joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502a44
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x502a6c
test dword [0x7eeab0], 0xffffffff
jne 0x502af4
call fcn.006a7fbc
jmp fcn.00502a44
push edi
push esi
push ebp
push esi
mov eax, edx
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea edx, [edi - 4]
movzx eax, ax
mov esi, eax
shr edx, 0x1f
lea edx, [edx + edi - 4]
sar edx, 1
test edx, edx
je 0x502ae4
mov dword [esp], ebx
mov edi, eax
shl edi, 8
movzx ebx, byte [ebp]
and eax, 0xffffff00
shr eax, 8
xor ebx, eax
movzx ebx, bl
movzx eax, word [ebx*2 + 0x6f0140]
xor edi, eax
movzx eax, di
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, esi
shl ebx, 8
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
movzx esi, word [edi*2 + 0x6f0140]
xor ebx, esi
movzx esi, bx
dec edx
jne 0x502a91
mov ebx, dword [esp]
shl eax, 0x10
add eax, esi
mov dword [ecx], eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
push edi
push esi
push ebp
push esi
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea esi, [edi - 4]
movzx eax, dx
mov edx, eax
shr esi, 0x1f
lea esi, [esi + edi - 4]
sar esi, 1
test esi, esi
je 0x502b6e
mov dword [esp], ebx
movzx edi, byte [ebp]
mov ebx, eax
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl eax, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor eax, ebx
movzx eax, ax
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, edx
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl edx, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor edx, ebx
movzx edx, dx
dec esi
jne 0x502b17
mov ebx, dword [esp]
shl eax, 0x10
add eax, edx
mov dword [ecx], eax
pop ecx
pop ebp
pop esi
pop edi
ret 4

Function at 0x502b7c
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x502ba4
test dword [0x7eeab0], 0xffffffff
jne 0x502c20
call fcn.006a7fbc
jmp fcn.00502b7c
push esi
push ebx
push esi
movzx eax, dx
mov ebx, eax
mov esi, dword [esp + 0x10]
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
test edx, edx
je 0x502c15
mov dword [esp], edi
mov edi, eax
shl edi, 8
movzx esi, byte [ecx]
and eax, 0xffffff00
shr eax, 8
xor esi, eax
and esi, 0xff
movzx eax, word [esi*2 + 0x6f0140]
xor edi, eax
movzx eax, di
movzx edi, byte [ecx + 1]
add ecx, 2
mov esi, ebx
shl esi, 8
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
movzx ebx, word [edi*2 + 0x6f0140]
xor esi, ebx
movzx ebx, si
dec edx
jne 0x502bc0
mov edi, dword [esp]
shl eax, 0x10
add eax, ebx
pop ecx
pop ebx
pop esi
ret 4
push esi
push ebx
push esi
movzx eax, dx
mov ebx, eax
mov esi, dword [esp + 0x10]
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
test edx, edx
je 0x502c92
mov dword [esp], edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
shl eax, 8
movzx esi, word [edi*2 + 0x6f0140]
xor eax, esi
movzx eax, ax
movzx edi, byte [ecx + 1]
add ecx, 2
mov esi, ebx
and esi, 0xffffff00
shr esi, 8
xor edi, esi
and edi, 0xff
shl ebx, 8
movzx esi, word [edi*2 + 0x6f0140]
xor ebx, esi
movzx ebx, bx
dec edx
jne 0x502c3c
mov edi, dword [esp]
shl eax, 0x10
add eax, ebx
pop ecx
pop ebx
pop esi
ret 4
Function at 0x52a78c
Capabilities:
Terminate process

Disassembly:
push edi
push ebp
push ebx
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x52a808
push dword [edi + 0x14]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x52a804
mov edx, dword [edi + 0x18]
test edx, edx
je 0x52a7c1
xor eax, eax
push eax
push eax
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [edi + 0xc]
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x52a7d6
mov ebx, 1
jmp 0x52a7ec
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x52a7ea
mov ebx, 1
jmp 0x52a7ec
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov eax, ebx
pop ebx
pop ebp
pop edi
ret
xor ebx, ebx
jmp 0x52a7fe
xor eax, eax
pop ebx
pop ebp
pop edi
ret

Function at 0x52a810
Capabilities:
Create process on windows

Disassembly:
push esi
push ecx
mov eax, 0x154
call fcn.006977b0
mov ecx, dword [esp + 0x154]
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x52a837
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
xor eax, eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x100], 0x44
mov dword [esp + 0x104], 0
mov dword [esp + 0x12c], 1
mov eax, dword [esp + 0x168]
test eax, eax
je 0x52a8ea
mov eax, dword [esp + 0x168]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x164]
cmp eax, 1
je 0x52a905
mov eax, 5
mov word [esp + 0x130], ax
jmp 0x52a90f
xor eax, eax
mov word [esp + 0x130], ax
xor eax, eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
lea eax, [esp]
push dword [esp + 0x160]
push dword [esi]
push str.__s___s
push eax
call fcn.00697936
add esp, 0x10
xor eax, eax
lea ecx, [esp + 0x100]
lea edx, [esp + 0x144]
push edx
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x52a97b
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
push dword [esi + 4]
push dword [esp + 0x148]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [esp + 0x154]
push eax
push dword [esp + 0x148]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x154]
cmp eax, 0x103
je 0x52a9d4
push dword [esp + 0x144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x158
pop esi
ret 0xc
mov edx, dword [esp + 0x144]
mov dword [esi + 0x10], edx
mov ecx, dword [esp + 0x14c]
mov dword [esi + 0x14], ecx
mov eax, 1
add esp, 0x158
pop esi
ret 0xc
Function at 0x52c8ac
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x52c8d4
test dword [0x7eeab0], 0xffffffff
jne 0x52c8d4
call fcn.006a7fbc
jmp fcn.0052c8ac
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov edi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [ecx], eax
mov dword [edx], eax
xor esi, esi
mov dword [esp], eax
mov dword [esp + 0xc], edi
lea edx, [esp + 8]
xor eax, eax
push eax
push eax
push edx
mov ecx, dword [esp + 0x18]
push dword [ecx + 0x10]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x52c9f6
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x52c996
inc ecx
call fcn.004dc288
mov ebp, eax
lea eax, [esp + 4]
push eax
push dword [esp + 0xc]
push ebp
mov edx, dword [esp + 0x18]
push dword [edx + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x52c9b9
cmp dword [esp + 4], 0
je 0x52c996
mov edi, esi
mov eax, dword [esp]
mov ebx, eax
add eax, dword [esp + 8]
mov dword [esp], eax
lea ecx, [eax + 1]
call fcn.004dc288
mov esi, eax
test edi, edi
je 0x52c973
push ebx
push edi
push esi
call fcn.006a8180
add esp, 0xc
add ebx, esi
push dword [esp + 8]
push ebp
push ebx
call fcn.006a8180
add esp, 0xc
mov ecx, edi
call fcn.004db958
mov ecx, ebp
call fcn.004db958
jmp 0x52c8fc
mov eax, dword [esp]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [ecx], esi
mov dword [edx], eax
test esi, esi
je 0x52c9ad
mov byte [esi + eax], 0
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, ebp
call fcn.004db958
mov ecx, esi
call fcn.004db958
mov eax, dword [edi + 0x4a]
test eax, eax
je 0x52ca2c
mov edx, dword [eax]
push str.Failed_to_Read_nHTTP_Response_
push eax
call dword [edx + 0x48]
add esp, 8
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, esi
call fcn.004db958
mov eax, dword [edi + 0x4a]
test eax, eax
je 0x52ca2c
mov edx, dword [eax]
push str.No_HTTP_Response_
push eax
call dword [edx + 0x48]
add esp, 8
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, 1
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8

Function at 0x52cd98
Capabilities:
Send data

Disassembly:
push ebp
push esi
mov ebp, ecx
lea eax, [esp]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x52cddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x4a]
test eax, eax
je 0x52cde2
mov edx, dword [eax]
push str.HTTP_Data_nPosting_failure_
push eax
call dword [edx + 0x48]
add esp, 8
pop ecx
pop ebp
ret 8
xor eax, eax
pop ecx
pop ebp
ret 8
mov eax, 1
pop ecx
pop ebp
ret 8
Function at 0x547a8c
Capabilities:
Initialize winsock library

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x1c8
call fcn.006977b0
mov ecx, dword [esp + 0x1c8]
mov ebx, ecx
mov edi, dword [esp + 0x1e0]
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
lea ebp, [ebx + 0xc]
mov ecx, ebp
mov edx, str._tallydata
call fcn.004f60bc
lea ecx, [esp + 0x190]
call fcn.00525978
cmp dword [ebx + 0xb7], 0
je 0x547af1
lea eax, [esp + 0x190]
push str.author.ini
push eax
call fcn.00523b9c
jmp 0x547b03
lea eax, [esp + 0x190]
push str.Tally.ini
push eax
call fcn.00523b9c
add esp, 8
mov ecx, dword [esp + 0x19c]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x547b44
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x547b49
mov eax, dword [ecx]
call dword [eax + 0x64]
test eax, eax
je 0x547b49
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x547b49
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
jne 0x547b49
mov esi, 1
cmp esi, 1
je 0x547c78
test esi, esi
je 0x547c5f
cmp edi, 1
jle 0x547ba0
mov ecx, dword [ebx + 0xc]
call fcn.004db958
mov ecx, ebp
mov eax, dword [esp + 0x1e4]
mov edx, dword [eax + 4]
call fcn.004f60bc
cmp edi, 2
jle 0x547ba0
mov esi, 1
mov dword [ebx + 0x54], esi
mov eax, dword [esp + 0x1e4]
push dword [eax + 8]
call fcn.00697b1e
pop ecx
mov dword [0x7e7fe0], eax
mov dword [0x7e7fe4], esi
cmp dword [ebx + 0xc], 0
je 0x547c4e
cmp dword [ebx + 0x14], 0
je 0x547c29
mov ecx, dword [ebx + 0xc]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x547bca
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x547bb5
dec eax
cmp byte [ecx + eax - 1], 0x5c
jne 0x547bd6
mov byte [ecx + eax - 1], 0
mov ecx, dword [ebx + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x547bf0
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x547bdb
dec eax
cmp byte [ecx + eax - 1], 0x5c
jne 0x547bfc
mov byte [ecx + eax - 1], 0
cmp dword [ebx + 0x48], 0
je 0x547c20
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp + 0x190]
call fcn.00523c78
add esp, 0x1cc
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov ecx, ebx
call fcn.00547d08
jmp 0x547c02
lea ecx, [ebx + 0x14]
mov edx, dword [ebx + 0x10]
call fcn.004f60bc
cmp dword [ebx + 0x14], 0
jne 0x547bb0
lea ecx, [ebx + 0x14]
mov edx, dword [ebx + 0x10]
call fcn.004f60bc
jmp 0x547bb0
mov ecx, ebp
mov edx, str._tallydata
call fcn.004f60bc
jmp 0x547baa
push 1
push ebx
push 0x548958
lea ecx, [esp + 0x19c]
call fcn.0052601c
jmp 0x547b5a
cmp dword [ebx + 0xb7], 0
je 0x547c98
lea eax, [esp + 0x190]
push str.author.ini
push dword [ebx + 0x10]
push eax
call fcn.00523a04
jmp 0x547cad
lea eax, [esp + 0x190]
push str.Tally.ini
push dword [ebx + 0x10]
push eax
call fcn.00523a04
add esp, 0xc
mov ecx, dword [esp + 0x19c]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov esi, eax
cmp esi, 1
je 0x547cfe
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x547b52
mov eax, dword [ecx]
call dword [eax + 0x64]
test eax, eax
je 0x547b52
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x547b52
mov eax, dword [ecx]
call dword [eax + 0x68]
cmp eax, 1
jne 0x547b52
mov esi, 1
jmp 0x547b52
Function at 0x54c4bc
Capabilities:
Enumerate pe sections

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x54c4e4
test dword [0x7eeab0], 0xffffffff
jne 0x54c588
call fcn.006a7fbc
jmp fcn.0054c4bc
push edi
push esi
mov edx, dword [esp + 0xc]
lea eax, [edx + 0x18]
lea edi, [ecx + 0x18]
mov dword [esp], edi
cmp edi, eax
jbe 0x54c4fe
sub edi, eax
cmp edi, 0xe
ja 0x54c50d
mov edi, dword [esp]
cmp eax, edi
jbe 0x54c50d
sub eax, dword [esp]
cmp eax, 0xe
ja 0x54c50d
movzx eax, word [edx + 0x18]
mov word [ecx + 0x18], ax
movzx edi, word [edx + 0x1a]
mov word [ecx + 0x1a], di
movzx eax, word [edx + 0x1c]
mov word [ecx + 0x1c], ax
movzx eax, word [edx + 0x1e]
mov word [ecx + 0x1e], ax
movzx eax, word [edx + 0x20]
mov word [ecx + 0x20], ax
movzx eax, word [edx + 0x22]
mov word [ecx + 0x22], ax
movzx eax, word [edx + 0x24]
mov word [ecx + 0x24], ax
mov edi, dword [edx]
mov dword [ecx], edi
xor eax, eax
mov dword [edx], eax
movzx edi, word [edx + 4]
mov word [ecx + 4], di
movzx edi, word [edx + 6]
mov word [ecx + 6], di
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov dword [edx + 8], eax
movzx eax, word [edx + 0xc]
mov word [ecx + 0xc], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 0xe], ax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov edx, dword [edx + 0x14]
mov dword [ecx + 0x14], edx
pop ecx
pop edi
ret 4
push edi
mov edx, dword [esp + 8]
movzx eax, word [edx + 0x18]
mov word [ecx + 0x18], ax
movzx eax, word [edx + 0x1a]
mov word [ecx + 0x1a], ax
movzx eax, word [edx + 0x1c]
mov word [ecx + 0x1c], ax
movzx eax, word [edx + 0x1e]
mov word [ecx + 0x1e], ax
movzx eax, word [edx + 0x20]
mov word [ecx + 0x20], ax
movzx eax, word [edx + 0x22]
mov word [ecx + 0x22], ax
movzx eax, word [edx + 0x24]
mov word [ecx + 0x24], ax
mov eax, dword [edx]
mov dword [ecx], eax
xor eax, eax
mov dword [edx], eax
movzx edi, word [edx + 4]
mov word [ecx + 4], di
movzx edi, word [edx + 6]
mov word [ecx + 6], di
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov dword [edx + 8], eax
movzx eax, word [edx + 0xc]
mov word [ecx + 0xc], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 0xe], ax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
pop edi
ret 4
Function at 0x57dec8
Capabilities:
Parse url

Disassembly:
push esi
push ebp
push ebx
sub esp, 8
mov ebp, ecx
mov ebx, dword [esp + 0x18]
mov dword [ebp], 0x7f2058
mov dword [esp], 1
lea esi, [ebp + 4]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ebp + 4], 0x3c
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], eax
mov edx, 1
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x24], edx
mov dword [ebp + 0x2c], edx
mov dword [ebp + 0x34], edx
mov dword [ebp + 0x3c], edx
lea edx, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov dword [ebp + 0x44], 1
mov ecx, dword [esp]
inc ecx
call fcn.004dc288
mov dword [ebp + 0x40], eax
lea edx, [esp]
push 0
push edx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov edx, dword [esp]
mov eax, dword [ebp + 0x40]
xor ebx, ebx
mov byte [eax + edx], bl
mov ecx, dword [ebp + 0x40]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x57df9c
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x57df87
dec eax
push esi
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x57dfbc
mov dword [ebp + 0x44], 0
mov eax, ebp
add esp, 8
pop ebx
pop ebp
pop esi
ret 4
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov byte [edx + ecx], 0
mov eax, ebp
add esp, 8
pop ebx
pop ebp
pop esi
ret 4
Function at 0x5807dc
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push ebp
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
call fcn.00697769
pop ecx
mov ebp, eax
call fcn.00697746
mov ecx, eax
mov eax, ebp
cdq
mov esi, edx
xor edx, edx
add esi, ecx
mov dword [esp], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], edx
lea ecx, [esp + 8]
push 0xf0000000
push 1
push edx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x58084d
lea eax, [esp]
push eax
push 8
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x580841
mov dword [esp], ebp
mov dword [esp + 4], esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop ebp
pop esi
ret
Function at 0x584d28
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
mov ecx, 0x80
shr ecx, 3
mov eax, 0
mov ebx, 0
xor dword [esi], eax
xor dword [esi + 4], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
call fcn.005f0db0
mov dword [esi], eax
mov dword [esi + 4], ebx
add esi, 8
loop 0x584d41
pop ebx
pop edi
pop esi
ret
Function at 0x5851b4
Capabilities:
Inspect section memory permissions

Disassembly:
sub eax, eax
sub ebx, ebx
bt ecx, 0xa
jae 0x5851c3
or eax, 0x80
bt ecx, 0x17
jae 0x5851cc
or eax, 0x40
bt ecx, 0xd
jae 0x5851d5
or eax, 0x20
bt ecx, 0x10
jae 0x5851de
or eax, 0x10
bt ecx, 7
jae 0x5851e7
or eax, 8
bt ecx, 3
jae 0x5851f0
or eax, 4
bt ecx, 5
jae 0x5851f9
or eax, 2
bt ecx, 0x1c
jae 0x585202
or eax, 1
bt ecx, 9
jae 0x58520d
or eax, 0x8000
bt ecx, 2
jae 0x585218
or eax, 0x4000
bt ecx, 0x13
jae 0x585223
or eax, 0x2000
bt ecx, 0xe
jae 0x58522e
or eax, 0x1000
bt ecx, 0x11
jae 0x585239
or eax, 0x800
bt ecx, 0x15
jae 0x585244
or eax, 0x400
bt ecx, 0xc
jae 0x58524f
or eax, 0x200
bt ecx, 4
jae 0x58525a
or eax, 0x100
bt ecx, 0x1e
jae 0x585265
or eax, 0x800000
bt ecx, 0
jae 0x585270
or eax, 0x400000
bt ecx, 8
jae 0x58527b
or eax, 0x200000
bt ecx, 1
jae 0x585286
or eax, 0x100000
bt ecx, 0x1d
jae 0x585291
or eax, 0x80000
bt ecx, 0x14
jae 0x58529c
or eax, 0x40000
bt ecx, 0xb
jae 0x5852a7
or eax, 0x20000
bt ecx, 6
jae 0x5852b2
or eax, 0x10000
bt edx, 0xf
jae 0x5852bd
or eax, 0x80000000
bt edx, 0x14
jae 0x5852c8
or eax, 0x40000000
bt edx, 0x19
jae 0x5852d3
or eax, 0x20000000
bt edx, 3
jae 0x5852de
or eax, 0x10000000
bt edx, 9
jae 0x5852e9
or eax, 0x8000000
bt edx, 0x11
jae 0x5852f4
or eax, 0x4000000
bt edx, 0x1a
jae 0x5852ff
or eax, 0x2000000
bt edx, 0
jae 0x58530a
or eax, 0x1000000
bt edx, 0x15
jae 0x585316
or ebx, 0x80
bt edx, 0xb
jae 0x58531f
or ebx, 0x40
bt edx, 7
jae 0x585328
or ebx, 0x20
bt edx, 8
jae 0x585331
or ebx, 0x10
bt edx, 0xc
jae 0x58533a
or ebx, 8
bt edx, 0x17
jae 0x585343
or ebx, 4
bt edx, 1
jae 0x58534c
or ebx, 2
bt edx, 0x10
jae 0x585355
or ebx, 1
bt edx, 6
jae 0x585361
or ebx, 0x8000
bt edx, 0x13
jae 0x58536d
or ebx, 0x4000
bt edx, 0xa
jae 0x585379
or ebx, 0x2000
bt edx, 0xe
jae 0x585385
or ebx, 0x1000
bt edx, 0x16
jae 0x585391
or ebx, 0x800
bt edx, 4
jae 0x58539d
or ebx, 0x400
bt edx, 0x1b
jae 0x5853a9
or ebx, 0x200
bt edx, 0x18
jae 0x5853b5
or ebx, 0x100
ret
Function at 0x5a7168
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xfffffe00
jne 0x5a71a0
test dword [0x7eeab0], 0xffffff80
jne 0x5a7250
test dword [0x7eeab0], 0xffffffff
jne 0x5a72c8
call fcn.006a7fbc
jmp fcn.005a7168
push ebx
mov ebx, dword [ecx + 0x25]
test ebx, ebx
jle 0x5a7244
mov eax, dword [ecx + 0x29]
mov edx, dword [eax]
mov ecx, dword [edx]
cmp ebx, 4
jl 0x5a7248
mov edx, ebx
and edx, 3
neg edx
add edx, ebx
pxor xmm1, xmm1
xor eax, eax
movd xmm0, ecx
punpckldq xmm0, xmm0
punpckldq xmm0, xmm0
movdqa xmm3, xmm0
pcmpgtd xmm3, xmm1
movdqa xmm2, xmm0
pxor xmm2, xmm1
pand xmm3, xmm2
pxor xmm1, xmm3
add eax, 4
cmp eax, edx
jb 0x5a71d7
movdqa xmm0, xmm1
psrldq xmm0, 8
movdqa xmm2, xmm1
pcmpgtd xmm2, xmm0
pxor xmm1, xmm0
pand xmm2, xmm1
pxor xmm2, xmm0
movdqa xmm1, xmm2
psrldq xmm1, 4
movdqa xmm3, xmm2
pcmpgtd xmm3, xmm1
pxor xmm2, xmm1
pand xmm3, xmm2
pxor xmm3, xmm1
movd eax, xmm3
cmp edx, ebx
jae 0x5a7246
cmp ecx, eax
cmovge eax, ecx
inc edx
cmp edx, ebx
jb 0x5a7238
jmp 0x5a7246
xor eax, eax
pop ebx
ret
xor eax, eax
xor edx, edx
jmp 0x5a7234
push ebx
mov ebx, dword [ecx + 0x25]
test ebx, ebx
jle 0x5a72bc
mov eax, dword [ecx + 0x29]
mov edx, dword [eax]
mov ecx, dword [edx]
cmp ebx, 2
jl 0x5a72c0
mov edx, ebx
and edx, 1
neg edx
add edx, ebx
pxor mm1, mm1
xor eax, eax
movd mm0, ecx
punpckldq mm0, mm0
movq mm3, mm0
pcmpgtd mm3, mm1
movq mm2, mm0
pxor mm2, mm1
pand mm3, mm2
pxor mm1, mm3
add eax, 2
cmp eax, edx
jb 0x5a7278
movq mm0, mm1
psrlq mm0, 0x20
movq mm2, mm1
pcmpgtd mm2, mm0
pxor mm1, mm0
pand mm2, mm1
pxor mm2, mm0
movd eax, mm2
emms
cmp edx, ebx
jae 0x5a72be
cmp ecx, eax
cmovge eax, ecx
inc edx
cmp edx, ebx
jb 0x5a72b0
jmp 0x5a72be
xor eax, eax
pop ebx
ret
xor eax, eax
xor edx, edx
jmp 0x5a72ac
push esi
mov edx, dword [ecx + 0x25]
test edx, edx
jle 0x5a72e8
mov eax, dword [ecx + 0x29]
mov ecx, dword [eax]
mov esi, dword [ecx]
xor eax, eax
xor ecx, ecx
cmp esi, eax
jl 0x5a72e1
mov eax, esi
inc ecx
cmp ecx, edx
jl 0x5a72db
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5a72ec
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xfffffe00
jne 0x5a7324
test dword [0x7eeab0], 0xffffff80
jne 0x5a73dc
test dword [0x7eeab0], 0xffffffff
jne 0x5a745c
call fcn.006a7fbc
jmp fcn.005a72ec
push ebx
mov ebx, dword [ecx + 0x25]
test ebx, ebx
jle 0x5a73cc
mov eax, dword [ecx + 0x29]
mov edx, dword [eax]
mov ecx, dword [edx]
cmp ebx, 4
jl 0x5a73d3
mov edx, ebx
and edx, 3
neg edx
add edx, ebx
movdqa xmm1, xmmword [0x6d5390]
xor eax, eax
movd xmm0, ecx
punpckldq xmm0, xmm0
punpckldq xmm0, xmm0
movdqa xmm2, xmm0
pcmpgtd xmm2, xmm1
pxor xmm1, xmm0
pand xmm2, xmm1
movdqa xmm1, xmm0
pxor xmm1, xmm2
add eax, 4
cmp eax, edx
jb 0x5a735f
movdqa xmm0, xmm1
psrldq xmm0, 8
movdqa xmm2, xmm1
pcmpgtd xmm2, xmm0
pxor xmm0, xmm1
pand xmm2, xmm0
pxor xmm2, xmm1
movdqa xmm1, xmm2
psrldq xmm1, 4
movdqa xmm3, xmm2
pcmpgtd xmm3, xmm1
pxor xmm1, xmm2
pand xmm3, xmm1
pxor xmm3, xmm2
movd eax, xmm3
cmp edx, ebx
jae 0x5a73d1
cmp ecx, eax
cmovl eax, ecx
inc edx
cmp edx, ebx
jb 0x5a73c0
jmp 0x5a73d1
mov eax, 0x11bed
pop ebx
ret
mov eax, 0x11bed
xor edx, edx
jmp 0x5a73bc
push ebx
mov ebx, dword [ecx + 0x25]
test ebx, ebx
jle 0x5a744c
mov eax, dword [ecx + 0x29]
mov edx, dword [eax]
mov ecx, dword [edx]
cmp ebx, 2
jl 0x5a7453
mov edx, ebx
and edx, 1
neg edx
add edx, ebx
movq mm1, qword [0x6d53a0]
xor eax, eax
movd mm0, ecx
punpckldq mm0, mm0
movq mm2, mm0
pcmpgtd mm2, mm1
pxor mm1, mm0
pand mm2, mm1
movq mm1, mm0
pxor mm1, mm2
add eax, 2
cmp eax, edx
jb 0x5a7408
movq mm0, mm1
psrlq mm0, 0x20
movq mm2, mm1
pcmpgtd mm2, mm0
pxor mm0, mm1
pand mm2, mm0
pxor mm2, mm1
movd eax, mm2
emms
cmp edx, ebx
jae 0x5a7451
cmp ecx, eax
cmovl eax, ecx
inc edx
cmp edx, ebx
jb 0x5a7440
jmp 0x5a7451
mov eax, 0x11bed
pop ebx
ret
mov eax, 0x11bed
xor edx, edx
jmp 0x5a743c
push esi
mov edx, dword [ecx + 0x25]
test edx, edx
jle 0x5a747f
mov eax, dword [ecx + 0x29]
mov ecx, dword [eax]
mov esi, dword [ecx]
mov eax, 0x11bed
xor ecx, ecx
cmp esi, eax
jge 0x5a7478
mov eax, esi
inc ecx
cmp ecx, edx
jl 0x5a7472
pop esi
ret
mov eax, 0x11bed
pop esi
ret