joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51b7dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004048e4
mov eax, dword [ebp - 8]
call fcn.004048e4
mov eax, dword [ebp + 0x14]
call fcn.004048e4
mov eax, dword [ebp + 0x10]
call fcn.004048e4
xor eax, eax
push ebp
push 0x51ba0a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0xc], 0
je 0x51b841
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005164bc
jmp 0x51b876
push esi
mov eax, dword [ebp + 0x10]
call fcn.004048f4
push eax
mov eax, dword [ebp + 0x14]
call fcn.004048f4
push eax
mov eax, dword [ebp - 8]
call fcn.004048f4
push eax
mov eax, dword [ebp - 4]
call fcn.004048f4
push eax
mov eax, ebx
call fcn.00488250
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
jg 0x51b9d8
lea eax, [ebp - 0x10]
mov edx, 0x51ba24
call fcn.004044cc
mov eax, dword [ebp - 0xc]
cmp eax, 0x20
ja case.0x51b89f.0
mov al, byte [eax + 0x51b8a6]
jmp dword [eax*4 + 0x51b8c7]
lea eax, [ebp - 0x10]
mov edx, 0x51ba3c
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51ba78
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51baa4
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bad0
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bb1c
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bb60
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bb9c
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bc04
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bc28
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bc7c
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bcb8
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bd08
call fcn.004044cc
jmp case.0x51b89f.0
lea eax, [ebp - 0x10]
mov edx, 0x51bd48
call fcn.004044cc
mov eax, dword [ebp - 0x10]
call fcn.0053d3d4
xor ebx, ebx
jmp 0x51b9da
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ba11
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00404458
ret
Function at 0x51eee8
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.004093a4
test al, al
je 0x51ef64
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x51ef64
mov eax, dword [esp]
call fcn.0040887c
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x51ef6c
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51ef5a
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x51ef90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51f0c7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x51f0ac
mov eax, dword [ebp - 8]
call fcn.0040887c
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x51f0dc
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51f018
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x51f104
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51f03a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x51f128
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51f05c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040280c
lea edx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.00408b50
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404488
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408b50
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00404488
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00408b50
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f0ce
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404458
ret
Function at 0x544b4c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.005448fc
lea edx, [ebp - 6]
mov ecx, 2
mov eax, ebx
call fcn.005448d4
cmp word [ebp - 6], 0x5a4d
je 0x544b89
mov eax, 0x544cc4
call fcn.00544a04
mov edx, 0x3c
mov eax, ebx
call fcn.005448fc
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.005448d4
cmp dword [ebp - 0xc], 0
jne 0x544bb4
mov eax, 0x544ce8
call fcn.00544a04
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005448fc
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
call fcn.005448d4
cmp dword [ebp - 0x10], 0x4550
je 0x544be0
mov eax, 0x544d0c
call fcn.00544a04
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, ebx
call fcn.005448d4
movzx eax, word [ebp - 0x18]
cmp eax, 0xe0
je 0x544c04
mov eax, 0x544d30
call fcn.00544a04
lea edx, [ebp - 0x108]
mov ecx, 0xe0
mov eax, ebx
call fcn.005448d4
cmp word [ebp - 0x108], 0x10b
je 0x544c2b
mov eax, 0x544d54
call fcn.00544a04
cmp dword [ebp - 0x98], 0
je 0x544c3d
cmp dword [ebp - 0x94], 0
jne 0x544c47
mov eax, 0x544d78
call fcn.00544a04
mov eax, dword [ebp - 0x98]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
movzx esi, word [ebp - 0x26]
dec esi
test esi, esi
jl 0x544ca0
inc esi
lea edx, [ebp - 0x130]
mov ecx, 0x28
mov eax, ebx
call fcn.005448d4
mov eax, dword [edi]
cmp eax, dword [ebp - 0x124]
jne 0x544c9d
cmp dword [ebp - 0x120], 0
je 0x544c9d
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x120]
mov dword [eax], edx
jmp 0x544ca0
dec esi
jne 0x544c60
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x544cb2
mov eax, 0x544d94
call fcn.00544a04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x54cbec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x158]
mov edx, dword [0x407c14]
call fcn.00404dcc
xor eax, eax
push ebp
push 0x54ce41
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
mov ecx, 0x54ce58
mov edx, ebx
call fcn.00404740
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.004095a8
test eax, eax
jne 0x54ce12
mov eax, dword [ebp - 0x14c]
mov edx, 0x54ce68
call fcn.00404840
je 0x54cdf4
mov eax, dword [ebp - 0x14c]
mov edx, 0x54ce74
call fcn.00404840
je 0x54cdf4
mov eax, dword [ebp - 0x14c]
mov edx, 0x54ce80
call fcn.00404840
je 0x54cdf4
test byte [ebp - 0x150], 0x10
je 0x54cd72
push ebx
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x160]
call fcn.004093b4
test al, al
je 0x54cd72
push edi
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x164]
call fcn.004099ac
push edi
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x168]
push eax
push ebx
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004047b4
mov edx, dword [ebp - 0x16c]
mov eax, esi
pop ecx
call fcn.0054cbec
jmp 0x54cdf4
push ebx
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x170]
call fcn.004093a4
test al, al
je 0x54cdf4
push 0
push edi
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x174]
call fcn.004048f4
push eax
push ebx
push 0x54ce98
push dword [ebp - 0x14c]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x178]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x158]
call fcn.004095f8
test eax, eax
je 0x54cc7f
lea eax, [ebp - 0x158]
call fcn.0040961c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ce48
lea eax, [ebp - 0x178]
mov edx, 8
call fcn.00404458
lea eax, [ebp - 0x158]
mov edx, dword [0x407c14]
call fcn.00404e9c
ret
Function at 0x54d048
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54d24b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x310]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x54d228
mov eax, dword [0x5a2e30]
mov eax, dword [eax]
call fcn.00568474
test al, al
je 0x54d228
mov eax, dword [0x5a3398]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a0b94
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54d13f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov edx, dword [0x5a3304]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x54d264
call fcn.00404740
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x41a94c]
call fcn.0041f99c
mov dword [ebp - 0xc], eax
push 0xffff
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x310]
call fcn.004381b0
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41a94c]
call fcn.0041f99c
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041f508
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041f720
mov eax, dword [ebp - 0xc]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54d17b
mov eax, dword [ebp - 8]
call fcn.0041f484
mov dword [ebp - 0x10], eax
mov edx, dword [0x5a3304]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.00519150
test al, al
jne 0x54d1b2
mov eax, dword [ebp - 8]
call fcn.00403600
mov eax, dword [0x5a3398]
mov eax, dword [eax]
xor edx, edx
call fcn.004a0b94
jmp 0x54d228
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403600
mov eax, dword [0x5a3398]
mov eax, dword [eax]
xor edx, edx
call fcn.004a0b94
mov byte [ebp - 1], 1
push 0x44
mov ecx, 0x54d274
mov edx, 0x54d284
mov eax, dword [0x5a311c]
mov eax, dword [eax]
call fcn.004a2dfc
cmp eax, 6
jne 0x54d228
push 5
push 0
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x310]
call fcn.004381b0
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
push 0x54d2a8
mov eax, ebx
call fcn.00488250
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d252
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x14]
call fcn.00404434
ret
Function at 0x5950ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5950f4
push ebx
push esi
push edi
mov esi, dword [0x5a2fb4]
xor eax, eax
push ebp
push 0x5952f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.00404a80
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
mov eax, esi
call fcn.0040462c
mov eax, dword [esi]
call fcn.004046f4
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
jne 0x59516c
mov eax, dword [esi]
call fcn.004046f4
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404994
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [esi]
lea eax, [ebp - 0x20]
mov ecx, 0x595314
call fcn.00404740
mov eax, dword [ebp - 0x20]
call fcn.004093a4
test al, al
jne 0x59522d
xor eax, eax
push ebp
push 0x595208
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a74c]
call fcn.004035d0
mov dword [ebp - 8], eax
call fcn.0040ae3c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040a7e8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x595328
call fcn.00404740
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, 0x595314
call fcn.00404740
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x595224
mov byte [ebp - 1], 1
jmp 0x5952d6
xor eax, eax
push ebp
push 0x595292
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a74c]
call fcn.004035d0
mov dword [ebp - 8], eax
mov edx, dword [esi]
lea eax, [ebp - 0x30]
mov ecx, 0x595314
call fcn.00404740
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0xc]
mov edx, 0x595334
mov eax, dword [ebp - 8]
call fcn.0041e5d8
mov eax, dword [ebp - 0xc]
call fcn.0040a848
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5952ab
call fcn.0040ae3c
fld qword [ebp - 0x18]
fadd dword [0x595338]
fcompp
fnstsw ax
sahf
jbe 0x5952cd
call fcn.0040ae3c
fcomp qword [ebp - 0x18]
fnstsw ax
sahf
ja 0x5952d1
xor eax, eax
jmp 0x5952d3
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x595300
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00404458
lea eax, [ebp - 0xc]
call fcn.00404434
ret
Function at 0x532020
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x5a4348], 0
jne 0x532159
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
xor eax, eax
test cl, 1
je 0x532042
bts eax, 7
shr ecx, 1
test cl, 1
je 0x53204d
bts eax, 6
shr ecx, 1
test cl, 1
je 0x532058
bts eax, 5
shr ecx, 1
test cl, 1
je 0x532063
bts eax, 4
shr ecx, 1
test cl, 1
je 0x53206e
bts eax, 3
shr ecx, 1
test cl, 1
je 0x532079
bts eax, 2
shr ecx, 1
test cl, 1
je 0x532084
bts eax, 1
test cl, 2
je 0x53208d
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax*4 + 0x5a4350], ebx
lea ecx, [edx + 1]
nop
test bl, 1
je 0x53212f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x532120
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x5a4350], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x532037
mov byte [0x5a4348], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x532280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x10], edx
lea edx, [ecx + 8]
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
movlpd qword [ebp - 0x20], xmm0
jl 0x532315
mov edi, dword [ebp + 8]
jg 0x5322b4
test edi, edi
je 0x532315
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov ecx, dword [ebp - 8]
inc bl
mov edi, dword [ebp - 8]
movzx ebx, bl
mov edx, dword [ecx + ebx*4]
mov al, dl
add al, byte [ebp - 4]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ecx + eax*4]
mov dword [ecx + ebx*4], eax
mov ecx, dword [ebp - 4]
mov dword [edi + ecx*4], edx
add dl, al
mov ecx, edi
movzx eax, dl
mov edi, dword [ebp + 8]
mov al, byte [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
xor byte [esi + ecx], al
add esi, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
adc eax, 0
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0xc]
jl 0x5322c0
jg 0x532312
cmp esi, edi
jb 0x5322c0
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], ebx
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x534350
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5a206c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, edx
mov ecx, dword [esi + 4]
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, 0xfffffff7
mov byte [ebp - 0xc], dl
shr edx, 3
sub eax, edx
mov byte [ebp - 8], cl
shr ecx, 0x18
and eax, 0x3f
inc eax
mov byte [ebp - 5], cl
push eax
mov edx, 0x599618
mov ecx, esi
call fcn.00535130
push 8
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00535130
add esp, 8
xor eax, eax
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
sar edx, 2
and ecx, 3
shl ecx, 3
mov edx, dword [esi + edx*4 + 8]
shr edx, cl
mov byte [edi + eax + 4], dl
inc eax
cmp eax, 0x10
jl 0x5343d0
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop esi
call fcn.00562376
mov esp, ebp
pop ebp
ret
Function at 0x534430
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589069
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5a206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0
push 0x58
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], 0
call fcn.0056238c
mov ecx, eax
add esp, 4
mov dword [ebp - 0x74], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
lea edx, [esi + 4]
mov dword [ebp - 4], 1
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x5344bf
mov edx, dword [edx]
add eax, eax
push eax
call fcn.00535130
add esp, 4
lea ecx, [ebp - 0x74]
call fcn.00534350
inc dword [0x5a4754]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [edi], 0x599c14
xor ecx, ecx
movups xmm0, xmmword [ebp - 0x70]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov byte [ebp - 0x14], 0
movups xmmword [ebp - 0x24], xmm0
mov word [edi + 4], cx
mov dword [ebp - 0x78], 1
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x24]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x44]
movq qword [ebp - 0x34], xmm0
push 0x5995f8
push eax
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x28], 0
call fcn.00534320
add esp, 0xc
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x60]
push eax
call fcn.0053f3f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
lea ecx, [edi + 4]
push dword [ebp - 0x4c]
cmovae eax, dword [ebp - 0x5c]
push eax
call fcn.00541c30
mov byte [ebp - 4], 1
dec dword [0x5a4754]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x60], 0x599c14
cmp edx, 8
jb 0x5345ae
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5345a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5345e2
push edx
push ecx
call fcn.005623bc
add esp, 8
inc esi
cmp esi, 0x10
jl 0x534510
push 0x58
push dword [ebp - 0x74]
call fcn.005623bc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562376
mov esp, ebp
pop ebp
ret
call fcn.005681a6
int3
Function at 0x534690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5890f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5a206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0x58
mov dword [ebp - 0x5c], eax
call fcn.0056238c
mov dword [ebp - 0x40], eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
push esi
mov edx, edi
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00535130
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.00534350
movups xmm0, xmmword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x58]
movups xmmword [ebp - 0x20], xmm0
call fcn.005345f0
xor ecx, ecx
mov dword [ebp - 0x2c], 0x599c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
inc dword [0x5a4754]
mov ecx, eax
call fcn.0053fab0
add esp, 4
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x28]
add ecx, 4
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x53477b
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00541f70
dec dword [0x5a4754]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x5347b7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5347ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53480f
push edx
push ecx
call fcn.005623bc
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x5347e7
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5347dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53480f
push edx
push ecx
call fcn.005623bc
add esp, 8
push 0x58
push dword [ebp - 0x40]
call fcn.005623bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562376
mov esp, ebp
pop ebp
ret
call fcn.005681a6
int3