joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587c10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0049f020
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor edi, edi
call fcn.0056ec30
add esp, 0xc
test eax, eax
je 0x587c70
lea esp, [esp]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x587c52
add edi, 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
add ebp, 1
push ebp
call fcn.0056ec30
add esp, 0xc
test eax, eax
jne 0x587c40
test edi, edi
jne 0x587c94
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.004ea090
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv edi
cmp edi, 1
push ebx
mov ebx, eax
jne 0x587cab
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
push esi
push 0
push eax
call fcn.0048cf80
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.0056ec30
add esp, 0x18
test eax, eax
je 0x587d93
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
shl eax, 0xa
test ecx, eax
je 0x587d6d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x587da0
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push esi
push ebp
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x5c]
and edx, 1
add edx, ebx
push edx
mov edx, dword [esp + 0x68]
push edi
push eax
call fcn.00587810
add esp, 0x34
test eax, eax
je 0x587dbe
add edi, ebx
test esi, esi
jle 0x587d6d
mov eax, dword [esp + 0x54]
mov ecx, ebp
sub ecx, eax
mov ebp, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub ebp, 1
jne 0x587d60
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
add eax, 1
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.0056ec30
add esp, 0xc
test eax, eax
jne 0x587ce0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004ea090
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x58a1f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0049f020
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x64]
add ebp, 1
test byte [ecx + 0x38], 1
je 0x58a23a
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
lea edx, [ecx + ebp]
cmp edx, eax
jbe 0x58a22d
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
jmp 0x58a245
mov eax, dword [esp + 0x18]
cmp ebp, dword [eax + 4]
ja 0x58a226
mov esi, eax
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + edx - 1]
je 0x58a29a
cmp dword [edi + 0x88], 0
jne 0x58a29a
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x5f424c
push eax
call fcn.004fb8c0
add esp, 0xc
test eax, eax
jne 0x58a28b
test bl, 1
jne 0x58a28b
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov ecx, dword [edi + 0x58]
test byte [ecx], 8
je 0x58a29a
test ebx, ebx
jbe 0x58a29a
sub ebx, 1
mov edx, dword [edi + 0x80]
mov eax, dword [edx]
push eax
call fcn.00517e50
add esp, 4
test eax, 0x200000
je 0x58a2c5
or ecx, 0xffffffff
sub ecx, ebx
add dword [esi + 4], ecx
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea eax, [ebx + ebp]
mov esi, edi
sub esi, eax
xor esi, eax
mov edx, edi
xor edx, eax
or esi, edx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
sub esi, 1
cmp eax, ecx
mov dword [esp + 0x18], ecx
jae 0x58a2f5
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebp, ebp
test ecx, ecx
jbe 0x58a34e
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea eax, [edi + edx - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
mov edx, ebx
sub edx, ebp
shr edx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
sub dl, 1
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
sub dword [esp + 0x24], 1
xor edx, ebx
and eax, edx
not eax
add ebp, 1
and esi, eax
cmp ebp, dword [esp + 0x18]
jb 0x58a313
mov edx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [ebx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [edx], eax
pop ebx
mov dword [edx + 4], edi
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x58a390
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.0049f020
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x18], esi
sub esi, edi
xor ebp, ebp
cmp ebx, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
jae 0x58a3fa
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.004fb890
add esp, 0xc
cmp edi, 0x40
jbe 0x58a416
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.004fb890
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
cmp ebx, edx
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x1c], ecx
jbe 0x58a440
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x10], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call fcn.0048cf80
mov edx, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
cmp edx, dword [esp + 0xc4]
jae 0x58a525
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edx, ecx
mov ebx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0xc]
shr eax, 0x1f
shr ebx, 0x1f
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
jmp 0x58a4b8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add ecx, ebx
shr ecx, 0x1f
xor cl, al
mov edx, ebp
shr edx, 0x1f
xor al, dl
or cl, al
mov eax, ebx
mov bl, byte [esp + 0x2c]
shr eax, 0x1f
xor al, bl
xor bl, dl
or al, bl
xor al, dl
sub al, 1
xor cl, dl
mov edx, dword [esp + 0x14]
mov dl, byte [edx + ebp]
not al
add dword [esp + 0x10], 1
and al, dl
sub cl, 1
and al, cl
mov ecx, dword [esp + 0x1c]
or byte [esi + ecx], al
add esi, 1
mov eax, esi
sub eax, edi
xor eax, edi
mov ecx, esi
xor ecx, edi
or eax, ecx
xor eax, esi
shr eax, 0x1f
neg eax
add ebp, 1
and esi, eax
cmp ebp, dword [esp + 0xc4]
jb 0x58a4b0
mov ebx, dword [esp + 0x24]
xor eax, eax
test edi, edi
jbe 0x58a565
jmp 0x58a530
mov esi, dword [esp + 0x1c]
mov edx, ebx
xor edx, 0x20
mov cl, byte [edx + esi]
mov dl, byte [ebx + esi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + eax], dl
add ebx, 1
mov edx, ebx
sub edx, edi
xor edx, edi
mov ecx, ebx
xor ecx, edi
or edx, ecx
xor edx, ebx
shr edx, 0x1f
neg edx
add eax, 1
and ebx, edx
cmp eax, edi
jb 0x58a530
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048b951
add esp, 0xa4
ret
Function at 0x5962e0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004ea690
add esp, 8
test esi, esi
jg 0x59633e
je 0x59631c
cmp esi, 0xffffffff
jne 0x59633e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x596333
cmp eax, 0xb
je 0x596333
cmp eax, 0x2733
jne 0x59633e
push 0xa
push edi
call fcn.004ea6b0
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x596d00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x20]
cmp dword [esi], 6
je 0x596d17
call fcn.005966d0
test eax, eax
jle 0x596d60
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push ebx
mov esi, eax
call fcn.004ea690
add esp, 8
test esi, esi
jg 0x596d5e
push esi
call fcn.00596240
add esp, 4
test eax, eax
je 0x596d5e
push 0xa
push ebx
call fcn.004ea6b0
add esp, 8
mov eax, esi
pop esi
pop ebx
ret

Function at 0x598f70
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x598fb1
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.004ea090
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x598fc0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebp
mov ebx, 1
call fcn.00598eb0
mov edi, eax
add esp, 4
test edi, edi
jge 0x598ffc
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.004ea090
add esp, 0x14
jmp 0x5990ba
call fcn.00598e30
cmp eax, 1
jne 0x5990ca
test edi, edi
jle 0x599015
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.004fb8f0
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x599050
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.004ea090
add esp, 0x14
jmp 0x5990a0
cmp word [eax + 8], 2
je 0x599071
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.004ea090
add esp, 0x14
jmp 0x5990a0
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx]
mov byte [esi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx + 2]
mov byte [esi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
mov byte [esi + 3], cl
xor ebx, ebx
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.004fb8f0
add esp, 0x10
test ebx, ebx
je 0x5990d1
push ebp
push 0x5f50a4
push 2
call fcn.004ea3b0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x489252
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
jmp 0x4421ed
pop edx
test edx, edx
jmp 0x4b9345
lea edi, [ebp - 0x104]
push edi
jmp 0x4467a8
jg 0x47874c
add al, 0x20
jmp 0x47874c
jl 0x47874c
cmp al, 0x5b
jmp 0x423428
mov ebp, esp
add esp, 0xfffffef4
jmp 0x405038
push edx
push edi
jmp 0x4d8e05
lea edx, [ecx + 0x30]
push dword [edx]
jmp 0x409994
jmp 0x45c5f9
xor ebx, ebx
jmp 0x4efec9
xor eax, dword [ebp + 0xc]
jne 0x469496
jmp 0x45c5f6
mov edi, dword [ecx + 0x18]
test ax, ax
jne 0x4efec9
jmp 0x4b1ef5
pop ecx
mov ecx, dword [ecx]
jmp 0x4173dd
stosb byte es:[edi], al
inc ebx
jmp 0x45fa87
pop ecx
push dword [ecx + 0xc]
jmp 0x469495
push ebp
jmp 0x43a59e
pop ecx
push dword [ecx + 0xc]
jmp 0x478fc2
pop eax
call fcn.0041cd33
jmp 0x450c4c
jne 0x44f2db
mov edi, dword [ebp + 0xc]
jmp 0x44f2d6
je 0x4df826
mov edi, dword [ebp + 8]
jmp 0x4df821
push esi
cmp dword [ebp + 8], 0
jmp 0x4c3ac4
push dword fs:[0x30]
jmp 0x48fe85
mov ax, word [edx + ebx*2]
cmp al, 0x40
jmp 0x424db1

Function at 0x4a97a0
Capabilities:
Encode data using xor

Disassembly:
call 0x72a0220a
mov edx, dword [ebx - 0x5dc554d0]
xor eax, 0x2b12db92
mov al, 3
invalid
sti
xchg edx, eax
xchg ebx, eax
dec ebx
wait
fst dword [ecx]
or cl, dl
add esp, dword [ebx]
clc
xor al, 0x80
psrld mm3, qword [ecx + 0x2a]
jmp 0x4a96ba
fisttp dword [edi]
scasd eax, dword es:[edi]
jb 0x4a96c7
xchg ebx, eax
xor byte [ebx - 0x6c8e046e], ch
push ebx
mov al, 0x43
imul edi, dword [eax - 0x16074ff8], 0x47
xchg ebp, eax
cld
jb 0x4a973c
xchg ebx, eax
xor byte [ebx + 0x236b6b92], ch
xor esp, dword [ecx + 0x60200860]
and dl, byte [esi + 0x2aa1517b]
mov edx, dword [ebx - 0x46d54d0]
mov edx, dword [ebx + 0x50dbbb09]
push eax
adc dword [ebx], 0x21dbbb39
pushal
mov ebx, 0x28233843
push esi
jb 0x4a9712
xchg ebx, eax
xor byte [ebx - 0x6c6d046e], ch
push ebx
mov ebx, 0x508839d9
mov eax, 0x76d06008
xor eax, dword [ebx + 0x2a894b0f]
mov edx, dword [ebx + 0x6b92ab30]
mov edx, dword [ebx + 0x28939aa9]
invalid
invalid
xchg ebx, eax
invalid
test eax, 0xd828939a
shr dword [esi - 0x25], cl
xchg ebx, eax
cwde
jb 0x4a9737
fcom st(3)
outsb dx, byte [esi]
fist dword [ebx - 0x6c748d68]
xchg ebx, eax
xor byte [ebx - 0x6c74046e], ch
sti
pop ebx
fldcw word [ecx + 0x60]
sub byte [eax + 0x18520fc1], al
jae 0x4a9798
dec ecx
xchg ebx, eax
xor edx, dword [ebx]
and edx, 0xffffff8a
mov dl, 0xe8
inc ecx
test al, 0x41
xchg ebx, eax
push ecx
and byte [ecx + 0x6b0bab09], bl
imul esp, dword [eax + 0x20b85950], 0x954750f8
mov al, byte [0x20b85950]
clc
push eax
inc edi
xchg ebp, eax
outsd dx, dword [esi]
xchg ebx, eax
xchg ebx, eax
sar byte [edx + 0x32], cl
stosd dword es:[edi], eax
dec ecx
push eax
xchg ebx, eax
xchg esp, eax
mov al, byte [0xe93293f1]
stosd dword es:[edi], eax
stc
inc dword [ebx - 0x16b83bb9]
aas
or dword [ebx - 0x6cf912cd], ebp
jle 0x4a97d5
sub dword [edx], edi
sbb dword [edi + eax*2 + 0x7b], 0xffffffa3
jo 0x4a97a4
and eax, ecx
clc
aad 0xf3
inc edi
xchg ebp, eax
imul edi, dword [0x9553a300], 0xffffffa0
mov ebx, 0xf85cd5d4
daa
push ebx
push ss
lcall 0xbe2d, 0xfb4fe139
wait
test eax, 0x1bbabab
mov eax, dword [0x4d405ba]
loope 0x4a97c2
test dword [edx], edx
invalid
Function at 0x4b8fc0
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
cwde
xor eax, 0xf1199301
neg ebx
and al, 0xae
stosd dword es:[edi], eax
xchg ebx, eax
dec ecx
lodsd eax, dword [esi]
stosd dword es:[edi], eax
fcmovnb st(0), st(4)
inc edi
add ebp, dword [ebx + 0x4babaefd]
les eax, [edi + 3]
stosd dword es:[edi], eax
std
scasb al, byte es:[edi]
stosd dword es:[edi], eax
dec ebx
leave
xor dword [edx - 0xe], ebx
in eax, 0x6b
fild dword [edx + edx + 0x56db2ba9]
imul ecx, dword [ecx + 0x5c84db18], 0xfffffff9
stosd dword es:[edi], eax
sub al, bh
xchg ebx, eax
jno 0x4b8f62
adc byte [ebx + ecx*8], bl
fld xword [ebx + edi]
loopne 0x4b9007
retf
stosd dword es:[edi], eax
fstp xword [0x93ab4e81]
in eax, dx
mov bh, 0x82
fild dword [edx - 0x73b4c5f0]
dec ecx
jecxz 0x4b900b
fcmovnu st(0), st(7)
rcr al, 0x62
invalid
rcl dword [ebx - 0x15e713bd]
xchg ebx, eax
inc ebx
in al, dx
sbb dl, ch
xchg ebx, eax
popal
jno 0x4b8f74
add dword [ebx - 0x6da7fe6d], eax
nop
cmp dword [eax], 0x53
xchg ebx, eax
inc eax
and dword [eax - 0x2926c125], edi
stosd dword es:[edi], eax
xchg ebx, eax
loope 0x4b8f98
or al, ch
or ebx, dword [ebx + ebp*8 - 0x7c36446d]
sub esi, edi
cmp al, byte [edx]
push esi
and ecx, dword [ecx - 0x227199df]
popfd
jmp 0x4b8fbf
inc ecx
xchg ebx, eax
salc
out 0x93, eax
xchg ebx, eax
cmp dword [esi], 0xffffffac
invalid
Function at 0x4e4990
Capabilities:
Encode data using xor

Disassembly:
fucomi st(5)
cmpsd dword [esi], dword es:[edi]
add eax, eax
inc esi
jo 0x4e493b
and ecx, edi
inc edx
fld dword [edx - 0x6f]
inc edx
and dword [edi - 0x7c4dde9e], 0x9e125687
stosd dword es:[edi], eax
xchg ebx, eax
xor byte [ebx + 0x78e639ab], dh
nop
adc edx, ecx
stosd dword es:[edi], eax
xchg ebx, eax
mov dword [0x2fabd3e2], eax
and byte [ebx + 0xa685687], al
mov ebp, 0x21c481ab
imul ebp, dword [ebx + 0x5893db27], 0x819393ec
in eax, 0x93
mov bh, 0xab
xchg ebx, eax
add dword [esi + 0x17919383], ebp
stosd dword es:[edi], eax
aaa
dec ebx
scasb al, byte es:[edi]
adc dword [ebx + 0x37ab1791], 0x4b
xchg ebx, eax
xor dl, byte [ebx + edx*4 - 0x6d]
cmp dword [ebp - 0x6c7ceb55], ebx
dec esi
mov ecx, 0xabd3aac6
or eax, 0x9adf9383
shr dword [ebx - 0x236c7c19], cl
lcall 0xdc93, 0x83e7abd3
cwde
jbe 0x4e4931
mov ah, byte [edx]
sbb dword [ebx - 0x7c8c6567], eax
mov bh, 0xab
xchg ebx, eax
je 0x4e4977
xchg ebx, eax
add byte [ebx - 0x6cb8ccb8], ch
xchg ebx, eax
and al, 0x1c
fisttp dword [ebx + esi - 0x69]
fist dword [ebx - 0x795461f3]
add dword [edi], 0xffffffdb
xchg ebx, eax
les ebx, [edx - 0x7ca86c86]
xchg ebx, eax
or dh, byte [ebx + 0x3091bab]
add dword [edi - 0x549d7013], 0x1b
stosd dword es:[edi], eax
sbb ecx, dword [ecx]
add eax, dword [ebx + 0x628fed87]
stosd dword es:[edi], eax
sbb ecx, dword [ebx + 0x1d]
cmpsb byte [esi], byte es:[edi]
mov dl, 0xf9
ja 0x4e4a49
dec ebx
sbb eax, 0x77f9b2a6
imul edx, dword [ebx - 0xdccebb], 0xffffffab
fistp dword [ebx + 0x11]
jns 0x4e4994
xchg ebx, eax
inc ebp
xor dword [ebx], esp
jmp [ebx + 0x79115bdb]
dec ebx
sub edx, ecx
mov ds, word [ebx + 0x49]
jno 0x4e49cc
push esi
sbb al, 0x31
jae 0x4e49d7
stosd dword es:[edi], eax
xchg ebx, eax
adc eax, 0x819f633a
ret
pop ecx
sub edx, 0x5183f6ce
sbb ecx, edx
and dword [ecx - 0x6cc75213], 0xffffff81
mov esi, dword [ebx]
in eax, dx
inc ebx
cwde
cmp eax, 0x9360e76b
push ecx
enter 0x4093, 0x4b
sub dword [0xcbc8f17a], 0x74
dec ebx
xchg ebx, eax
pop ebx
imul edx, dword [ebx + 0x2d909883], 0x10fb93b0
pop ds
push 0xffffffffffffff81
in eax, dx
push ss
jnp 0x4e4a39
cmpsd dword [esi], dword es:[edi]
fcom dword [esi - 0x7d]
xchg dword [ebx - 0x23], edi
leave
outsd dx, dword [esi]
sub ebp, 0x1c
or eax, dword [eax + 0x317bdb93]
stosd dword es:[edi], eax
add byte [ecx], bh
aaa
xchg ebx, eax
stc
add byte [edi - 0x7cccf2ad], al
mov bl, 0xed
leave
xor eax, dword [ebx - 0x4d3912de]
or bl, byte [eax]
fisttp dword [ecx + 0x12aaab67]
fistp dword [ecx - 0x38]
xchg ebx, eax
lcall 0x56b4, 0xdbb60392
int1
xchg ebx, eax
sti
xchg edi, eax
jmp 0xeaf0e8ca
Function at 0x506d40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 8
mov esi, dword [edi + 0x10]
jb 0x506d5c
mov edx, dword [edi]
jmp 0x506d5e
mov edx, edi
mov ebx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 4], ebx
add esi, esi
je 0x506d84
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, esi
jb 0x506d70
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
mov dword [ebp - 0xc], 0
div dword [ecx + 0x94]
mov esi, edx
mov eax, esi
or eax, 1
mov dword [ebp - 0x14], eax
bsr eax, eax
mov dword [ebp - 0xc], eax
movzx eax, al
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
test edx, edx
je 0x506dd7
mov ecx, eax
mov edx, 1
shl edx, cl
mov eax, esi
mov ecx, dword [ebp - 0xc]
and edx, 0xfffffffe
sub eax, edx
cmp dword [ecx + eax*4], 0
setne al
test al, al
jne 0x506ddd
mov ecx, dword [ebp - 8]
push esi
call fcn.00506fb0
movzx eax, bl
mov dword [ebp - 0xc], 0
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0xd], al
movzx eax, bh
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 2]
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 1]
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
bsr eax, eax
or ebx, 1
movzx ecx, al
mov dword [ebp - 0xc], eax
mov eax, 1
shl eax, cl
and eax, 0xfffffffe
sub esi, eax
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov esi, dword [esi + ecx*4 + 4]
mov esi, dword [esi + eax*4]
test esi, esi
je 0x506e8b
nop dword [eax]
mov eax, dword [esi + 0x24]
cmp eax, ebx
ja 0x506e8b
jne 0x506e85
cmp dword [edi + 0x14], 8
lea ecx, [esi + 4]
jb 0x506e66
mov eax, dword [edi]
jmp 0x506e68
mov eax, edi
cmp dword [ecx + 0x14], 8
lea edx, [ecx + 0x10]
jb 0x506e73
mov ecx, dword [ecx]
push dword [edi + 0x10]
mov edx, dword [edx]
push eax
call fcn.004afba0
add esp, 8
test eax, eax
je 0x506e9d
mov esi, dword [esi]
test esi, esi
jne 0x506e50
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5070d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x18], 8
lea edx, [edi + 4]
mov esi, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
jb 0x5070ec
mov edx, dword [edx]
push ebx
mov ebx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 4], ebx
add esi, esi
je 0x507114
nop dword [eax + eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, esi
jb 0x507100
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x10]
xor edx, edx
mov eax, ebx
mov dword [ebp - 0xc], 0
div dword [esi + 0x94]
mov eax, edx
mov dword [ebp - 8], eax
or eax, 1
mov dword [ebp - 0x18], eax
bsr eax, eax
movzx ecx, al
mov dword [ebp - 0xc], eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x507168
mov edx, 1
shl edx, cl
mov ecx, dword [ebp - 8]
and edx, 0xfffffffe
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x14]
cmp dword [edx + eax*4], 0
setne al
test al, al
jne 0x507176
jmp 0x50716b
mov ecx, dword [ebp - 8]
push ecx
mov ecx, esi
call fcn.00506fb0
mov edi, dword [ebp + 0xc]
movzx eax, bl
mov edx, 1
mov dword [ebp - 0x14], ebx
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0x1d], al
movzx eax, bh
pop ebx
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0x1e], al
movzx eax, byte [ebp - 2]
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0x1f], al
movzx eax, byte [ebp - 1]
mov dword [ebp - 4], 0
movzx eax, byte [eax + 0x5c8950]
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x18]
bsr eax, eax
movzx ecx, al
shl edx, cl
mov dword [ebp - 4], eax
and edx, 0xfffffffe
mov eax, dword [ebp - 8]
mov ecx, dword [esi + ecx*4 + 4]
sub eax, edx
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
test eax, eax
je 0x5071ec
nop
cmp eax, edi
je 0x5071fd
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x5071e0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 8
mov esi, dword [edi]
mov dword [ecx], esi
mov al, byte [edi + 0x24]
not al
test al, 1
jne 0x507212
lea ecx, [edi + 4]
call fcn.00506c50
push edi
call int.00405150
mov ecx, dword [ebp - 0x10]
add esp, 4
dec dword [ecx + 0x8c]
test esi, esi
je 0x507237
mov al, byte [esi + 0x24]
not al
test al, 1
je 0x507237
mov esi, dword [esi]
test esi, esi
jne 0x507228
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret 8