joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d820
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax + eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x51d840
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
ret 4

Function at 0x51de30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
xorps xmm1, xmm1
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x51de82
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x51de45
mov eax, dword [esi]
jmp 0x51df65
cmp eax, 0x4e0
jb 0x51df65
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x51dea0
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x51def0
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [esi + 0x1384]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
pop esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5c76b0]
cvtpd2ps xmm0, xmm0
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x5c7088]
ret
Function at 0x5230b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
cmp edi, 8
jl 0x52315f
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5bbb50]
xor edx, dword [eax*4 + 0x5bb750]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x5bbf50]
movzx eax, byte [esi + 6]
xor edx, dword [eax*4 + 0x5ba750]
movzx eax, byte [esi + 5]
xor edx, dword [eax*4 + 0x5bab50]
movzx eax, byte [esi + 7]
xor edx, dword [eax*4 + 0x5ba350]
movzx eax, byte [esi + 4]
add esi, 8
xor edx, dword [eax*4 + 0x5baf50]
movzx eax, cl
xor edx, dword [eax*4 + 0x5bb350]
mov ecx, edx
sub ebx, 1
jne 0x5230d0
pop ebx
test edi, edi
je 0x52317f
movzx eax, byte [esi]
lea esi, [esi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
xor ecx, dword [edx*4 + 0x5ba350]
sub edi, 1
jne 0x523163
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x5248e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00524860
test eax, eax
je 0x524a4d
mov eax, dword [edi + 4]
lea esi, [edi + 4]
cmp dword [eax], 0
je 0x52491e
mov ebp, dword [edi]
lea ecx, [ebp + 0x20]
call fcn.00529750
cmp dword [ebp + 0x20], 0
lea esi, [edi + 4]
je 0x52491e
mov dword [ebp + 0x1b4], 1
lea esi, [edi + 4]
mov eax, dword [edi + 4]
cmp dword [eax + 0xe2c], 0
jne 0x524962
push 0
mov ebp, eax
call dword [0x5a4880]
add esp, 4
cmp dword [ebp + 0x34], eax
je 0x524a4d
mov eax, dword [ebp + 8]
test eax, eax
je 0x52496c
push dword [ebp + 0x30]
push 0
push 0
push edi
call eax
add esp, 0x10
cmp eax, 1
je 0x524a4d
lea esi, [edi + 4]
jmp 0x52496c
mov dword [eax + 0xe2c], 0
mov eax, dword [edi]
mov dword [eax], 0
mov eax, dword [edi + 4]
mov dword [eax + 0xf8], 0
mov eax, dword [esi]
push dword [eax + 0x1c4]
call dword [0x5a46f0]
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x1c4], 0
mov eax, dword [esi]
mov dword [eax + 0xfc], 0
mov eax, dword [edi]
mov ecx, dword [esi]
pop edi
mov eax, dword [eax + 0x1c]
mov dword [ecx + 0xe28], eax
mov eax, dword [esi]
mov dword [eax + 0xe8], 0
mov eax, dword [esi]
mov dword [eax + 0xe4], 0
mov eax, dword [esi]
mov dword [eax + 0xe74], 0x67452301
mov dword [eax + 0xe78], 0xefcdab89
mov dword [eax + 0xe7c], 0x98badcfe
mov dword [eax + 0xe80], 0x10325476
mov dword [eax + 0xe84], 0
mov dword [eax + 0xe88], 0
mov dword [eax + 0xe8c], 0
mov dword [eax + 0xe90], 0
mov eax, dword [esi]
mov dword [eax + 0x17f8], 0
mov dword [eax + 0x17fc], 0
mov eax, dword [esi]
pop esi
pop ebp
pop ebx
mov dword [eax + 0x1808], 0
mov eax, 1
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x528960
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov ecx, dword [esi + 0x1c]
mov ebp, ecx
mov edi, dword [esi + 0x10]
cmp edi, ecx
jbe 0x5289d9
mov edx, dword [esi + 0x20]
test edx, edx
je 0x5289e1
mov eax, dword [esi]
lea ebp, [ecx + 1]
mov ebx, dword [esi + 0x18]
mov eax, dword [eax + ecx*4]
mov dword [esi + 0x1c], ebp
cmp edx, 0x20
jae 0x5289cf
mov esi, eax
mov ecx, 0x18
sub ecx, edx
cmp ecx, 0x20
jae 0x5289aa
mov eax, esi
shr eax, cl
movzx ecx, al
jmp 0x5289ac
xor ecx, ecx
mov eax, ebx
add edx, 8
shr eax, 8
xor eax, ecx
movzx ebx, bl
shl ebx, 8
movzx ecx, word [eax*2 + 0x5bc400]
xor ebx, ecx
cmp edx, 0x20
jb 0x528995
mov esi, dword [esp + 0x14]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], 0
cmp edi, ebp
jbe 0x528ae8
mov eax, dword [esi]
sub edi, ebp
movzx edx, word [esi + 0x18]
lea ebp, [eax + ebp*4]
mov dword [esp + 0x10], ebp
cmp edi, 2
jb 0x528a99
mov esi, dword [esp + 0x10]
mov ebp, edi
shr ebp, 1
mov ebx, dword [esi]
sub edi, 2
movzx eax, dx
mov edx, dword [esi + 4]
shr ebx, 0x10
xor ebx, eax
mov eax, dword [esi]
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
movzx eax, al
mov cx, word [ecx*2 + 0x5bce00]
xor cx, word [eax*2 + 0x5bc800]
mov eax, edx
shr eax, 8
movzx eax, al
xor cx, word [eax*2 + 0x5bc600]
mov eax, ebx
shr eax, 8
xor cx, word [eax*2 + 0x5bd200]
mov eax, edx
shr eax, 0x18
xor cx, word [eax*2 + 0x5bca00]
movzx eax, bl
xor cx, word [eax*2 + 0x5bd000]
movzx eax, dl
xor cx, word [eax*2 + 0x5bc400]
mov eax, dword [esi]
add esi, 8
movzx eax, al
xor cx, word [eax*2 + 0x5bcc00]
movzx edx, cx
sub ebp, 1
jne 0x528a01
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
test edi, edi
je 0x528ae2
mov ebx, dword [ebp]
movzx eax, dx
shr ebx, 0x10
xor ebx, eax
mov eax, dword [ebp]
shr eax, 8
mov ecx, ebx
movzx eax, al
shr ecx, 8
mov dx, word [eax*2 + 0x5bc600]
xor dx, word [ecx*2 + 0x5bca00]
movzx eax, bl
xor dx, word [eax*2 + 0x5bc800]
mov eax, dword [ebp]
movzx eax, al
xor dx, word [eax*2 + 0x5bc400]
movzx edx, dx
movzx eax, dx
mov dword [esi + 0x18], eax
pop edi
mov dword [esi + 0x1c], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x52de63
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x5a4174]
test eax, eax
je 0x52dea2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52dea2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52dea2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x52dea2
cmp dword [ecx + 0x74], 0xe
jbe 0x52dea2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5357e0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x5de040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.00534e80
mov esi, eax
add esp, 8
test esi, esi
je 0x535847
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov eax, 0x13
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052d235
mov esp, ebp
pop ebp
ret
push 0x5a50e8
push edi
call dword [0x5a48a0]
add esp, 8
test eax, eax
je 0x535878
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x53587a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052d235
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.00534e10
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x53591b
push 0x2e
push edi
call fcn.00580d97
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x5358a7
sub edx, eax
cmp edx, 0xc8
ja 0x535865
test esi, esi
je 0x535865
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5358c6
call dword [0x5a4718]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00534e10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x535865
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x535865
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov eax, 3
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.0052d235
mov esp, ebp
pop ebp
ret
Function at 0x535a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
call dword [0x5a4718]
mov ecx, dword [ebp + 8]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7311], 8
je 0x535ab3
nop
mov al, byte [ecx + 1]
inc ecx
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7311], 8
jne 0x535aa0
mov al, byte [ebp + 0xb]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x535ac6
mov dword [ebp - 0x10], 1
jmp 0x535ace
cmp al, 0x2b
mov dword [ebp - 0x10], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x535c06
mov al, byte [edx + 1]
cmp al, 0x78
je 0x535ae6
cmp al, 0x58
jne 0x535c06
movsd xmm2, qword [0x5c72a0]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0xc], edx
mov byte [ebp + 0xb], al
cmp ecx, dword [ebp - 0x14]
jne 0x535b11
cmp dword [ebp - 4], 0
jne 0x535b63
mov dword [ebp - 4], 1
inc edx
jmp 0x535af1
movzx eax, al
test byte [eax + 0x5a7311], 0x10
je 0x535b63
test edi, edi
jne 0x535b2c
cmp byte [ebp + 0xb], 0x30
jne 0x535b2c
inc dword [ebp - 8]
jmp 0x535b59
inc edi
cmp edi, 0x1e
jg 0x535b58
test byte [ecx + 0x5a7311], 2
je 0x535b40
add ecx, 0xffffffd0
jmp 0x535b46
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x535b59
inc esi
cmp dword [ebp - 4], 0
je 0x535b60
dec esi
inc edx
jmp 0x535af1
mov eax, dword [ebp - 8]
add eax, edi
je 0x535c06
mov eax, dword [ebp + 0xc]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x535b80
cmp al, 0x50
jne 0x535be1
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x535b95
mov edx, dword [ebp - 0xc]
lea edi, [ecx + 1]
add edx, 2
jmp 0x535ba1
cmp al, 0x2b
jne 0x535b9f
mov edx, dword [ebp - 0xc]
add edx, 2
xor edi, edi
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7311], 2
je 0x535c06
movsx eax, byte [ebp + 0xb]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x5a7311], 2
jne 0x535bb2
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
cmp dword [ebp - 0x10], 0
je 0x535bee
xorps xmm1, xmmword [0x5c7700]
push esi
sub esp, 8
movsd qword [esp], xmm1
call dword [0x5a4764]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53a320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
xor eax, dword [ebp + 0x10]
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x53a35c
push ebx
mov ebx, dword [ebp + 8]
nop dword [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x53a340
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x53a360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx + 6], 0
jne 0x53a3be
mov edx, dword [ebx + 8]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edi
shr esi, 5
xor edx, edi
inc esi
cmp edi, esi
jb 0x53a3ae
lea eax, [ebx + 0xf]
add eax, edi
mov ebx, eax
nop dword [eax]
mov ecx, edx
mov eax, edx
shl ecx, 5
sub edi, esi
shr eax, 2
add ecx, eax
movzx eax, byte [ebx]
add ecx, eax
sub ebx, esi
xor edx, ecx
cmp edi, esi
jae 0x53a390
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov dword [ebx + 8], edx
mov eax, edx
mov byte [ebx + 6], 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53a6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
cmp ebx, 0x28
ja 0x53a81d
mov eax, dword [ebp + 8]
mov esi, ebx
shr esi, 5
mov edx, ebx
inc esi
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x38]
xor edi, ebx
mov dword [ebp - 4], edi
cmp ebx, esi
jb 0x53a6f9
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [ebx + edx - 1]
mov eax, edi
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, edi
shr eax, 2
add ecx, eax
xor edi, ecx
cmp edx, esi
jae 0x53a6d5
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edi
mov edx, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
lea ecx, [edx - 1]
and ecx, edi
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp + 0x10], eax
test edi, edi
je 0x53a77d
movzx eax, byte [edi + 7]
cmp ebx, eax
jne 0x53a773
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 0x10]
mov esi, ebx
sub esi, 4
jb 0x53a741
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x53a746
add ecx, 4
add edx, 4
sub esi, 4
jae 0x53a730
cmp esi, 0xfffffffc
je 0x53a7b0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x53a773
cmp esi, 0xfffffffd
je 0x53a7b0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x53a773
cmp esi, 0xfffffffe
je 0x53a7b0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x53a773
cmp esi, 0xffffffff
je 0x53a7b0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x53a7b0
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x53a714
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp dword [edi + 0x1c], edx
jl 0x53a7d2
cmp edx, 0x3fffffff
jg 0x53a7d2
lea eax, [edx + edx]
push eax
push dword [ebp + 8]
call fcn.0053a900
mov ecx, dword [edi + 0x20]
add esp, 8
mov esi, dword [ebp - 4]
dec ecx
mov eax, dword [edi + 0x18]
and ecx, esi
lea eax, [eax + ecx*4]
mov dword [ebp + 0x10], eax
jmp 0x53a7d5
mov eax, dword [ebp - 8]
mov cl, byte [edi + 5]
xor cl, 3
mov al, byte [eax + 0x3c]
xor al, 3
test cl, al
jne 0x53a858
mov byte [edi + 5], cl
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
lea eax, [ebx + 0x11]
push eax
push 4
push dword [ebp + 8]
call fcn.00538810
mov edi, eax
push ebx
push dword [ebp + 0xc]
lea eax, [edi + 0x10]
mov dword [edi + 8], esi
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call fcn.00580dbb
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov byte [edi + 7], bl
mov ecx, dword [eax]
mov dword [edi + 0xc], ecx
mov dword [eax], edi
mov eax, dword [ebp - 8]
inc dword [eax + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xffffffef
jae 0x53a861
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov esi, dword [eax + 0x38]
lea eax, [ebx + 0x11]
push eax
push 0x14
push ecx
call fcn.00538810
mov edi, eax
push ebx
push dword [ebp + 0xc]
lea ecx, [edi + 0x10]
mov dword [edi + 8], esi
mov byte [edi + 6], 0
mov byte [edi + ebx + 0x10], 0
push ecx
mov dword [edi + 0xc], ebx
call fcn.00580dbb
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call fcn.0053fb30
int3
Function at 0x550570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
mov eax, dword [ecx]
push ebx
push esi
lea esi, [ecx + 8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0xc
jne 0x5505f8
mov eax, dword [edi]
mov ecx, dword [esi]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + ecx*4]
mov eax, ecx
and eax, 0x3f
cmp al, 0x1b
jne 0x550665
dec dword [edi + 0x10]
and ecx, 0xffc5ffff
or ecx, 0x440000
xor eax, eax
shr ecx, 0x11
mov edx, 0x4000
cmp dword [ebp + 0x10], eax
cmove eax, edx
or ecx, eax
push ecx
push edi
call fcn.00550780
mov esi, dword [edi + 0x18]
push 0x7fff801e
push edi
mov dword [edi + 0x18], 0xffffffff
call fcn.00550780
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push esi
push eax
push edi
call fcn.005508e0
mov eax, dword [ebp + 0xc]
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 7
jne 0x550668
lea ebx, [edi + 0x2c]
mov edx, dword [esi]
mov ecx, esi
test edx, 0x100
jne 0x550616
movzx eax, byte [edi + 0x2a]
cmp edx, eax
jl 0x550616
dec byte [ebx]
mov eax, dword [esi]
shl eax, 9
or eax, dword [ebp + 0x10]
shl eax, 0xe
or eax, 0x3fe3
push eax
push edi
call fcn.00550780
mov eax, dword [edi + 0x18]
push 0x7fff801e
push edi
mov dword [ebp + 0xc], eax
mov dword [edi + 0x18], 0xffffffff
call fcn.00550780
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [ebp - 8], eax
cmp edx, 0xffffffff
je 0x550710
cmp eax, 0xffffffff
jne 0x5506b8
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
movzx eax, byte [edi + 0x2c]
lea ebx, [edi + 0x2c]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [edi]
movzx eax, byte [eax + 8]
cmp dword [ebp - 4], eax
jbe 0x550694
mov eax, dword [ebp - 4]
cmp eax, 0xff
jae 0x550717
mov ebx, dword [edi]
mov byte [ebx + 8], al
lea ebx, [edi + 0x2c]
inc byte [edi + 0x2c]
movzx eax, byte [edi + 0x2c]
dec eax
push eax
push ecx
push edi
call fcn.005500c0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [eax], 7
jne 0x550616
jmp 0x550600
mov ecx, eax
mov eax, dword [edi]
mov edi, dword [eax + 0x30]
nop
mov esi, dword [edi + ecx*4]
lea ebx, [edi + ecx*4]
mov eax, esi
shr eax, 0xe
sub eax, 0x1ffff
cmp eax, 0xffffffff
je 0x5506e1
inc eax
add eax, ecx
cmp eax, 0xffffffff
je 0x5506e1
mov ecx, eax
jmp 0x5506c0
mov edi, dword [ebp + 8]
sub edx, ecx
dec edx
mov eax, edx
mov dword [ebp + 0xc], edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1ffff
jg 0x550724
mov eax, dword [ebp + 0xc]
and esi, 0x3fff
add eax, 0x1ffff
shl eax, 0xe
or eax, esi
mov dword [ebx], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.function_or_expression_needs_too_many_registers
push dword [edi + 8]
call fcn.005405c0
push str.control_structure_too_long
push dword [edi + 8]
call fcn.005405c0
int3
Function at 0x569580
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebx - 4]
test ebp, ebp
jle 0x5695ea
mov ecx, dword [esp + 0xc]
sub ecx, ebx
push esi
mov dword [esp + 0x10], ecx
push edi
nop dword [eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [esp + 0x14]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
mov dword [ebx - 4], eax
sub ebp, 1
jne 0x5695a0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5695f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jle 0x569664
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
sub ecx, eax
sub dword [esp + 0x14], eax
push ebx
push esi
mov dword [esp + 0x14], ecx
push edi
nop
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [esp + 0x20]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
mov dword [ecx + eax - 4], edi
mov ecx, dword [esp + 0x18]
sub ebp, 1
jne 0x569610
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x569ce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
xor ebp, ebp
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x569d4e
push esi
mov esi, dword [esp + 0x1c]
nop word [eax + eax]
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
inc ebp
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
and cl, 0x1f
xor cl, dl
mov byte [esi - 1], cl
cmp ebp, edi
jb 0x569d10
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x569d60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
xor ebp, ebp
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x569dc4
push esi
mov esi, dword [esp + 0x1c]
nop word [eax + eax]
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
inc ebp
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
and dl, 0xf0
or al, dl
mov byte [esi - 2], cl
mov byte [esi - 1], al
cmp ebp, ebx
jb 0x569d90
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x8ddf4c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddf52
pop ebp
sub ebp, 6
sub ebp, 0x4ddf4c
jmp 0x8ddfb0
jmp 0x8ddfb9
mov eax, 0x4ddf4c
add eax, ebp
add eax, 0x93
mov ecx, 0x61a
mov edx, 0xe8d2850d
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddfd0
jmp 0x8ddfe3
dec ebp
or eax, 0x650d0d1d
or eax, 0x3e0d21c1
int 0x5d
cwde
xor dword [ecx + ecx*2], ebp
or eax, 0x86c0865d
test byte [ecx], dh
or eax, 0xcc8c0d0d
cmc
or eax, 0xc00e0d0d
mov ch, 0xb
or eax, 0x25b70d0d
or eax, 0xeffa0d0d
push cs
lds eax, [esi + 0xd0d018c]
or eax, 0x655dc80e
inc ebp
cmp byte [ecx + 0x49a70e65], al
or eax, 0x6529210c
or eax, 0xe50d0d0d
or byte [0x25e40d0d], cl
or eax, 0x59580d0d
push eax
xchg byte [eax + 0xd0d0d05], cl
xchg byte [eax + 0xd0d0d01], bl
xchg byte [eax + 0xd0d0d1d], al
int3