8
ret
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
ret
Function at 0x52dc40
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x24
mov eax, dword [0x13413f8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, dword [ebx + 0x88]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x52dc7c
cmp dword [eax], 0
je 0x52dc7c
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00472312
add esp, 0x24
ret
push ebp
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [esi + 0x1c], 0
lea eax, [esi + 0x1c]
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
jle 0x52dcc3
push 4
push eax
push 0x1001
push 0xffff
push edi
call ebp
cmp eax, 0xffffffff
je 0x52ddb9
cmp dword [esi + 0x20], 0
lea eax, [esi + 0x20]
jle 0x52dce5
push 4
push eax
push 0x1002
push 0xffff
push edi
call ebp
cmp eax, 0xffffffff
je 0x52ddb9
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x52dd17
cmp dword [esi + 0x68], 0
je 0x52dd17
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x14], ax
push dword [esi + 0x68]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
mov eax, 0x10
jmp 0x52dda8
cmp eax, 0x17
jne 0x52dd46
cmp dword [ebx + 0x5c], 0
jne 0x52dd46
lea eax, [esi + 0x6c]
mov edx, 0x576f00
mov dword [esp + 0x10], eax
mov ecx, eax
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x52dd77
add ecx, 4
add edx, 4
sub esi, 4
jae 0x52dd35
cmp dword [ebx + 4], 0x17
jne 0x52dd62
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x1b
push 0x29
push edi
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00472312
add esp, 0x24
ret
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
movups xmmword [esp + 0x14], xmm0
mov eax, 0x17
movq qword [esp + 0x24], xmm0
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x10]
movups xmm0, xmmword [eax]
mov eax, 0x1c
movups xmmword [esp + 0x1c], xmm0
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x52dd46
mov ecx, dword [esp + 0x30]
or eax, 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.00472312
add esp, 0x24
ret
Function at 0x52e680
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x52e6a6
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x52e694
pop edi
mov eax, edx
pop esi
ret

Function at 0x52e6b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x18]
test ebx, ebx
je 0x52e6e4
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
push eax
call fcn.005229b0
movzx eax, al
inc esi
xor eax, edi
add esp, 4
imul edi, eax, 0x1000193
cmp esi, ebx
jb 0x52e6c6
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x539660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov ecx, dword [esp + 0x44]
mov eax, ecx
mov edx, dword [esp + 0x30]
sub eax, edx
push ebx
mov dword [esp + 0x14], eax
mov ebx, ecx
mov eax, dword [esp + 0x44]
sub ebx, eax
inc eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
cmp eax, 1
jle 0x5397ac
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x3c]
sub eax, ebx
push esi
push edi
lea edi, [ebx + 4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], edi
mov esi, dword [eax + edi]
mov ebx, ecx
sub ebx, dword [esp + 0x10]
mov ecx, edx
mov eax, dword [eax + edi + 4]
sub ecx, ebx
mov dword [esp + 0x2c], eax
cmp ecx, dword [esp + 0x1c]
jb 0x539764
mov ebp, dword [edi]
and ecx, 0x1f
mov dword [esp + 0x24], ebp
mov ebp, 1
mov dword [esp + 0x50], ebp
shl dword [esp + 0x50], cl
mov ecx, dword [esp + 0x20]
add ecx, ebx
cmp ecx, ebp
cmovl ecx, ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x30], ecx
cmp esi, eax
je 0x539787
mov edi, dword [esp + 0x3c]
imul eax, ebx, 0x34
add eax, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
lea edi, [edi + eax*4]
nop dword [eax + eax]
movzx eax, byte [esi + ebp]
push eax
push dword [esp + 0x58]
push dword [esp + 0x50]
push ebp
push dword [esp + 0x28]
push ecx
push dword [esp + 0x40]
push ebx
push edx
push edi
call fcn.00539a00
mov ecx, dword [esp + 0x78]
inc esi
mov edx, dword [esp + 0x68]
add esp, 0x28
lea eax, [ecx*4]
mov ecx, dword [esp + 0x30]
add edi, eax
cmp esi, dword [esp + 0x2c]
jne 0x539720
mov edi, dword [esp + 0x14]
jmp 0x539787
mov ecx, dword [esp + 0x3c]
add eax, ebp
push 1
push 0
push edx
push ebx
push eax
lea eax, [esi + ebp]
push eax
mov eax, dword [edi]
lea eax, [ecx + eax*4]
push eax
call fcn.005397c0
mov edx, dword [esp + 0x5c]
add esp, 0x1c
mov eax, dword [esp + 0x10]
add edi, 4
mov ecx, dword [esp + 0x54]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], edi
jl 0x5396b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x53a3b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x24]
cmp ebp, 8
jb 0x53a470
mov ecx, ebp
shr ecx, 3
mov dword [esp + 0x10], ecx
cmp eax, 1
jne 0x53a3f9
movq xmm0, qword [esi]
movq qword [esp + 0x14], xmm0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x53a3fe
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push 0xc2b2ae3d
push 0x27d4eb4f
push ecx
push eax
call fcn.00472cf0
mov ecx, eax
add esi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00472cf0
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00472cf0
mov ebx, eax
mov edi, edx
mov eax, dword [esp + 0x30]
add ebx, 0xc2b2ae63
adc edi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x53a3e0
cmp ebp, 4
jb 0x53a4c3
push 0x9e3779b1
push 0x85ebca87
cmp eax, 1
mov eax, dword [esi]
push 0
push eax
add esi, 4
call fcn.00472cf0
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.00472cf0
mov ebx, eax
mov edi, edx
add ebx, 0x9e3779f9
adc edi, 0x165667b1
sub ebp, 4
test ebp, ebp
je 0x53a507
movzx eax, byte [esi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00472cf0
xor ebx, eax
lea esi, [esi + 1]
xor edi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, edi, 0xb
push 0x85ebca87
shld edi, ebx, 0xb
push edi
push eax
call fcn.00472cf0
mov ebx, eax
mov edi, edx
sub ebp, 1
jne 0x53a4c7
push 0xc2b2ae3d
xor ecx, ecx
mov esi, edi
push 0x27d4eb4f
xor ecx, edi
shr esi, 1
push ecx
xor esi, ebx
push esi
call fcn.00472cf0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00472cf0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x5434b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x74]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0x10], 0
mov dword [esp + 0x84], 0
lea eax, [edi + ecx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7c]
add eax, esi
mov dword [esp + 0x7c], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
push dword [eax + 0x6858]
mov ebx, dword [eax + 0x685c]
lea edx, [eax + 0x1808]
mov ebp, dword [eax + 0x6860]
push ecx
mov dword [esp + 0x28], edx
lea ecx, [eax + 0x1004]
lea edx, [eax + 0x1004]
mov dword [esp + 0x88], ebx
push edi
push ecx
mov dword [esp + 0x2c], edx
lea ecx, [eax + 0x1808]
mov edx, dword [eax + 0x6814]
add ebp, ebx
push ecx
push eax
mov dword [esp + 0x3c], edx
mov edx, dword [eax + 0x6818]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 0x681c]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x44], edx
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.00542c20
add esp, 0x24
cmp eax, 0xffffff88
ja 0x5436ef
lea edx, [eax + edi]
mov edi, dword [esp + 0x84]
test edi, edi
je 0x5436ad
mov ecx, dword [esp + 0x7c]
xorps xmm0, xmm0
mov eax, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x18]
sub eax, edx
movq qword [esp + 0x30], xmm0
push eax
push edx
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 1
push eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], 1
call fcn.005403f0
add esp, 0xc
cmp eax, 0xffffff88
jbe 0x5435e6
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
push dword [esp + 0x74]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00540f90
push dword [esp + 0x28]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00540f90
push dword [esp + 0x38]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.00540f90
lea eax, [esp + 0x60]
push eax
call fcn.005441c0
add esp, 0x28
cmp eax, 2
jg 0x5436a5
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x5436cf
lea eax, [esp + 0x3c]
dec edi
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00542f80
movq xmm0, qword [esp + 0x38]
lea eax, [esp + 0x88]
add esp, 8
push dword [esp + 0x28]
push dword [esp + 0x30]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x4c]
sub esp, 0xc
mov ecx, esp
push dword [esp + 0x34]
movq qword [ecx], xmm0
push esi
mov dword [ecx + 8], eax
call fcn.005439a0
add esp, 0x28
cmp eax, 0xffffff88
ja 0x5436ef
add esi, eax
lea eax, [esp + 0x3c]
push eax
call fcn.005441c0
add esp, 4
cmp eax, 2
jle 0x543635
mov ebx, dword [esp + 0x80]
test edi, edi
jne 0x5435d9
mov eax, ebp
sub eax, ebx
cmp ebx, ebp
ja 0x5435d9
lea edi, [eax + esi]
cmp edi, dword [esp + 0x14]
jbe 0x5436d8
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov ebx, dword [esp + 0x80]
jmp 0x5436ad
test eax, eax
je 0x5436e9
push eax
push ebx
push esi
call fcn.004f37d0
add esp, 0xc
mov esi, edi
sub esi, dword [esp + 0x78]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret