joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d49d4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
mov esi, 0x100
mov dword [ebp - 0x20], ebx
mov edx, dword [ebx + 0x4c]
cmp edx, 1
mov edi, dword [ebx + 0x1b8]
sete al
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov byte [edi + 0x1c], al
mov eax, 0x2fe
push dword [ebx + 0x64]
mov ecx, dword [ebx + 4]
cmovne eax, esi
push eax
push 1
push ebx
call dword [ecx + 8]
xor esi, esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x14]
add esp, 0x10
mov dword [ebp - 0x10], esi
cmp dword [ebx + 0x64], esi
jle 0x4d4af8
mov ecx, dword [edi + esi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 0xc], 1
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
jne 0x4d4a48
mov eax, dword [edi + 0x18]
add dword [eax + esi*4], 0xff
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, dword [eax + esi*4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
lea esi, [eax*2 - 2]
add eax, 0xfe
cdq
idiv esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov esi, dword [ebp - 4]
mov edx, eax
cmp edi, edx
jle 0x4d4a9d
imul ebx, ecx, 0x1fe
add ebx, 0xfe
add ebx, esi
add ebx, 0x1fe
inc ecx
mov eax, ebx
cdq
idiv dword [ebp - 0x18]
mov edx, eax
cmp edi, edx
jg 0x4d4a84
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
movzx eax, cl
mov ecx, dword [ebp - 0x14]
movzx ecx, cl
imul ecx, eax
mov byte [edi + ebx], cl
inc edi
mov ecx, dword [ebp - 8]
cmp edi, 0xff
jle 0x4d4a72
cmp dword [ebp - 0xc], 1
mov esi, dword [ebp - 0x10]
jne 0x4d4ae2
xor ecx, ecx
lea edx, [ebx - 1]
inc ecx
mov al, byte [ebx]
mov byte [edx], al
mov al, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
dec edx
cmp ecx, 0xff
jle 0x4d4ac7
mov eax, dword [ebp - 0x20]
inc esi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
cmp esi, dword [eax + 0x64]
mov eax, dword [ebp - 0x14]
jl 0x4d4a2b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5078f8
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x568]
mov esi, ecx
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x56c], esi
push eax
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x570], edi
cmp edi, 0xffffffff
jne 0x507967
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0x507ab1
jmp 0x507aa2
xor ebx, ebx
test byte [ebp - 0x560], 0x10
jne 0x507a85
lea eax, [ebp - 0x108]
sub eax, dword [ebp - 0x568]
sar eax, 1
push eax
lea eax, [ebp - 0x534]
push eax
push dword [ebp - 0x568]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x5079d9
lea eax, [ebp - 0x310]
push eax
push str.WideCharToMultiByte_failed_for__S
push esi
call fcn.004f6fc4
add esp, 0xc
jmp 0x507a85
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5079e2
sub ecx, edx
lea eax, [ebp + ecx - 0x10c]
mov ecx, esi
mov dword [ebp - 0x564], eax
call fcn.004f703f
push ebx
push eax
call fcn.00724770
mov esi, dword [ebp - 0x56c]
pop ecx
pop ecx
test eax, eax
jne 0x507a78
mov eax, dword [esi + 0x20]
cmp dword [eax + 0x40], ebx
jne 0x507a78
push str..ttc
push dword [ebp - 0x564]
call fcn.0070d624
pop ecx
pop ecx
test eax, eax
jne 0x507a3f
lea edx, [ebp - 0x108]
mov ecx, esi
call fcn.005077a3
jmp 0x507a78
push str..ttf
push dword [ebp - 0x564]
call fcn.0070d624
pop ecx
pop ecx
test eax, eax
je 0x507a6b
push str..otf
push dword [ebp - 0x564]
call fcn.0070d624
pop ecx
pop ecx
test eax, eax
jne 0x507a78
lea edx, [ebp - 0x108]
mov ecx, esi
call fcn.0050772e
mov ecx, esi
call fcn.004f70d4
mov edi, dword [ebp - 0x570]
lea eax, [ebp - 0x560]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x507969
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
call edi
push eax
push str.extend_system_font_list:_unknown_error__d
push 2
push esi
call fcn.004f715e
int3
Function at 0x507ac2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf8
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0xf6
ja 0x507b18
push str.Fonts._t_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0070d4a8
add esp, 0xc
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.005078f8
mov eax, dword [0xf0364c]
test eax, eax
jne 0x507b33
push str.couldnt_find_any_usable_system_fonts
push esi
call fcn.004f6fc4
mov eax, dword [0xf0364c]
pop ecx
pop ecx
push fcn.0070d624
push 0x188
push eax
push dword [0xf03648]
call fcn.00703b80
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.006f3e28
leave
ret
Function at 0x51ac7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0xee37e4]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, edx
mov dword [esp + 0xc], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [ebx + 8]
cdq
and edx, 7
mov dword [esp + 0x10], ecx
add eax, edx
mov dword [esp + 0x1c], esi
sar eax, 3
push 0x10
pop ecx
cmp eax, ecx
cmovl ecx, eax
xor edi, edi
test eax, eax
lea eax, [ebx + 0xdc]
cmovg edi, ecx
cmp dword [ebx + 0x20], 2
jne 0x51ad1a
mov ecx, dword [esp + 0x10]
mov edx, ebx
push eax
push dword [ebp + 0xc]
push dword [esp + 0x1c]
call fcn.0051a575
add esp, 0xc
lea edx, [ebx + 0xdc]
lea ecx, [esp + 0x78]
push edi
call fcn.0057c0d4
pop ecx
push 0x20
push 0xd0626c
mov edx, esi
lea ecx, [esp + 0x80]
call fcn.0057c138
pop ecx
pop ecx
lea eax, [ebx + 0xdc]
cmp dword [ebx + 0x20], 3
je 0x51ad2a
cmp dword [ebx + 0x20], 4
jne 0x51ae1d
mov ecx, dword [esp + 0x10]
mov edx, ebx
push eax
push dword [ebp + 0xc]
push dword [esp + 0x1c]
call fcn.0051a575
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.0051e124
push 0x20
mov edx, 0xd0626c
call fcn.0051e148
mov edx, dword [ebx]
pop ecx
mov ecx, dword [esp + 0x10]
call fcn.004fb6b0
mov edx, dword [ebx]
mov ecx, dword [esp + 0x10]
push eax
call fcn.004fb685
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.0051e148
pop ecx
lea edx, [esp + 0x184]
lea ecx, [esp + 0x20]
call fcn.0051e1d5
push edi
lea edx, [ebx + 0xdc]
lea ecx, [esp + 0x7c]
call fcn.0057c0d4
pop ecx
lea eax, [esp + 0x184]
mov edx, esi
push 0x10
push eax
lea ecx, [esp + 0x80]
call fcn.0057c138
xor edx, edx
pop ecx
inc edx
pop ecx
mov dword [esp + 0x18], edx
xor ecx, ecx
test edi, edi
jle 0x51adda
mov al, byte [ebx + ecx + 0xdc]
xor al, dl
mov byte [esp + ecx + 0x184], al
inc ecx
cmp ecx, edi
jl 0x51adc1
mov esi, dword [esp + 0x1c]
push edi
lea edx, [esp + 0x188]
lea ecx, [esp + 0x7c]
call fcn.0057c0d4
pop ecx
push 0x10
push esi
mov edx, esi
lea ecx, [esp + 0x80]
call fcn.0057c138
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
pop ecx
pop ecx
cmp edx, 0x13
jle 0x51adbb
lea edi, [esi + 0x10]
mov esi, 0xd0626c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
cmp dword [ebx + 0x20], 5
mov edi, dword [esp + 0x10]
jne 0x51ae3d
push esi
push 0
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, edi
push dword [esp + 0x20]
call fcn.0051a710
add esp, 0x10
cmp dword [ebx + 0x20], 6
jne 0x51ae59
push esi
push 0
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, edi
push dword [esp + 0x20]
call fcn.0051ab77
add esp, 0x10
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006f3e28
mov esp, ebp
pop ebp
ret
Function at 0x51b3ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
mov eax, edx
push ebx
mov dword [ebp - 0x1d4], eax
push esi
mov eax, dword [eax + 8]
mov esi, dword [ebp + 0xc]
cdq
push edi
mov edi, dword [ebp + 8]
and edx, 7
mov dword [ebp - 0x1d8], ecx
add eax, edx
mov ecx, dword [ebp + 0x10]
sar eax, 3
push 0x10
mov dword [ebp - 0x1dc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x1e4], ecx
pop ecx
cmp eax, ecx
push 0x20
cmovl ecx, eax
xor ebx, ebx
test eax, eax
pop eax
cmovg ebx, ecx
cmp esi, eax
mov dword [ebp - 0x1e0], ebx
cmovbe eax, esi
push eax
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.006f6760
mov ecx, dword [ebp - 0x1d0]
add esp, 0xc
cmp ecx, 0x20
jae 0x51b48d
push 0x20
pop eax
sub eax, ecx
push eax
lea eax, [ebp - 0x28]
add eax, ecx
push 0xd0626c
push eax
call fcn.006f6760
add esp, 0xc
lea ecx, [ebp - 0xc4]
call fcn.0051e124
push 0x20
lea edx, [ebp - 0x28]
call fcn.0051e148
pop ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xc4]
call fcn.0051e1d5
mov edi, dword [ebp - 0x1d4]
cmp dword [edi + 0x20], 3
jl 0x51b4e8
push 0x32
pop esi
lea ecx, [ebp - 0xc4]
call fcn.0051e124
push ebx
lea edx, [ebp - 0x28]
call fcn.0051e148
pop ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xc4]
call fcn.0051e1d5
sub esi, 1
jne 0x51b4c0
push ebx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1cc]
call fcn.0057c0d4
push 0x20
pop ebx
cmp dword [ebp - 0x1d8], ebx
lea eax, [ebp - 0x48]
mov esi, ebx
cmovbe esi, dword [ebp - 0x1d8]
push esi
push dword [ebp - 0x1dc]
push eax
call fcn.006f6760
add esp, 0x10
cmp esi, ebx
jae 0x51b538
mov eax, ebx
sub eax, esi
push eax
lea eax, [ebp - 0x48]
add eax, esi
push 0xd0626c
push eax
call fcn.006f6760
add esp, 0xc
lea eax, [ebp - 0x48]
push ebx
push eax
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x1cc]
call fcn.0057c138
cmp dword [edi + 0x20], 3
pop ecx
pop ecx
jl 0x51b59c
mov esi, dword [ebp - 0x1e0]
xor ebx, ebx
inc ebx
xor ecx, ecx
test esi, esi
jle 0x51b571
mov al, byte [ebp + ecx - 0x28]
xor al, bl
mov byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, esi
jl 0x51b562
push esi
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x1cc]
call fcn.0057c0d4
lea eax, [ebp - 0x68]
push 0x20
push eax
mov edx, eax
lea ecx, [ebp - 0x1cc]
call fcn.0057c138
add esp, 0xc
inc ebx
cmp ebx, 0x13
jle 0x51b55c
mov edi, dword [ebp - 0x1e4]
lea esi, [ebp - 0x68]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x51e124
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx], 0
and dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x53a1c0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
mov edi, esi
test edx, edx
jle 0x53a1e2
movzx eax, byte [edi + ecx]
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
inc edi
cmp edi, edx
jl 0x53a1ca
imul ecx, esi, 9
pop edi
pop esi
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x549450
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10c], 0
push ebx
mov ebx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x114], ebx
movzx edx, byte [ebx + 0x18]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x1c]
mov esi, dword [ebx + 0x30]
imul eax, edx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x11c], edx
sub ecx, eax
movzx eax, byte [ebx + 0x1a]
mov dword [ebp - 0x118], ecx
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x110], ecx
test ecx, ecx
jle 0x5495d2
movss xmm1, dword [0xed097c]
mov ebx, ecx
mov esi, dword [ebp - 0x10c]
mov eax, dword [ebp + 8]
movss xmm0, dword [eax + edi*8]
mulss xmm0, xmm1
cvttss2si ecx, xmm0
movss xmm0, dword [eax + edi*8 + 4]
mulss xmm0, xmm1
mov dword [ebp + edi*4 - 0x104], ecx
cvttss2si eax, xmm0
sub eax, ecx
cdq
idiv dword [ebp + 0xc]
mov dword [ebp + edi*4 - 0x84], eax
test ecx, ecx
jne 0x549509
mov eax, dword [ebp + 0xc]
cvttss2si ecx, xmm0
shl eax, 8
cmp ecx, eax
jne 0x549509
xor eax, eax
jmp 0x54950c
xor eax, eax
inc eax
or esi, eax
inc edi
cmp edi, ebx
jl 0x5494c1
mov ebx, dword [ebp - 0x114]
test esi, esi
mov esi, dword [ebp - 0x108]
je 0x5495d2
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5495d2
mov ecx, dword [ebp - 0x118]
mov edi, dword [ebx + 0x10]
dec eax
mov dword [ebp - 0x120], eax
test edi, edi
je 0x5495c2
dec edi
xor esi, esi
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x108]
movzx ebx, byte [esi + edi]
mov edx, 0xff
shl ebx, 8
imul ebx, dword [ebp + esi*4 - 0x84]
sar ebx, 8
add ebx, dword [ebp + esi*4 - 0x104]
sar ebx, 8
cmp ebx, edx
movzx eax, bl
cmovl edx, eax
xor ecx, ecx
test ebx, ebx
movzx eax, dl
cmovg ecx, eax
mov byte [esi + edi], cl
inc esi
cmp esi, dword [ebp - 0x110]
jl 0x549555
add edi, dword [ebp - 0x11c]
mov dword [ebp - 0x108], edi
mov edi, dword [ebp - 0x10c]
test edi, edi
jne 0x549546
mov eax, dword [ebp - 0x120]
mov esi, dword [ebp - 0x108]
mov ebx, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
add esi, ecx
mov dword [ebp - 0x108], esi
test eax, eax
jne 0x549538
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x57b07d
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
push edi
mov dword [ebp - 0x808], ebx
mov edx, ebx
mov edi, 0x100
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
inc esi
movzx edx, cl
cmp esi, edi
jl 0x57b0a5
mov esi, ebx
mov edx, 0xf06c88
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0xf06cb0
jl 0x57b0d7
mov byte [0xf06688], 0x63
mov byte [0xf06beb], 0
mov ecx, dword [ebp + ebx*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0xf06688], bl
mov byte [ebx + 0xf06b88], al
mov ebx, eax
inc ebx
mov dword [ebp - 0x808], ebx
cmp ebx, edi
jl 0x57b108
mov edi, 0xff
xor esi, esi
mov dword [ebp - 0x80c], edi
movzx edx, byte [esi + 0xf06688]
mov eax, edx
movzx ebx, byte [esi + 0xf06b88]
and al, 0x80
mov dword [ebp - 0x808], ebx
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0xf080b0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf07cb0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf070b0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf06cb0], ecx
test ebx, ebx
je 0x57b258
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d8]
cdq
idiv edi
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp + edx*4 - 0x804]
cdq
idiv edi
mov eax, dword [ebp + ebx*4 - 0x404]
mov ebx, 0xff
add eax, dword [ebp - 0x3e0]
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x808]
mov eax, dword [ebp + eax*4 - 0x404]
add eax, dword [ebp - 0x3cc]
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x57b260
xor ecx, ecx
xor edi, edi
xor ebx, ebx
xor eax, eax
shl ecx, 8
xor ecx, edi
mov edi, 0xff
shl ecx, 8
xor ecx, ebx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0xf078b0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf074b0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf084b0], ecx
rol ecx, 8
mov dword [esi*4 + 0xf06788], ecx
inc esi
cmp esi, 0x100
jl 0x57b185
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x57b542
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
sub eax, 0x80
je 0x57b586
sub eax, 0x40
je 0x57b57e
sub eax, 0x40
je 0x57b576
xor eax, eax
inc eax
jmp 0x57b65c
mov dword [edi], 0xe
jmp 0x57b58c
mov dword [edi], 0xc
jmp 0x57b58c
mov dword [edi], 0xa
push dword [ebp + 8]
lea esi, [edi + 8]
lea ecx, [ebp - 0x124]
mov dword [edi + 4], esi
call fcn.0057b2b5
pop ecx
test eax, eax
jne 0x57b65c
mov edx, dword [ebp - 0x124]
shl edx, 4
add edx, dword [ebp - 0x120]
push 4
pop ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
sub edx, 0x1c
mov dword [esi], eax
add esi, ecx
mov edi, dword [edi]
dec edi
jmp 0x57b63c
mov ebx, ecx
movzx eax, byte [edx + 3]
push 4
movzx ecx, byte [eax + 0xf06688]
movzx eax, byte [edx + 2]
mov ecx, dword [ecx*4 + 0xf06788]
movzx eax, byte [eax + 0xf06688]
xor ecx, dword [eax*4 + 0xf084b0]
movzx eax, byte [edx + 1]
movzx eax, byte [eax + 0xf06688]
xor ecx, dword [eax*4 + 0xf074b0]
movzx eax, byte [edx]
movzx eax, byte [eax + 0xf06688]
xor ecx, dword [eax*4 + 0xf078b0]
mov dword [esi], ecx
pop ecx
add esi, ecx
add edx, ecx
sub ebx, 1
jne 0x57b5e3
dec edi
sub edx, 0x20
test edi, edi
jg 0x57b5e1
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [edx + ecx]
mov dword [esi + ecx], eax
mov eax, dword [edx + ecx + 4]
mov dword [esi + ecx + 4], eax
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x57bfe5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x57c0d1
mov edx, dword [ebp + 0x10]
test eax, eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
jne 0x57c069
mov ebx, dword [ebp + 0x14]
sub eax, ebx
mov dword [ebp - 8], eax
lea eax, [esi - 1]
shr eax, 4
inc eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov esi, edx
lea edi, [ebp - 0x28]
push ebx
push edx
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0057b66b
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push 0x10
pop edx
mov al, byte [ecx + ebx]
xor byte [ebx], al
inc ebx
sub edx, 1
jne 0x57c03a
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 4]
sub ecx, 0x10
add edx, 0x10
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x57c020
jmp 0x57c0cf
lea ebx, [esi - 1]
mov dword [ebp - 0xc], edx
mov esi, dword [ebp + 0x14]
sub eax, edx
shr ebx, 4
inc ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
mov ebx, dword [ebp - 8]
mov edi, esi
push 0x10
mov ecx, edx
sub edi, edx
pop edx
mov al, byte [ebx + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x57c08d
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
push esi
push esi
call fcn.0057b66b
mov edi, dword [ebp + 0xc]
sub ebx, 0x10
mov edx, dword [ebp - 0xc]
add edx, 0x10
mov dword [ebp - 8], ebx
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
add esi, 0x10
sub dword [ebp - 0x14], 1
mov dword [ebp - 4], esi
jne 0x57c081
pop edi
pop ebx
pop esi
leave
ret

Function at 0x57c138
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
mov dword [ebp - 4], edx
mov ebx, ecx
jbe 0x57c196
sub dword [ebp + 8], edx
push esi
push edi
mov eax, dword [ebx]
inc eax
movzx edi, al
mov eax, dword [ebx + 4]
mov dl, byte [edi + ebx + 8]
movzx esi, dl
add eax, esi
movzx ecx, al
mov al, byte [ecx + ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], edi
mov byte [ecx + ebx + 8], dl
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov byte [edi + ebx + 8], al
movzx eax, al
add eax, esi
movzx eax, al
mov al, byte [eax + ebx + 8]
xor al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
sub dword [ebp + 0xc], 1
mov dword [ebp - 4], ecx
jne 0x57c14d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x57ce1c
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x24], 0
and dword [ecx + 0x20], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x57f3fb
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x44], 0
and dword [ecx + 0x40], 0
mov dword [ecx], 0xf3bcc908
mov dword [ecx + 4], 0x6a09e667
mov dword [ecx + 8], 0x84caa73b
mov dword [ecx + 0xc], 0xbb67ae85
mov dword [ecx + 0x10], 0xfe94f82b
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0x5f1d36f1
mov dword [ecx + 0x1c], 0xa54ff53a
mov dword [ecx + 0x20], 0xade682d1
mov dword [ecx + 0x24], 0x510e527f
mov dword [ecx + 0x28], 0x2b3e6c1f
mov dword [ecx + 0x2c], 0x9b05688c
mov dword [ecx + 0x30], 0xfb41bd6b
mov dword [ecx + 0x34], 0x1f83d9ab
mov dword [ecx + 0x38], 0x137e2179
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x57f593
Capabilities:
Hash data using sha224

Disassembly:
and dword [ecx + 0x44], 0
and dword [ecx + 0x40], 0
mov dword [ecx], 0xc1059ed8
mov dword [ecx + 4], 0xcbbb9d5d
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0x9159015a
mov dword [ecx + 0x18], 0xf70e5939
mov dword [ecx + 0x1c], 0x152fecd8
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov dword [ecx + 0x28], 0x68581511
mov dword [ecx + 0x2c], 0x8eb44a87
mov dword [ecx + 0x30], 0x64f98fa7
mov dword [ecx + 0x34], 0xdb0c2e0d
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
ret
Function at 0x5a6949
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], 0x61747375
push ebx
push ebx
push 0x101
mov edi, edx
mov word [ebp - 8], 0x2072
mov esi, ecx
mov dword [ebp - 0x14], 0x61747375
mov word [ebp - 0x10], 0x72
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
call fcn.004f9ccb
add esp, 0xc
lea eax, [ebp - 0x24]
mov edx, edi
mov ecx, esi
push 6
push eax
call fcn.004f9af5
pop ecx
pop ecx
cmp eax, 6
jne 0x5a69f6
lea ecx, [ebp - 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0xc]
cmp eax, dword [edx]
jne 0x5a69be
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
je 0x5a69d4
lea ecx, [ebp - 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
cmp eax, dword [edx]
jne 0x5a69d9
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
jne 0x5a69d9
xor eax, eax
inc eax
jmp 0x5a69f8
lea ecx, [ebp - 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
cmp eax, dword [edx]
jne 0x5a69f2
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
jne 0x5a69f2
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x5a69f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret