joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d26f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x2d27f1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x2d27f1
push ebx
call fcn.002d9330
add esp, 4
test eax, eax
je 0x2d274a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x2d2751
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x2d2730
jmp 0x2d2753
mov esi, 0x1505
jmp 0x2d2753
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x2d27f1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x2d2784
inc ebp
dec ebx
je 0x2d27ef
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x2d27ef
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x2d2780
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.002d9330
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x2d2780
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.002d9350
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x2d2780
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x2d27ef
cmp dword [eax + 4], 5
mov edi, 0
jne 0x2d27f1
mov edi, dword [eax + 8]
jmp 0x2d27f1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x2d2b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x2d2b8d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x2d2b8d
push esi
call fcn.002d9330
add esp, 4
test eax, eax
je 0x2d2b6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x2d2b71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x2d2b50
jmp 0x2d2b73
mov ebx, 0x1505
jmp 0x2d2b73
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x2d2b95
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x2d2ba4
inc ebp
dec edi
je 0x2d2b8b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x2d2b8b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x2d2ba0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.002d9330
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x2d2ba0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.002d9350
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x2d2ba0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x2d2b8d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x2d2b8d
Function at 0x2d8e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x2d8e8b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x2d8e93
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x2d8f2b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x2d8ed9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x2d8f3a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x2d8eee
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x2d8f00
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x2d8ec0
jmp 0x2d8f09
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x2d8ec0
cmp edi, ebx
jge 0x2d8f20
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x2d8ec4
jmp 0x2d8f24
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x2d8ecd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x2d8fc2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x2d8fc2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x2d8f74
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x2d8f60
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x2d8fc2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x2d8f80
dec eax
mov ecx, 1
xor esi, esi
jmp 0x2d8fdc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x2d8e8b
test edx, edx
mov dword [esp], ecx
js 0x2d9010
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x2d9020
inc ebp
dec edx
cmp edi, ebp
jne 0x2d8ff0
mov edx, 0xffffffff
jmp 0x2d9022
xor edi, edi
jmp 0x2d9025
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x2d8fd0
and ebp, 3
je 0x2d9058
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x2d9040
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x2d905a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x2d8fd0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x2d9070
jmp 0x2d8fd0
Function at 0x2d9a80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x2d9ae5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x2d9aa0
mov eax, 0x270
jmp 0x2d9bc7
cmp eax, 0x4e0
jb 0x2d9bc7
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x2d9b00
mov esi, dword [ecx + 0xd50]
xor eax, eax
jmp 0x2d9b71
and esi, 0x80000000
or edi, esi
shr edi, 1
xor edi, dword [ecx + eax*4 + 4]
xor edi, ebx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
mov esi, edx
cmp eax, 0x18c
je 0x2d9b93
mov edx, dword [ecx + eax*4 + 0xd54]
mov edi, edx
and edi, 0x7fffffff
mov ebx, edx
xor ebx, 0x7ffffffe
and ebx, edi
je 0x2d9b50
mov ebx, 0x9908b0df
jmp 0x2d9b50
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
mov esi, edx
not esi
or esi, dword [ecx + 0x1384]
add edx, esi
inc edx
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, edx
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
and ecx, eax
or eax, edx
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x2ebc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
test edi, edi
sets bl
mov esi, edi
sub esi, 1
sete bh
or bl, bh
mov esi, edi
sub esi, 0x25
setge bh
or bl, bh
test bl, 1
jne 0x2ebc54
jmp 0x2ebc59
jmp 0x2ebde8
mov esi, ecx
add esi, edx
add esi, 0xffffffff
mov byte [ecx + edx - 1], 0
cmp eax, 0
jne 0x2ebc78
mov ecx, esi
add ecx, 0xffffffff
mov byte [esi - 1], 0x30
jmp 0x2ebde8
cmp edi, 0xa
jne 0x2ebd06
jmp 0x2ebc83
cmp eax, 0x64
jb 0x2ebcc2
mov edi, 0x64
mov ecx, eax
mov eax, ecx
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0x3112bd]
mov edi, esi
add edi, 0xffffffff
mov byte [esi - 1], al
mov al, byte [edx + 0x3112bc]
add edi, 0xffffffff
mov byte [esi - 2], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov esi, edi
jmp 0x2ebc83
cmp eax, 0xa
setb cl
jmp 0x2ebcca
test cl, 1
jne 0x2ebcd1
jmp 0x2ebcdf
mov al, byte [eax + 0x311b88]
add esi, 0xffffffff
mov byte [esi], al
jmp 0x2ebcff
shl eax, 1
mov cl, byte [eax + 0x3112bd]
mov edx, esi
add edx, 0xffffffff
mov byte [esi - 1], cl
mov al, byte [eax + 0x3112bc]
add edx, 0xffffffff
mov byte [esi - 2], al
mov esi, edx
mov ecx, esi
jmp 0x2ebde8
cmp edi, 0x10
sete cl
test cl, 1
jne 0x2ebd18
jmp 0x2ebd13
jmp 0x2ebdbe
jmp 0x2ebd1a
cmp eax, 0x100
jb 0x2ebd4e
mov ecx, eax
and ecx, 0xff
shl ecx, 1
mov dl, byte [ecx + 0x311386]
mov edi, esi
add edi, 0xffffffff
mov byte [esi - 1], dl
mov cl, byte [ecx + 0x311385]
add edi, 0xffffffff
mov byte [esi - 2], cl
shr eax, 8
mov esi, edi
jmp 0x2ebd1a
cmp eax, 0x10
setb cl
test cl, 1
jne 0x2ebd5b
jmp 0x2ebd6c
mov al, byte [eax + 0x311b88]
mov ecx, esi
add ecx, 0xffffffff
mov byte [esi - 1], al
jmp 0x2ebde8
mov ecx, eax
and ecx, 0xffffffff
shl ecx, 1
mov edx, eax
add edx, 0xffffffff
sub edx, ecx
or edx, 0xfffffffd
add edx, 3
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
mov edx, eax
and edx, ecx
shl edx, 1
xor eax, ecx
add eax, edx
mov dl, byte [eax + 0x311386]
mov ecx, esi
add ecx, 0xffffffff
mov byte [esi - 1], dl
mov al, byte [eax + 0x311385]
add ecx, 0xffffffff
mov byte [esi - 2], al
jmp 0x2ebde8
cmp eax, 0
jbe 0x2ebde4
mov ecx, eax
mov eax, ecx
xor edx, edx
div edi
mov al, byte [edx + 0x311b88]
mov ebx, esi
add ebx, 0xffffffff
mov byte [esi - 1], al
mov eax, ecx
xor edx, edx
div edi
mov esi, ebx
jmp 0x2ebdbe
mov ecx, esi
jmp 0x2ebde8
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x33ec70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp + 2], 0x5d5ca197
mov word [esp + 6], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0xa
xor dl, byte [esp + ecx + 2]
add dl, 0xb0
mov byte [esp + ecx + 2], dl
inc ecx
cmp ecx, 6
jne 0x33ec90
xor ecx, ecx
cmp dword [esp + 2], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x318670]

Function at 0x33fa20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x10111213
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
or cl, 0x4c
xor cl, byte [esp + eax]
add cl, 0xa0
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x33fa40
mov eax, dword [esp]
mov edx, dword [0x31aea0]
test edx, edx
je 0x33fab8
xor ebx, ebx
mov ecx, dword [0x31aea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x33fa90
inc ebx
cmp edx, ebx
jne 0x33fa80
jmp 0x33fab8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x33fab8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x31aea8]
call fcn.0033d1a0
add esp, 0x20
test edi, edi
je 0x33fac2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x33face
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5afb28
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x43b008], 0x8088405
inc edx
mov dword [ebx + 0x43b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x5dba60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x5dba8d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x5dba7e
and ecx, 3
je 0x5dbaa5
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x5dba92
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x5dbab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x5dbae9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x5dbad1
pop esi
and esi, 3
je 0x5dbb0e
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x5dbaef
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x5dbb18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x5dbb44
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x5dbb35
and ecx, 3
je 0x5dbb5c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x5dbb49
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x5dbb64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x5dbb70
pop edi
pop ebx
ret
Function at 0x5dc48c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.005dc0e4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x3577cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x5dc53a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.005af710
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.005dbb64
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.005af710
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.005dbb64
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x5dc4e7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x5dc588
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.005af710
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.005dbb64
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.005af710
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x5dc5b2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x5dc5b2
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x5dc5a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3577d2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005dc280
ret

Function at 0x5ead94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x5eade8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x43b814]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x43bc14]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x43c014]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x43c414]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x5eada3
pop edi
pop esi
pop ebx
ret
Function at 0x5f89b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x5f8a70
xor ebx, ebx
lea esi, [ebp - 0x114]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
call fcn.005b2334
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x5f89da
xor edx, edx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x5f8a70
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc edx
and dl, 0xff
mov esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x114]
mov cl, byte [ebp - 0xd]
add cl, al
and cl, 0xff
mov byte [ebp - 0xd], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov cl, byte [ebp + ecx - 0x114]
mov byte [ebp + esi - 0x114], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x114], al
add al, byte [ebp + esi - 0x114]
and al, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x114]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], cl
inc ebx
dec dword [ebp - 0x14]
jne 0x5f8a0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5f8a7c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x5f8b34
xor esi, esi
lea ecx, [ebp - 0x110]
mov eax, esi
cdq
idiv edi
mov al, byte [ebx + edx]
mov byte [ecx], al
inc esi
inc ecx
cmp esi, 0x100
jne 0x5f8aa9
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x5f8b34
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc edx
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [ebp + eax - 0x110]
lea ecx, [eax + ecx]
and cl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [ebp + ebx - 0x110]
mov edi, edx
and edi, 0xff
mov byte [ebp + edi - 0x110], bl
xor ebx, ebx
mov bl, cl
mov byte [ebp + ebx - 0x110], al
xor ebx, ebx
mov bl, dl
add al, byte [ebp + ebx - 0x110]
and al, 0xff
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + esi]
and eax, 0xff
xor bl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
inc esi
dec dword [ebp - 0x10]
jne 0x5f8acf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f8b40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, ecx
mov ecx, edx
mov ebp, eax
test cl, cl
jbe 0x5f8ba7
xor ebx, ebx
mov esi, esp
mov byte [edi + ebx], bl
xor eax, eax
mov al, cl
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov al, byte [ebp + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x5f8b58
xor eax, eax
xor ebx, ebx
mov esi, esp
mov dl, byte [edi + ebx]
xor ecx, ecx
mov cl, dl
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
add eax, ecx
and eax, 0xff
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
inc ebx
inc esi
cmp ebx, 0x100
jne 0x5f8b80
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x60680c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x606812
ret
Function at 0x64bdd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x45cc70]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x3c71a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00643fa0
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.006451c8
mov eax, dword [esi]
call fcn.00632aa0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x64be42
mov eax, dword [esi]
call fcn.00632aa0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00632aac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x64be66
mov eax, dword [esi]
call fcn.00632aac
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00632a94
cmp eax, dword [ebp - 0x18]
jle 0x64be7c
mov eax, dword [esi]
call fcn.00632a94
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00632a88
cmp eax, dword [ebp - 0xc]
jle 0x64be92
mov eax, dword [esi]
call fcn.00632a88
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0064a758
push eax
call fcn.005b46d4
call fcn.005b3c14
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x64bf59
mov eax, ebx
call fcn.005b1334
cmp eax, 0x64
jge 0x64bf59
cmp dword [0x44a26c], 0
je 0x64bf59
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.005b4724
cmp dword [ebp - 8], 0
je 0x64bf59
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.005b4724
cmp dword [ebp - 8], 0
je 0x64bf1c
mov bl, 2
jmp 0x64bf37
lea edx, [ebp - 0x20]
mov eax, dword [0x464830]
call fcn.0064f068
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x64bf35
xor ebx, ebx
jmp 0x64bf37
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x44a374]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0064a758
push eax
call dword [0x44a26c]
mov eax, dword [0x45ca7c]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.00647e8c
push 4
mov eax, dword [ebp - 4]
call fcn.0064a758
push eax
call fcn.005b471c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c71b0
call fcn.005b3c14
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret