joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5226b0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [edx + 0x18]
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
pop ebp
ret
Function at 0x522890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x5228ea
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, edx
mov esi, dword [edi + 0x80]
mov dword [ebp + 0xc], eax
nop dword [eax]
cmp esi, 0x40
jae 0x5228e4
mov al, byte [eax + edx]
inc ecx
xor al, byte [esi + edi + 0x40]
mov byte [edx], al
inc edx
inc dword [edi + 0x80]
mov esi, dword [edi + 0x80]
mov eax, dword [ebp + 0xc]
sub ebx, 1
jne 0x5228c0
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ebx
cmp ebx, 0x40
jb 0x5229a9
lea eax, [edi + 0x41]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov edx, eax
sub edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], edx
lea esi, [eax + 2]
mov eax, ebx
add esi, ecx
shr eax, 6
mov dword [ebp - 8], eax
lea eax, [edi + 0x40]
push eax
push edi
call fcn.00521ff0
inc dword [edi + 0x30]
add esp, 8
mov eax, dword [ebp - 4]
mov edi, 8
mov edx, dword [ebp - 0xc]
add eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
movzx ecx, byte [eax + ebx]
lea eax, [eax + 8]
xor cl, byte [edx - 1]
lea edx, [edx + 8]
mov byte [eax - 8], cl
movzx ecx, byte [esi - 1]
xor cl, byte [edx - 8]
mov byte [eax - 7], cl
movzx ecx, byte [edx - 7]
xor cl, byte [esi]
mov byte [eax - 6], cl
movzx ecx, byte [edx - 6]
xor cl, byte [esi + 1]
mov byte [eax - 5], cl
movzx ecx, byte [edx - 5]
xor cl, byte [esi + 2]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor cl, byte [esi + 3]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor cl, byte [esi + 4]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 2]
xor cl, byte [esi + 5]
add esi, 8
mov byte [eax - 1], cl
sub edi, 1
jne 0x522932
mov ebx, dword [ebp + 0xc]
add dword [ebp - 4], 0x40
sub ebx, 0x40
sub dword [ebp - 8], 1
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
jne 0x522911
test ebx, ebx
je 0x5229ec
lea esi, [edi + 0x40]
push esi
push edi
call fcn.00521ff0
inc dword [edi + 0x30]
add esp, 8
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov edi, dword [ebp - 4]
sub dword [ebp + 0x10], ecx
add edi, ecx
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + edx]
mov al, byte [eax + ecx]
xor al, byte [esi + edx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x5229d0
mov edi, dword [ebp + 8]
mov dword [edi + 0x80], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push dword [ebp + 0x18]
push ecx
push edx
push ebx
push 1
push esi
call fcn.00522a00
add esp, 0x24
test eax, eax
jne 0x522e99
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x14]
mov edx, eax
xor ecx, ecx
sub edx, esi
xorps xmm4, xmm4
xorps xmm3, xmm3
lea esi, [eax + 4]
nop dword [eax]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
add eax, ecx
movd xmm2, dword [edx + eax]
movd xmm1, dword [eax]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [eax + 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [esi + ecx]
add ecx, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, 0x10
jb 0x522e00
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x522e97
push ebx
push edi
call fcn.0050f8d0
add esp, 8
mov eax, 0xffffffaa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret

Function at 0x523130
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005226b0
Function at 0x5232f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], ebx
push eax
push 0x10
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.00519ab0
add esp, 0x14
test eax, eax
jne 0x5234db
movzx eax, byte [ebp - 0x13]
xor edx, edx
movzx ecx, byte [ebp - 0x10]
push esi
movzx esi, byte [ebp - 0x14]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x12]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc0], 0
movzx eax, byte [ebp - 0x11]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc4], 0
movzx eax, byte [ebp - 0xf]
or ecx, eax
mov dword [ebx + 0x104], esi
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x40], 0
movzx eax, byte [ebp - 0xd]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x44], 0
movzx eax, byte [ebp - 0xb]
or edx, ecx
movzx ecx, byte [ebp - 8]
push edi
movzx edi, byte [ebp - 0xc]
shl edi, 8
or edi, eax
shl ecx, 8
movzx eax, byte [ebp - 0xa]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 9]
xor edx, edx
shl edi, 8
or edi, eax
mov dword [ebp - 0x20], 4
movzx eax, byte [ebp - 7]
or ecx, eax
mov dword [ebx + 0x84], edi
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
or edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x100], ecx
shrd dword [ebp - 0x18], edi, 1
shl ecx, 0x1f
and edx, 1
shr edi, 1
xor eax, eax
or dword [ebp - 0x18], eax
or edi, ecx
mov ecx, dword [ebp - 0x1c]
shrd ecx, esi, 1
imul edx, edx, 0xe1000000
xor ecx, eax
shr esi, 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebx + eax*8 + 0x40], edx
mov dword [ebx + eax*8 + 0x44], edi
mov dword [ebx + eax*8 + 0xc0], ecx
mov dword [ebx + eax*8 + 0xc4], esi
sar eax, 1
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x523401
mov ecx, 2
mov dword [ebp - 0x20], ecx
nop dword [eax + eax]
lea edi, [ecx + 0x18]
mov eax, dword [ebx + edi*8]
lea edi, [ebx + edi*8]
mov dword [ebp - 0x1c], eax
lea edx, [ecx + 8]
mov eax, dword [edi + 4]
lea edx, [ebx + edx*8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp ecx, 1
jle 0x5234cd
lea eax, [ebx + 0x48]
sub edi, edx
lea esi, [edx + 8]
lea ebx, [ecx - 1]
mov edx, dword [eax + 0x80]
lea eax, [eax + 8]
mov ecx, dword [eax + 0x7c]
lea esi, [esi + 8]
xor edx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [edi + esi - 8], edx
mov dword [edi + esi - 4], ecx
mov edx, dword [eax - 8]
mov ecx, dword [eax - 4]
xor edx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x2c]
mov dword [esi - 8], edx
mov dword [esi - 4], ecx
sub ebx, 1
jne 0x523493
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jle 0x523460
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
Function at 0x5236c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
push ebx
mov ecx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x18], edi
lea edi, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x24]
push edi
push dword [ebp - 0x18]
push eax
push dword [ebp + 0x1c]
push ecx
push dword [ebp + 0x14]
push edx
push dword [ebp + 0xc]
push 0
push esi
call fcn.00523800
add esp, 0x2c
test eax, eax
jne 0x5237ef
xor esi, esi
test edi, edi
je 0x5237ed
cmp edi, 8
jb 0x5237a1
mov ecx, edi
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
movd xmm2, dword [ebx + eax]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ebp + eax - 0x10]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [ebx + eax + 4]
add eax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, ecx
jb 0x523730
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
cmp eax, edi
jae 0x5237c5
lea ecx, [ebp - 0x14]
sub ebx, ecx
nop word [eax + eax]
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [ebx + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or esi, edx
cmp eax, edi
jb 0x5237b0
test esi, esi
je 0x5237ed
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0050f8d0
add esp, 8
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
Function at 0x523b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x140]
mov edx, dword [ebx + 0x144]
mov esi, dword [ebx + 0x14c]
shld edx, eax, 3
mov dword [ebp - 0x28], ecx
shl eax, 3
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x148]
shld esi, eax, 3
mov dword [ebp - 0x1c], edx
shl eax, 3
mov dword [ebp - 0x20], eax
lea eax, [edi - 4]
mov dword [ebp - 0x18], esi
cmp eax, 0xc
ja 0x523c90
push edi
lea eax, [ebx + 0x150]
push eax
push ecx
call fcn.005478f0
mov eax, dword [ebp - 0x24]
add esp, 0xc
or eax, dword [ebp - 0x1c]
mov ecx, esi
mov edx, dword [ebp - 0x20]
jne 0x523b95
mov eax, edx
or eax, ecx
je 0x523c7d
mov esi, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x12], al
mov eax, esi
mov byte [ebp - 0x11], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x10], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov edx, dword [ebp - 0x24]
shrd eax, esi, 8
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0xe], al
mov byte [ebp - 0xf], cl
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, esi
mov byte [ebp - 9], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 5], dl
mov byte [ebp - 8], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
shrd eax, esi, 8
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
xor eax, eax
nop dword [eax]
movzx ecx, byte [ebp + eax - 0x14]
xor byte [ebx + eax + 0x170], cl
movzx ecx, byte [ebp + eax - 0x13]
xor byte [ebx + eax + 0x171], cl
movzx ecx, byte [ebp + eax - 0x12]
xor byte [ebx + eax + 0x172], cl
movzx ecx, byte [ebp + eax - 0x11]
xor byte [ebx + eax + 0x173], cl
add eax, 4
cmp eax, 0x10
jb 0x523c20
lea esi, [ebx + 0x170]
push esi
push esi
push ebx
call fcn.005234f0
add esp, 0xc
xor ecx, ecx
test edi, edi
je 0x523c7d
mov edx, dword [ebp - 0x28]
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x523c72
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
Function at 0x523d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esi
test edx, edx
je 0x523f61
lea eax, [esi + 0x170]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push ebx
movups xmmword [esi + 0x160], xmm0
push edi
lea edi, [esi + 0x160]
movups xmmword [esi + 0x170], xmm0
mov dword [esi + 0x180], eax
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
cmp edx, 0xc
jne 0x523e11
movq xmm0, qword [ecx]
movq qword [edi], xmm0
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov byte [esi + 0x16f], 1
jmp 0x523ee5
mov eax, edx
movlpd qword [ebp - 0x14], xmm0
mov ecx, 8
mul ecx
mov ecx, edx
mov byte [ebp - 9], dl
shr ecx, 0x18
mov ebx, eax
mov byte [ebp - 0xc], cl
mov eax, edx
mov ecx, edx
mov byte [ebp - 5], bl
shr ecx, 0x10
mov byte [ebp - 0xb], cl
mov ecx, edx
shr ecx, 8
mov byte [ebp - 0xa], cl
mov ecx, ebx
shrd ecx, eax, 0x18
mov byte [ebp - 8], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
mov ebx, dword [ebp + 0x14]
shrd eax, edx, 8
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
test ebx, ebx
je 0x523ea0
mov eax, dword [ebp - 0x18]
mov esi, 0x10
cmp ebx, esi
cmovb esi, ebx
xor ecx, ecx
test esi, esi
je 0x523e84
mov al, byte [ecx + eax]
xor byte [edi + ecx], al
inc ecx
mov eax, dword [ebp - 0x18]
cmp ecx, esi
jb 0x523e76
push edi
push edi
push dword [ebp - 0x1c]
call fcn.005234f0
mov eax, dword [ebp - 0x18]
add esp, 0xc
add eax, esi
mov dword [ebp - 0x18], eax
sub ebx, esi
jne 0x523e66
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x14]
xor byte [esi + ecx + 0x160], al
movzx eax, byte [ebp + ecx - 0x13]
xor byte [esi + ecx + 0x161], al
movzx eax, byte [ebp + ecx - 0x12]
xor byte [esi + ecx + 0x162], al
movzx eax, byte [ebp + ecx - 0x11]
xor byte [esi + ecx + 0x163], al
add ecx, 4
cmp ecx, 0x10
jb 0x523ea2
push edi
push edi
push esi
call fcn.005234f0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x150]
push eax
push 0x10
push edi
push esi
call fcn.00519ab0
add esp, 0x14
test eax, eax
jne 0x523f50
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], eax
test ebx, ebx
je 0x523f4e
mov edx, dword [ebp - 0x20]
mov esi, 0x10
cmp ebx, esi
cmovb esi, ebx
xor eax, eax
test esi, esi
je 0x523f3b
nop dword [eax]
mov cl, byte [eax + edi]
xor byte [edx + eax], cl
inc eax
cmp eax, esi
jb 0x523f30
push edx
push edx
push dword [ebp - 0x1c]
call fcn.005234f0
add esp, 0xc
add edi, esi
sub ebx, esi
jne 0x523f16
xor eax, eax
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
xor ecx, ebp
pop esi
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
Function at 0x5245e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x2c]
mov dword [ebp - 0x18], ebx
test edi, edi
jne 0x524620
lea eax, [edi - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebp - 0x14]
push edi
push ebx
push esi
push dword [ebp + 0x1c]
push edx
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0xc]
push 1
push eax
call fcn.00524120
mov edi, dword [ebp + 0x2c]
add esp, 0x2c
test eax, eax
jne 0x524730
mov ebx, dword [ebp + 0x28]
xor esi, esi
xor al, al
test edi, edi
je 0x5246e8
cmp edi, 8
jb 0x5246e8
mov edx, edi
xorps xmm4, xmm4
and edx, 0xfffffff8
xorps xmm3, xmm3
xor ecx, ecx
nop dword [eax]
movd xmm2, dword [ecx + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + ecx - 0x14]
lea ecx, [eax + 4]
punpcklbw xmm2, xmm0
add al, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, cl
por xmm4, xmm2
movd xmm2, dword [ecx + ebx]
movd xmm1, dword [ebp + ecx - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, al
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, edx
jb 0x524670
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
movzx ecx, al
cmp ecx, edi
jae 0x524706
nop
movzx edx, byte [ecx + ebx]
inc al
movzx ecx, byte [ebp + ecx - 0x14]
xor edx, ecx
movzx ecx, al
or esi, edx
cmp ecx, edi
jb 0x5246f0
test esi, esi
je 0x52472e
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0050f8d0
add esp, 8
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
Function at 0x53ad00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053add0
Function at 0x53d7e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053d8f0
Function at 0x53fb40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0053ff00
add esp, 4
test eax, eax
je 0x53fb5c
mov eax, 0xfffffffe
pop esi
pop ebp
ret
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x53fb95
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x53fbb7
call fcn.0053ad00
jmp 0x53fbbc
call fcn.0053d7e0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00541890
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00546c70
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x5d8f0a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x5d8f08]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x5d8f0c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x5d8f0e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret

Function at 0x57b56c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b164

Function at 0x57b577
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b2ee

Function at 0x58179a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058166e
Function at 0x590330
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
lea ecx, [esp + 8]
sub ecx, eax
and ecx, 0xf
add eax, ecx
sbb ecx, ecx
or eax, ecx
pushal
pushfd
not eax
xor edi, edx
and esi, edi
xor ecx, dword [0x6113d5]
ror esi, 0x17
mov dword [0x61be57], ecx
rol eax, 0x10
mov ecx, dword [vtable.type_info.0]

Function at 0x590360
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, 0x50c1ab6
mov esi, eax
sub ecx, esp
or esi, edi
mov esi, eax
shl esi, 3
and eax, 0xc9a5383
sub ebx, dword [0x6155c2]
and esi, edi
and esi, edi
xor edi, esi
or ecx, eax
mov ecx, dword [0x61228c]
xor edx, esp
xor esi, eax
not eax
mov edi, dword [0x615ed4]
rol edx, 0x16
mov esi, eax
shr eax, 0x19
mov esi, eax
mov eax, 0x3463793
and edx, 0xf37feec
inc eax
sub edi, ebx
mov esi, eax
xchg edi, eax
shl ecx, 0x1b
add esi, eax
shr esi, 0x17
xor eax, eax
rol esi, 0x16
xor edi, edi
xor esi, esp
neg esi
xor esi, 0x2ccf5c52
rol esi, 0x16
xor esi, eax
mov eax, edx
and esi, edi
not esi
call fcn.00412100
mov edx, dword [0x611990]
not eax
xor ecx, dword [0x613ac0]
mov ecx, 0x5c473e
ror eax, 0x18
mov dword [0x61be3c], 0x991fe9c
inc eax
shr esi, 4
rol esi, 0x1f
call fcn.00414a20
dec eax
neg ebx
inc esi
rol edi, 0x1f
loop 0x5903ef
sub esi, eax
neg eax
Function at 0x4738c9
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4735cc
and ecx, ecx
call fcn.00473904
sub ebx, ebx
or ebx, ecx
mov ecx, 0x4f8ca6a7
xor dword [edi], edx
inc ecx
mov ecx, 0x3145b71b
add edi, 2
add ecx, 1
dec ecx
cmp edi, eax
jl fcn.004738c9
or ebx, ecx
ret