joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520390
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x5f1040]
mov edi, eax
add esp, 4
test edi, edi
jne 0x5203bd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x520407
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x52040d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x52046b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x520430
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x520497
mov eax, dword [esi + 4]
push 1
push str.6p5_
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5b32cf
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x520470
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5204a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x5204f0
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmp dl, 2
cmovb ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x5204b2
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x5264a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x5264c3
push dword [ebx + 0x74]
call eax
add esp, 4
push esi
mov esi, dword [ebx + 0x54]
test esi, esi
je 0x526529
nop dword [eax + eax]
mov edi, dword [esi + 4]
xor edx, edx
mov eax, dword [edi + 0x60]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x54]
test eax, eax
je 0x526522
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x5264f6
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x5264e5
jmp 0x526522
test edx, edx
jne 0x5264ff
mov dword [edi + 0x54], ecx
jmp 0x526502
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52650f
push esi
call eax
add esp, 4
push esi
call fcn.005268c0
mov eax, dword [ebp - 4]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x5264d0
mov edi, dword [ebp + 8]
lea ecx, [ebx + 0x6c]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x5265b0
test edi, edi
je 0x5265b0
mov eax, dword [ecx]
test eax, eax
je 0x5265a3
mov ebx, eax
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x526558
push esi
call eax
add esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x52656b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x52657c
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [edi + 8]
push esi
push edi
call eax
mov eax, dword [edi + 8]
push ebx
push edi
call eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x526542
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x58], 0
test eax, eax
je 0x5265c4
push ebx
call eax
add esp, 4
push edi
push ebx
call fcn.00526420
mov eax, dword [ebp - 0xc]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x5265de
push ebx
call eax
add esp, 4
mov esi, dword [ebx + 0x68]
mov eax, dword [ebx + 8]
mov dword [ebp + 0xc], eax
test esi, esi
je 0x526614
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x526601
push esi
call ecx
mov eax, dword [ebp + 0x10]
add esp, 4
test dword [ebp + 0xc], 0x400
jne 0x526614
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 8
mov eax, dword [ebx + 0x80]
mov dword [ebx + 0x68], 0
pop esi
test eax, eax
je 0x52663a
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [ebx + 0x80], 0
mov eax, dword [edi + 8]
push ebx
push edi
call eax
add esp, 8
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x593bef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00593a65
Function at 0x40ca00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d7bf4]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4bc02c]
test eax, eax
jne 0x40ca2b
xor eax, eax
jmp 0x40ca93
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea edx, [ebp - 0x14]
push edx
push str.SeDebugPrivilege
push 0
call dword [0x4bc004]
test eax, eax
jne 0x40ca5c
mov eax, dword [ebp - 4]
push eax
call dword [0x4bc29c]
xor eax, eax
jmp 0x40ca93
push 0
push 0
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [0x4bc008]
test eax, eax
jne 0x40ca84
mov eax, dword [ebp - 4]
push eax
call dword [0x4bc29c]
xor eax, eax
jmp 0x40ca93
mov ecx, dword [ebp - 4]
push ecx
call dword [0x4bc29c]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049d75c
mov esp, ebp
pop ebp
ret

Function at 0x40cab0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x40cad6
xor eax, eax
jmp 0x40cbba
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
je 0x40caf4
xor eax, eax
jmp 0x40cbba
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 6]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
jmp 0x40cb21
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 8]
jae 0x40cbb8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov al, byte [edx]
mov byte [ebp - 0x21], al
mov ecx, dword [ebp - 0x1c]
cmp al, byte [ecx]
jne 0x40cb76
cmp byte [ebp - 0x21], 0
je 0x40cb6d
mov edx, dword [ebp - 0x20]
mov al, byte [edx + 1]
mov byte [ebp - 0x22], al
mov ecx, dword [ebp - 0x1c]
cmp al, byte [ecx + 1]
jne 0x40cb76
add dword [ebp - 0x20], 2
add dword [ebp - 0x1c], 2
cmp byte [ebp - 0x22], 0
jne 0x40cb39
mov dword [ebp - 0x28], 0
jmp 0x40cb7e
sbb edx, edx
sbb edx, 0xffffffff
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40cbaa
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, 1
jmp 0x40cbba
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
mov dword [ebp - 0xc], ecx
jmp 0x40cb18
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d440
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x40f250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x4cd2ac
mov eax, dword [ebp + 8]
push eax
call fcn.0049e289
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f289
push 0x4cc303
mov ecx, dword [ebp + 0xc]
call fcn.004064b0
jmp 0x40f32e
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049e6b9
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.0049e8c9
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x40f315
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.0049dfb2
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004a0650
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0049e6b9
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0049e531
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004064b0
mov edx, dword [ebp - 4]
push edx
call fcn.0049dd6d
add esp, 4
jmp 0x40f322
push 0x4cc30b
mov ecx, dword [ebp + 0xc]
call fcn.004064b0
mov eax, dword [ebp - 8]
push eax
call fcn.0049e5bb
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x423400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9758
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4d7bf4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0xd]
mov dword [ebp - 4], ebx
call fcn.00422190
push 8
call fcn.0049d93d
add esp, 4
cmp eax, ebx
je 0x423528
push eax
push 8
mov dword [esi], eax
xor edi, edi
call fcn.00405270
add esp, 8
cmp eax, ebx
je 0x42346a
xor ecx, ecx
mov dword [eax], edi
mov dword [eax + 4], ecx
mov ecx, dword [esi]
mov dword [ecx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
lea edx, [edi + 0x14]
push edx
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 2
call fcn.00422190
push 8
call fcn.0049d93d
add esp, 4
cmp eax, ebx
je 0x423511
push eax
push 8
mov dword [edi], eax
call fcn.00405270
add esp, 8
cmp eax, ebx
je 0x4234bf
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov eax, dword [edi]
mov dword [eax], edi
lea ecx, [esi + 0x30]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
call fcn.004064d0
lea ecx, [esi + 0x60]
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
call fcn.004064d0
mov dword [esi + 0x7c], 1
mov byte [esi + 0x80], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
lea ecx, [ebp - 0x20]
call fcn.00405ce0
push 0x4d2520
lea ecx, [ebp - 0x20]
push ecx
call fcn.004a316b
push ebx
lea ecx, [ebp - 0x20]
call fcn.00405ce0
push 0x4d2520
lea edx, [ebp - 0x20]
push edx
call fcn.004a316b
int3

Function at 0x434aa0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x434abb
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x434aef
cmp eax, 2
jg 0x434aef
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x4bcfe0]
push 2
push edx
call fcn.0049efa6
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0049efa6
add esp, 0x20
xor eax, eax
ret

Function at 0x4394b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.004a20c6
add esp, 0x18
test eax, eax
je 0x4394d4
cmp eax, 0xffffffff
jne 0x4394d6
xor eax, eax
pop ebp
ret
Function at 0x449ad0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x449b04
push str.Couldnt_set_desired_mode
push ebx
call fcn.00434c60
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x449b1b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00434be0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x449b32
push edi
call fcn.00449a60
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x449b46
push edi
call fcn.00446df0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x449b58
mov eax, edi
call fcn.00449ab0
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x449b66
mov eax, edi
call fcn.00449ac0
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x450860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x450871
jmp dword [ecx*4 + 0x4508e0]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x450c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.004036f0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.004aa8ab
add esp, 0x10
pop ebp
ret

Function at 0x458280
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4582a2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x458296
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x4582d2
cmp dword [esi + 8], 0
jne 0x4582c5
mov ecx, dword [eax + 8]
push 0x4c37fc
push ecx
call fcn.0049e289
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4582c5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.0049e531
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4582f4
mov eax, dword [esi + 8]
test eax, eax
je 0x4582ee
push eax
call fcn.0049e5bb
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x459070
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x45909b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x4590e2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x4590e5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x459146
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x459110
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x45917f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x4c39c4
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x4c39c5
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x459150
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48e290
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x48e2a0
xor eax, eax
jmp 0x48e43d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x48e3fe
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8888]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c8888]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c8888]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8888]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c8888]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c8888]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8888]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c8888]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x48e2a9
cmp dword [ebp + 0x10], 0
je 0x48e437
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8888]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x48e404
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x48e440
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c8888]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c8888]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x4e49d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jl 0x5aa523

Function at 0x55d36f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xc
pushfd
mov byte [esp], dh
lea esp, [esp + 4]
jmp fcn.005b4228

Function at 0x55ee01
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esi
push 0x8a6b30e6
movzx di, dl
push dword [esp]
mov edi, dword [esp]
mov edi, eax
mov dword [esp], eax
lea esp, [esp + 8]
call fcn.004ea751
bsf ebx, eax
shr bh, 1
shld bx, ax, 0xd
mov ebx, dword [ebp - 4]
adc si, ax
rcl si, 1
mov esi, dword [ebp - 8]
cmp ebp, 0x60938a28
add esp, 4
pushal
mov byte [esp], 0x8c
mov byte [esp + 0xc], 0x6f
lea esp, [esp + 0x20]
jmp fcn.005b4228

Function at 0x56654f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp al, 0xf
pushal
jmp 0x5adf23
mov byte [esp], ch
mov dword [esp], edx
mov dword [esp + 0x38], 0x200
pushfd
jmp 0x570cf5
push dword [esp + 0x10]
jmp 0x5ba065
bswap edx
push eax
pushfd
lea edx, [eax*2 + 0x4cdde7ba]
mov edx, dword [esp]
call fcn.0056513a
mov byte [ebp + ebp*4 + 0x72], bl
mov al, 0xd9
inc edi
or al, 0xa7
adc byte [edx], 0xed
jne 0x574d58
pop ebp
int3
add sp, dx
sub ah, byte [esi + 0x2e9bc2cd]
leave
xchg edi, eax
mov dword [0x69649a6f], eax
salc
scasd eax, dword es:[edi]
mov ss, word [ebx + 0x51807ba0]
or esp, ecx
or ebx, esp
or esp, ebx
jp 0x574d7c
xchg edx, eax
lahf
mov byte [0x4595c270], al
sbb al, al
pushfd
pop ds
int1
jmp 0x6d70f0a
mov ch, 0xd9
mov ch, 0x38
pop es
jno 0x574d12
invalid
mov al, 0x88
inc ecx
adc dh, dh
int3
mov eax, 0x4f6fb8
pushfd
pushfd
push eax
pushfd
lea esp, [esp + 0x38]
je 0x586b69
rdtsc
cwde
cwde
mov eax, 0x4f6fc4
movsx edx, dl
movzx ecx, byte [edi + ebx]
jmp 0x5b37a2
jmp 0x5a9cb2
push ecx
movsx dx, al
jmp 0x574ceb
mov dword [esp + 0x3c], edx
pushfd
pushfd
lea esp, [esp + 0x44]
call fcn.004eaa35
not ax
inc ah
sete al
xor ax, 0xd653
add esp, 0x20
push 0xba997835
inc ah
mov eax, edi
push 0x2bd406a5
and eax, 0xf
cmc
stc
jmp 0x4e41e1

Function at 0x567bd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x48]
call fcn.004ea751
btc ebx, ebx
pushal
mov ebx, dword [ebp - 4]
shrd si, cx, cl
pushfd
mov esi, dword [ebp - 8]
test dl, 0x91
push esi
jmp 0x5835d1
pushfd
add esp, 0x30
push 0xcacda7a4
lea esp, [esp + 4]
jmp fcn.005b4228

Function at 0x569c8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [ebp - 4]
sal si, 2
not si
ror si, cl
mov esi, dword [ebp - 8]
mov byte [esp], bl
push dword [esp]
add esp, 0xc
push edi
lea esp, [esp + 4]
jmp fcn.005b4228