joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed100
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x6a9a60]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x420]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x14c]
push 0
add eax, 4
push eax
push dword [edi + 0x158]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x140], 0
mov dword [edi + 0x144], eax
jne 0x4ed186
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xc0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x140], eax
mov esi, dword [edi + 0x144]
cmp esi, 4
jge 0x4ed1c1
push str.Received_too_short_packet
push ebx
call fcn.004d15c0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3004
add esp, 0x88
ret
mov edx, dword [edi + 0x158]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x4ed1e0.1
jmp dword [ecx*4 + 0x4ed2ec]
cmp esi, 4
jle case.0x4ed1e0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x154]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4ed1e0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebx
call fcn.004d14f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ed23b
push 5
push edi
call fcn.004edc90
add esp, 8
mov eax, esi
jmp 0x4ed1a8
mov eax, dword [edi + 0x144]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.004df1a0
jmp 0x4ed2c1
movzx ecx, byte [edx + 2]
lea ebp, [edx + 4]
movzx eax, byte [edx + 3]
add esi, 0xfffffffc
shl ecx, 8
or ecx, eax
push esi
push ebp
mov dword [edi + 8], ecx
call fcn.004edd00
add esp, 8
cmp eax, esi
jae case.0x4ed1e0.4
push ebp
push str.TFTP_error:__s_n
push ebx
call fcn.004d1680
jmp 0x4ed2c1
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.004ece90
add esp, 0xc
test eax, eax
je case.0x4ed1e0.4
jmp 0x4ed1a8
push str.Internal_error:_Unexpected_packet
push 0x61217c
push ebx
call fcn.004d15c0
add esp, 0xc
push ebx
call fcn.004df580
add esp, 4
test eax, eax
je 0x4ed1a6
push 5
push edi
call fcn.004edc90
add esp, 8
mov eax, 0x2a
jmp 0x4ed1a8
Function at 0x4f45b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x6a9a60]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
or esi, 0xffffffff
push eax
mov ebx, dword [edi + 0xc]
mov ebp, dword [ebx + 0x14c]
push ebp
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4f4613
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push ebx
push edi
call fcn.004d2010
add esp, 0xc
cmp esi, 0xffffffff
jne 0x4f4638
push str.Error_accept__ing_server_connect
push edi
call fcn.004d15c0
add esp, 8
mov eax, 0x1e
jmp 0x4f46a8
push str.Connection_accepted_from_server_n
push edi
call fcn.004d1680
push 1
push esi
mov byte [ebx + 0x24e], 0
mov dword [ebx + 0x14c], esi
call fcn.004deea0
add esp, 0x10
mov byte [ebx + 0x261], 1
cmp dword [edi + 0x1b8], 0
je 0x4f46a6
push 1
push edi
call fcn.004c2560
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.004c2560
add esp, 0x1c
test esi, esi
je 0x4f46a6
push ebx
push edi
call fcn.004f4b40
add esp, 8
mov eax, 0x2a
jmp 0x4f46a8
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3004
add esp, 0x88
ret
Function at 0x4f65e0
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x4f6610
push str.Couldnt_set_desired_mode
push esi
call fcn.004d15c0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x4f6627
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.004d1680
add esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
cmp eax, 0x13
jne 0x4f6642
push ebx
push esi
call fcn.004f64e0
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x4f6753
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp dword [esi + 0x4e8], 2
mov dword [esp + 0x18], edi
jne 0x4f66c1
mov eax, dword [esi + 0x134]
mov eax, dword [eax]
test eax, eax
je 0x4f66c1
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
push esi
call fcn.004ea3f0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4f6780
push 0x2f
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x4f66b0
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x4f66bd
push dword [esp + 0x14]
call dword [0x6a9a7c]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x52c]
test ecx, ecx
jne 0x4f66df
cmp byte [esi + 0xce5], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x611ea8
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x612120
cmove eax, edx
push eax
push ecx
push 0x62c0ac
call fcn.004e1ef0
push ebx
mov ebp, eax
call dword [0x6a9a7c]
add esp, 0x14
test ebp, ebp
jne 0x4f671c
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x61217c
lea eax, [edi + 0x420]
push eax
push esi
call fcn.00504c20
push ebp
mov edi, eax
call dword [0x6a9a7c]
add esp, 0x14
test edi, edi
jne 0x4f6780
mov eax, dword [esi + 0xc]
pop ebp
mov dword [eax + 0x4a4], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x4f676c
push 0xd
push 1
push esi
call fcn.004f6060
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x4f6780
push 0xe
push 1
push esi
call fcn.004f6060
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x507720
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6a9a78]
mov edi, eax
add esp, 4
test edi, edi
jne 0x507747
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x507792
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x507796
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x5077f6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x5077b5
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x507827
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x636180
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x636181
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x507800
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x507830
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.004d3ea0
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x6a9a78]
mov edi, eax
add esp, 8
test edi, edi
je 0x507998
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5078ac
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x507911
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x5078d0
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x50793d
mov eax, dword [esi + 4]
push 1
push 0x636180
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x636181
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x507916
push dword [esp + 0x28]
call fcn.004d3ea0
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x507968
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x6a9a7c]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x572fe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x573007
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x572ff6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x593870
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.004b3cc0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.00550720
mov ebx, eax
push ebx
push esi
call fcn.00550600
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x5938ef
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5938d3
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00550670
push esi
call fcn.005507c0
add esp, 0x10
test eax, eax
jne 0x593969
push 1
push esi
call fcn.00550720
mov ebx, eax
push ebx
push esi
call fcn.00550600
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x593960
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x593944
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00550670
push esi
call fcn.005507c0
add esp, 0x10
test eax, eax
jne 0x593969
push esi
call fcn.005507c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5acf70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004b3cc0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x10], edi
test edi, edi
je 0x5acfb9
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x5acfb9
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x10], edi
jne 0x5acfa0
mov edx, dword [esp + 0x2c]
movzx ecx, byte [edx + 0xc]
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x24], ecx
cmp esi, 0x10
jb 0x5ad08a
nop dword [eax]
mov eax, esi
mov edx, ecx
shr eax, 4
xor edi, edi
add ecx, eax
cmp ecx, eax
cmovae edi, ecx
neg edx
mov dword [esp + 0x24], edi
cmp ecx, eax
mov edi, dword [esp + 0x2c]
push edi
push dword [esp + 0x2c]
cmovae edx, eax
push edx
push ebx
push ebp
mov dword [esp + 0x28], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x5ad066
mov edx, 0xc
mov eax, 1
nop
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x5ad050
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, edx
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x5acff0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x5ad0f8
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push edx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x5ad0d9
push edx
call fcn.005ad140
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x5ad0e6
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x5ad730
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.004b3cc0
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x5ad74f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x5ad81f
jb 0x5ad774
test eax, eax
jne 0x5ad81f
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x16c]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x5ad7c0
nop
test esi, esi
je 0x5ad811
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x5ad790
lea eax, [ebp + 0x60]
push eax
lea ebx, [ebp + 0x40]
push ebx
call fcn.005aedd0
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x5ad7c3
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x5ad7e5
push eax
push edi
push ecx
push ebx
call fcn.005aeba0
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x5ad80d
mov ecx, esi
nop dword [eax + eax]
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x5ad7f0
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x5ae980
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.004b3cc0
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebp, 0xc
jne 0x5ae9eb
mov eax, dword [esp + 0x24]
lea ebx, [ebp - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x5aeb1a
push edi
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x40], edi
lea ebx, [esi + 0x40]
mov dword [ebx + 4], edi
lea edx, [esi + 0x60]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], edx
cmp ebp, 0x10
jb 0x5aea7f
mov eax, ebp
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], eax
lea edx, [edi + 2]
mov eax, ecx
mov ebx, 4
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x5aea30
push dword [esp + 0x14]
push esi
call fcn.005aedd0
mov ecx, dword [esp + 0x20]
add esp, 8
add edi, 0x10
sub ebp, 0x10
sub dword [esp + 0x2c], 1
jne 0x5aea23
mov esi, dword [esp + 0x24]
lea ebx, [esi + 0x40]
lea edx, [esi + 0x60]
test ebp, ebp
je 0x5aea9e
mov ecx, ebx
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebp, 1
jne 0x5aea85
push edx
push ebx
call fcn.005aedd0
add esp, 8
mov edx, dword [esp + 0x1c]
xor eax, eax
shld eax, edx, 3
xor byte [esi + 0x4b], al
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x24]
shl edx, 3
xor byte [esi + 0x4f], dl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, edi
xor byte [esi + 0x4c], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [esi + 0x4d], cl
shrd eax, edi, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
push ebx
call fcn.005aedd0
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
mov ecx, dword [esi + 0x44]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [esi + 0x40]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
pop edi
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5b6240
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5b6254
mov dword [esp + 0x18], fcn.005b4a20
jmp fcn.005acc90
mov dword [esp + 0x18], fcn.005b3cc0
jmp fcn.005ac990
Function at 0x5f6b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.004b3cc0
mov eax, dword [0x6a9a60]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x5f6d25
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x5f6cb5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.005f6590
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x5f6c50
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x5f6d0c
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004b3004
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3004
add esp, 0x28
ret
Function at 0x85389c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8538a6
pushal
call 0x8538ac
pop ebp
sub ebp, 0x10
sub ebp, 0x45389c
jmp 0x8538c2
mov eax, 0x45389c
add eax, ebp
add eax, 0x4c
mov ecx, 0x60b
mov edx, 0x121ef3e9
xor byte [eax], dl
inc eax
dec ecx
jne 0x8538d9
jmp 0x8538ec
bound esp, qword [edx]
pushal
aad 0xe9
jmp 0x11ada1e0