joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec0f4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x268], ebx
mov ebx, ecx
test ebx, ebx
js 0x4ec127
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4ec120
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00406404
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 4]
mov edx, dword [0x401138]
call fcn.00407470
xor eax, eax
push ebp
push 0x4ec2b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4ec280
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 8]
push 0x4ec2e4
push dword [esi]
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.004069d4
mov eax, dword [ebp - 0x268]
call fcn.004064a8
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ec274
mov eax, dword [ebp - 0x264]
test al, 0x10
jne 0x4ec259
test al, 2
jne 0x4ec259
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x4ec2e4
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.0040661c
push dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.004069d4
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x10]
call fcn.004df730
test eax, 0x80000000
setne al
test al, al
je 0x4ec217
or edi, 0xffffffff
jmp 0x4ec226
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004df8d0
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004df694
lea eax, [ebp - 0x274]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.0040661c
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x264]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4ec1a9
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x4ec16c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec2bf
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00406414
lea eax, [ebp - 8]
call fcn.0040640c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x401138]
call fcn.0040730c
ret
Function at 0x4ed520
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ed5ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ed5d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x700f0037
mov eax, dword [0x59a140]
cmp dword [eax + 4], 0x60000
jl 0x4ed570
or dword [ebp - 8], 0x400000
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004ed6d0
mov eax, dword [ebp - 4]
call fcn.004eb20c
test al, al
je 0x4ed5a0
mov eax, dword [ebp - 4]
call fcn.004064a8
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
jne 0x4ed5a0
and dword [ebp - 8], 0xfffbffff
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x498]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed5d7
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4f11f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004064a8
push eax
call sub.kernel32.dll_GetDriveTypeW
sub eax, 3
je 0x4f1232
dec eax
je 0x4f1213
sub eax, 2
je 0x4f1232
jmp 0x4f1243
movzx eax, word [ebx]
call fcn.004e13a4
test al, al
je 0x4f1243
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.00404694
jmp 0x4f1243
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.00404694
pop esi
pop ebx
pop ebp
ret

Function at 0x4f1248
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f12f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x440], 0
jne 0x4f1296
push 0x465
mov eax, dword [ebp - 4]
call fcn.004862ac
mov ecx, eax
mov dl, 1
mov eax, dword [0x4ed878]
call fcn.004ed8f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x440], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x440]
call fcn.004eddd8
lea eax, [ebp - 8]
mov edx, 0x4f1314
call fcn.00406470
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4f12e2
test bl, 1
je 0x4f12db
lea eax, [ebp - 8]
call fcn.00406ee4
lea edx, [esi + 0x41]
mov word [eax], dx
push ebp
mov eax, dword [ebp - 8]
call fcn.004f11f0
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x4f12be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f12ff
lea eax, [ebp - 8]
call fcn.0040640c
ret
Function at 0x4f1fa8
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406404
xor eax, eax
push ebp
push 0x4f20c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f2099
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 4]
call fcn.004064a8
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4f2076
test byte [ebp - 0x25c], 0x10
jne 0x4f2059
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.0040661c
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x260]
call fcn.0040c750
mov edx, dword [ebp - 0x260]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x25c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4f201c
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x4f2082
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f20a0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4f7f14
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
movzx eax, byte [ebx + 4]
sub al, 1
jb 0x4f7f23
je 0x4f7f28
jmp 0x4f7f4f
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x4f7f4a
lea eax, [ebx + 8]
push eax
movzx eax, byte [ebx + 0xc]
push eax
mov eax, dword [0x599e34]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4fd9f0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x254], 0
je 0x4fda0c
cmp dword [esi + 4], 0
je 0x4fda39
test byte [ebx + 0x55], 1
jne 0x4fda2b
mov eax, ebx
call fcn.00481ef4
test eax, eax
jne 0x4fda2b
mov edx, esi
mov eax, ebx
call fcn.0048859c
jmp 0x4fdb2d
mov edx, esi
mov eax, ebx
call fcn.004836d4
jmp 0x4fdb2d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xe8]
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4fdb26
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004862ac
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.0047ec70
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004fd9f0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004862ac
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdb2d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x500bb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406404
xor eax, eax
push ebp
push 0x500c05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004064a8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x500be9
test al, 1
jne 0x500bed
xor ebx, ebx
jmp 0x500bef
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500c0c
lea eax, [ebp - 4]
call fcn.0040640c
ret
Function at 0x50da28
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x50daf2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00406798
lea eax, [ebp - 4]
call fcn.00406ee4
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406798
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040c9a4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406470
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00413b44
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00406470
push dword [ebp - 4]
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.0040d224
push dword [ebp - 0x10]
push 0x50db0c
mov eax, ebx
mov edx, 3
call fcn.004069d4
mov eax, dword [ebx]
call fcn.004064a8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x50da98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50daf9
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406414
ret

