joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x7826d4]
push ebx
cmp eax, 0xe00e0804
je 0x538fce
cmp eax, 0xe0090404
je 0x538fce
mov ebx, dword [0x782788]
test ebx, ebx
je 0x538fce
xor cl, cl
mov edx, 0x404
mov byte [ebp - 0x109], cl
cmp ax, dx
jne 0x538fbd
movups xmm0, xmmword [str.softwaremicrosoftwindowscurrentversion_]
mov ax, word [0x6cec68]
and ebx, 0xffff0000
mov word [ebp - 0xe0], ax
cmp ebx, 0x5010000
mov al, byte [0x6cec6a]
mov edx, str.MSTCIPH
movups xmmword [ebp - 0x108], xmm0
mov byte [ebp - 0xde], al
mov eax, str.TINTLGNT
movups xmm0, xmmword [0x6cec50]
push esi
cmovb edx, eax
movups xmmword [ebp - 0xf8], xmm0
mov esi, edx
movq xmm0, qword [0x6cec60]
push edi
movq qword [ebp - 0xe8], xmm0
mov al, byte [edx]
inc edx
test al, al
jne 0x538eb4
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x538ec4
mov ecx, edx
lea eax, [ebp - 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
mov ecx, edx
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x538fa8
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 4
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.Keyboard_Mapping
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x538f85
mov eax, dword [ebp - 0x118]
cmp ebx, 0x5000000
ja 0x538f50
cmp al, 0x22
je 0x538f66
cmp al, 0x23
je 0x538f66
cmp ebx, 0x5010000
je 0x538f60
cmp ebx, 0x5020000
jne 0x538f85
sub al, 0x22
cmp al, 2
ja 0x538f85
push dword [ebp - 0x110]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x110]
mov bl, byte [ebp - 0x109]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x109]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
Function at 0x5391f0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7826c8], 0
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
jne 0x5393b8
cmp byte [0x7843e0], 0
mov dword [0x7826d0], eax
jne 0x539252
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x539252
push 0x7843dc
push 0x6ceb70
push 1
push 0
push 0x7054d0
mov byte [0x7843e0], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x7826e8
mov dword [0x7826e8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x105
lea eax, [ebp - 0x10c]
mov byte [0x7826c9], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x53933a
lea ecx, [ebp - 0x10c]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x539290
mov eax, dword [0x6ceb80]
mov dword [ecx], eax
mov eax, dword [0x6ceb84]
mov dword [ecx + 4], eax
mov ax, word [0x6ceb88]
mov word [ecx + 8], ax
mov al, byte [0x6ceb8a]
mov byte [ecx + 0xa], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x78277c], eax
test eax, eax
je 0x539333
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
push str.ImmUnlockIMC
push dword [0x78277c]
mov dword [0x7826b0], eax
call esi
push str.ImmLockIMCC
push dword [0x78277c]
mov dword [0x7826b4], eax
call esi
push str.ImmUnlockIMCC
push dword [0x78277c]
mov dword [0x7826b8], eax
call esi
push str.ImmDisableTextFrameService
push dword [0x78277c]
mov dword [0x7826bc], eax
call esi
pop esi
test eax, eax
je 0x53933a
push 0xffffffffffffffff
call eax
jmp 0x53933a
mov byte [0x7826c9], 1
push dword [0x7826d0]
mov byte [0x7826c8], 1
call sub.IMM32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
push dword [0x7826d0]
call sub.IMM32.dll_ImmReleaseContext
call fcn.00538100
call fcn.005380d0
push 2
call fcn.0053a330
add esp, 4
call fcn.0053a6f0
test eax, eax
setne byte [0x7826ca]
call fcn.00538270
cmp byte [0x7826ca], 0
je 0x5393b8
mov eax, dword [0x7826d4]
and eax, 0x3ff
cmp eax, 4
jne 0x5393a7
call fcn.005384b0
test eax, eax
je 0x5393a7
mov al, 1
jmp 0x5393a9
xor al, al
push 0
mov byte [0x7826cd], al
call fcn.0053a8b0
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret 4
Function at 0x539a20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a8110
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x838], eax
cmp byte [eax + 0x20], 0
je 0x539c3f
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x539c3f
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
mov dword [ebp - 0x834], esi
test esi, esi
je 0x539a9d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov dword [ebp - 0x830], edi
test edi, edi
jne 0x539aa8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x539c3f
mov esi, edi
mov dword [ebp - 0x818], 0
xorps xmm0, xmm0
mov dword [ebp - 0x814], 0
movups xmmword [ebp - 0x828], xmm0
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x539ad0
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x539c5a
cmp esi, 0xf
ja 0x539b12
push esi
lea eax, [ebp - 0x828]
mov dword [ebp - 0x818], esi
push edi
push eax
mov dword [ebp - 0x814], 0xf
call fcn.00643a30
mov byte [ebp + esi - 0x828], 0
jmp 0x539b89
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x539b31
mov eax, bind
mov edi, bind
push eax
call fcn.0043e900
jmp 0x539b57
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
test eax, eax
je 0x539b5a
cmp eax, 0x1000
jb 0x539b51
push eax
call fcn.0043e900
jmp 0x539b57
push eax
call fcn.005c8dfe
add esp, 4
push esi
push dword [ebp - 0x830]
mov dword [ebp - 0x82c], eax
push eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x814], edi
call fcn.00643a30
mov eax, dword [ebp - 0x82c]
mov byte [eax + esi], 0
add esp, 0xc
push dword [ebp - 0x834]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x539c09
cmp dword [ebp - 0x814], 0xf
lea ecx, [ebp - 0x828]
push 0x400
cmova ecx, dword [ebp - 0x828]
lea edx, [ebp - 0x810]
push edx
add eax, ecx
sub eax, ecx
push eax
push ecx
push 0
push dword [0x7843cc]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x539c09
mov ecx, dword [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.005393d0
mov ecx, dword [0x783bb0]
test ecx, ecx
je 0x539c09
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xf
jbe 0x539c3f
mov edx, dword [ebp - 0x828]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x539c35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x539c5f
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.00444010
call fcn.0064e36a
int3
Function at 0x53c3c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x53c3d9
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x541c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a8605
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x73c280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x541c3a
mov edx, dword [edi]
mov ecx, dword [edi + 0x10]
xor ebx, ebx
add ecx, edx
mov dword [ebp + 0xc], ebx
cmp edx, ecx
jae 0x541c63
nop dword [eax + eax]
movzx eax, byte [edx]
inc edx
imul ebx, ebx, 0x1000193
xor ebx, eax
cmp edx, ecx
jb 0x541c50
mov dword [ebp + 0xc], ebx
movzx ecx, byte [esi]
and ecx, 1
inc ecx
add ecx, esi
lea eax, [ecx + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push edi
push ebx
mov ecx, esi
call fcn.00541e40
mov ecx, eax
test ecx, ecx
je 0x541ca2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ebx, [esi + 3]
mov dword [ebp - 0x18], 0
lea eax, [ebx + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00543670
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp + 0x10]
push esi
lea ecx, [edi + 8]
call fcn.0043ee60
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x20], eax
mov dword [ebp - 0x18], 0
call fcn.00542060
mov esi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp dword [ebx + 0x14], 0
mov eax, dword [ebx + 8]
lea edi, [eax + 1]
jne 0x541d23
push edi
mov ecx, ebx
call fcn.005438d0
mov ecx, dword [ebx + 4]
cmp ecx, eax
cmovb ecx, eax
push ecx
mov ecx, ebx
call fcn.00543510
jmp 0x541d50
cmp edi, dword [ebx + 0x10]
jbe 0x541d50
mov ecx, eax
mov edx, 1
shr ecx, 1
add eax, ecx
cmp edi, eax
cmovb edx, ecx
mov ecx, ebx
add edx, dword [ebx + 8]
push edx
call fcn.005438d0
cmp eax, dword [ebx + 4]
je 0x541d50
push eax
mov ecx, ebx
call fcn.00543a30
mov eax, dword [ebp + 0xc]
xor edx, edx
div dword [ebx + 4]
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], 0
lea edi, [eax + edx*4]
and edx, 0x7fffffff
mov dword [esi + 4], edx
mov eax, dword [edi]
test eax, eax
jne 0x541d98
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x14]
lea ecx, [edx + eax*4]
mov eax, dword [ecx]
test eax, eax
je 0x541d8e
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [edx + eax*4], esi
mov dword [edi], ecx
mov eax, dword [ecx]
mov dword [esi], eax
mov dword [ecx], esi
jmp 0x541da0
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [eax], esi
inc dword [ebx + 8]
lea ecx, [ebp - 0x1c]
call fcn.00542080
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5436f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ecx]
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 1
push esi
push edi
lea edi, [ecx + 1]
mov dword [ebp - 4], ecx
add edi, eax
mov ecx, ebx
lea eax, [edi + 1]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0xf
jbe 0x54371b
mov ecx, dword [ebx]
mov esi, dword [ebx + 0x10]
xor edx, edx
add esi, ecx
cmp ecx, esi
jae 0x543736
movzx eax, byte [ecx]
inc ecx
imul edx, edx, 0x1000193
xor edx, eax
cmp ecx, esi
jb 0x543726
mov ecx, dword [ebp - 4]
push edi
push ebx
push edx
call fcn.00541e40
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x543a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
call fcn.00543510
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x14]
lea edi, [eax + ecx*4]
mov dword [ebp + 8], edi
mov edi, dword [edi]
test edi, edi
je 0x543aff
push ebx
nop word [eax + eax]
cmp dword [edi + 0x1c], 0xf
lea eax, [edi + 8]
mov esi, edi
jbe 0x543a6e
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x18]
xor edx, edx
add ebx, eax
cmp eax, ebx
jae 0x543a90
nop dword [eax]
movzx ecx, byte [eax]
inc eax
imul edx, edx, 0x1000193
xor edx, ecx
cmp eax, ebx
jb 0x543a80
mov ebx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ebx + 4]
mov eax, edx
and eax, 0x7fffffff
mov dword [edi + 4], eax
mov eax, dword [edi]
test eax, eax
je 0x543ad0
nop word [eax + eax]
mov ecx, dword [eax + 4]
shr ecx, 0x1f
not ecx
test cl, 1
jne 0x543ad0
mov ecx, edx
mov esi, eax
or ecx, 0x80000000
mov dword [eax + 4], ecx
mov eax, dword [eax]
test eax, eax
jne 0x543ab0
mov eax, dword [ebx + 0x14]
lea ecx, [eax + edx*4]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
jne 0x543ae8
mov dword [ecx], edx
mov edi, dword [esi]
mov dword [ebp + 8], esi
jmp 0x543af6
mov eax, dword [eax]
mov edi, dword [esi]
mov dword [esi], eax
mov ecx, dword [ecx]
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], edi
test edi, edi
jne 0x543a60
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x544c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a89b5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x40
movups xmmword [ebp - 0x28], xmm0
call fcn.005c8dfe
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov ecx, eax
mov dword [ebp - 0x18], 0x37
add esp, 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x6d00e0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x6d00f0]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x6d0100]
mov dword [ecx + 0x30], eax
mov ax, word [0x6d0104]
mov word [ecx + 0x34], ax
mov al, byte [0x6d0106]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0043ee60
mov ecx, dword [ebp - 0x14]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x544d35
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x544d2b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x544d57
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.0064e36a
int3
Function at 0x544df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a89b5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x40
movups xmmword [ebp - 0x28], xmm0
call fcn.005c8dfe
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov ecx, eax
mov dword [ebp - 0x18], 0x37
add esp, 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x6d00e0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x6d00f0]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x6d0100]
mov dword [ecx + 0x30], eax
mov ax, word [0x6d0104]
mov word [ecx + 0x34], ax
mov al, byte [0x6d0106]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0043ee60
mov ecx, dword [ebp - 0x14]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x544ee5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x544edb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x544f07
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.0064e36a
int3

Function at 0x5472e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x13e4], 0x20
je 0x5472f6
xor al, al
pop esi
pop ebp
ret 4
cmp byte [esi + 0x365], 0
jne 0x547332
push edi
lea edi, [esi + 0x13d4]
xor ecx, ecx
cmp dword [edi + 0x14], 0xf
jbe 0x547310
mov edi, dword [edi]
mov edx, dword [ebp + 8]
xor dword [edi + ecx*4], edx
inc ecx
mov eax, dword [esi + 0x13e4]
add edx, 0x1000193
shr eax, 2
cmp ecx, eax
jne 0x547313
pop edi
mov byte [esi + 0x365], 1
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x54cf90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a9285
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x40]
push eax
call fcn.0043ee60
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00509fd0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0054ced0
add esp, 0xc
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmova eax, edi
add esi, eax
mov byte [ebp - 4], 1
xor edx, edx
cmp eax, esi
jae 0x54d030
nop word [eax + eax]
movzx ecx, byte [eax]
inc eax
imul edx, edx, 0x1000193
xor edx, ecx
cmp eax, esi
jb 0x54d020
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], edx
push eax
call fcn.005436b0
mov esi, dword [eax]
test esi, esi
jne 0x54d04f
mov byte [ebp - 0x41], 0
jmp 0x54d0b4
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmova eax, dword [ebp - 0x40]
push eax
call fcn.0050c4f0
mov edi, eax
mov byte [ebp - 0x41], 1
mov eax, 0xaaaaaaab
add esp, 8
mul edi
movd xmm0, edi
pshufd xmm2, xmm0, 0
movaps xmm1, xmm2
mov eax, dword [ebp - 0x50]
shr edx, 1
lea ecx, [edx + edx*2]
sub edi, ecx
mov ecx, dword [ebp - 0x58]
mov dword [eax], edi
movups xmm0, xmmword [esi + 0xc]
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x28]
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [eax]
xorps xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [ecx]
xorps xmm2, xmm0
movups xmmword [ecx], xmm2
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x54d0e3
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x54d0d9
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d145
push ecx
push edi
call fcn.005c8a85
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x54d125
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x54d11b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d145
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret 0x10
call fcn.0064e36a
int3
Function at 0x54d150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a307d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x73c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.0043ee60
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00509fd0
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
add esp, 4
cmp dword [ebp - 0x14], 0xf
cmova ecx, esi
xor edx, edx
add edi, ecx
cmp ecx, edi
jae 0x54d1d0
nop
movzx eax, byte [ecx]
inc ecx
imul edx, edx, 0x1000193
xor edx, eax
cmp ecx, edi
jb 0x54d1c0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], edx
push eax
add ecx, 0x18
call fcn.005436b0
mov eax, dword [eax]
test eax, eax
je 0x54d201
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x34]
sub ecx, dword [eax + 0x24]
mov dword [edx], ecx
test ecx, ecx
jg 0x54d22a
mov dword [ebx], 0
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x54d23d
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x54d233
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d25d
jmp 0x54d233
mov eax, dword [eax + 0x24]
mov dword [ebx], eax
mov bl, 1
jmp 0x54d203
push ecx
push esi
call fcn.005c8a85
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret 0xc
call fcn.0064e36a
int3