Function at 0x50db3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50dc7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov bl, 1
mov byte [ebp - 0xd], 0
mov esi, ecx
dec esi
test esi, esi
jl 0x50dc60
inc esi
xor edi, edi
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, word [edx + edi*2]
call fcn.00406588
mov eax, dword [ebp - 0x14]
mov edx, 0x50dc9c
call fcn.00406f30
test eax, eax
je 0x50dc58
mov eax, dword [ebp - 4]
movzx edx, word [eax + edi*2]
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x50dbc3
mov eax, edx
and ax, 0xffdf
mov word [ebp - 0x10], ax
test bl, bl
je 0x50dbed
lea eax, [ebp - 0x18]
movzx edx, word [ebp - 0x10]
call fcn.00406588
mov eax, dword [ebp - 0x18]
mov edx, 0x50dcec
call fcn.00406f30
dec eax
shl eax, 4
mov byte [ebp - 0xd], al
jmp 0x50dc0c
lea eax, [ebp - 0x1c]
movzx edx, word [ebp - 0x10]
call fcn.00406588
mov eax, dword [ebp - 0x1c]
push eax
mov edx, 0x50dcec
pop eax
call fcn.00406f30
dec eax
or byte [ebp - 0xd], al
xor bl, 1
test bl, bl
je 0x50dc58
cmp byte [ebp + 0xc], 0
je 0x50dc43
movzx eax, byte [ebp - 0xd]
and al, 0xf
movzx eax, al
shl eax, 4
movzx edx, byte [ebp - 0xd]
and dl, 0xf0
movzx edx, dl
shr edx, 4
or ax, dx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 8]
mov word [ecx + edx*2], ax
jmp 0x50dc53
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
movzx ecx, byte [ebp - 0xd]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 8]
inc dword [eax]
inc edi
dec esi
jne 0x50db85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dc82
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00406414
ret
Function at 0x51157c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x511700
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 0
mov eax, dword [ebp - 8]
call fcn.0050eca4
test eax, eax
je 0x5116ea
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00515d5c
xor eax, eax
push ebp
push 0x5116e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00516408
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 8]
call fcn.0050eca4
mov edx, eax
dec edx
mov eax, dword [ebp - 8]
call fcn.00516408
mov byte [ebp - 0x1a], al
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00511410
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x51166e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
call fcn.00429560
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
mov edx, dword [ebp - 0x14]
call fcn.00429804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511675
mov eax, dword [ebp - 0x14]
call fcn.0040444c
mov eax, dword [ebp - 4]
call fcn.004064a8
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511707
lea eax, [ebp - 4]
call fcn.0040640c
ret
Function at 0x511710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5118a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 0
mov eax, dword [ebp - 8]
call fcn.0050eca4
test eax, eax
je 0x51188e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00515d5c
xor eax, eax
push ebp
push 0x511887
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00516408
mov byte [ebp - 0x19], al
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00511410
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5117fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
call fcn.00429560
push 0
push 1
mov eax, dword [ebp - 0x14]
call fcn.00429560
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e710]
mov edx, dword [ebp - 0x14]
call fcn.00429804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511805
mov eax, dword [ebp - 0x14]
call fcn.0040444c
mov eax, dword [ebp - 4]
call fcn.004064a8
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5118ab
lea eax, [ebp - 4]
call fcn.0040640c
ret
Function at 0x5249d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x524aaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x34]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x524a31
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [esi + 0x34]
call fcn.004321a4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.005220e8
cmp dword [ebp - 4], 0
je 0x524a2d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
call fcn.0040641c
inc edi
dec ebx
jne 0x5249fc
mov eax, dword [esi + 0x38]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x524a94
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [esi + 0x38]
call fcn.004321a4
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.005220e8
cmp dword [ebp - 4], 0
je 0x524a90
lea eax, [ebp - 0x10]
push eax
push 0x40
push 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 8
push eax
call sub.kernel32.dll_VirtualProtect
inc edi
dec ebx
jne 0x524a3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524ab1
lea eax, [ebp - 4]
call fcn.0040640c
ret

Function at 0x554828
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
mov ebx, eax
xor ecx, ecx
cmp dword [0x5957f0], 4
jge 0x55484e
mov eax, dword [edx + ecx*4]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0x554837
jmp 0x55485e
mov eax, dword [edx + ecx*4]
bswap eax
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0x55484e
mov ecx, 0x40
pop edx
cmp dl, 0
je 0x554881
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x554869
pop ebx
ret
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x554881
pop ebx
ret
Function at 0x5573d8
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x5573ee
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x5573e7
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x557479
movzx ecx, byte [ecx + 0x596960]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x596860]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x596860]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x596960]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x5574d6
movzx ecx, byte [ecx + 0x596960]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x596960]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x596860]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x596860]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x596860]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x596960]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x596860]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x596960]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x596860]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x596860]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x596960]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x596960]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x596a60]
xor edx, dword [ebx*4 + 0x596e60]
xor edx, dword [eax*4 + 0x597260]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + str.9g]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x5576d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
and ecx, 0xff
xor ebx, ebx
mov esi, dword [edx + ebx*4]
imul edi, ecx, 0x1010101
xor esi, edi
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x5576e3
pop edi
pop esi
pop ebx
ret
Function at 0x5576fc
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x596860
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x596860]
xor edi, edx
mov edi, dword [edi*4 + 0x596a60]
mov dword [esi + ebx*4], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x557732
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x596960
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 8
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x596860]
xor edi, edx
mov edi, dword [edi*4 + 0x596e60]
mov dword [esi + ebx*4 + 4], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x55778b
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x596860
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x10
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x596960]
xor edi, edx
mov edi, dword [edi*4 + 0x597260]
mov dword [esi + ebx*4 + 0x800], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x5577e5
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x596960
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x18
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x596960]
xor edi, edx
mov edi, dword [edi*4 + str.9g]
mov dword [esi + ebx*4 + 0x804], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x55783c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret