joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4baa30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
mov ebx, dword [esp + 0xc4]
push ebp
push esi
mov esi, dword [esp + 0xc0]
push edi
mov edi, dword [esp + 0xc8]
lea eax, [ebx + 1]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1b], 0
call fcn.004bad00
add esp, 8
mov dword [esp + 0x20], eax
mov ebp, ebx
test ebx, ebx
jle 0x4babd4
mov ecx, edi
mov ebx, eax
sub ecx, eax
mov dword [esp + 0x1c], ecx
nop
mov edi, 0x78
cmp ebp, edi
push esi
cmovl edi, ebp
call fcn.004bbe40
add esp, 4
cmp eax, 1
jne 0x4bab0e
push 0x93
lea eax, [esp + 0x2d]
mov byte [esp + 0x2c], 0
push 0
push eax
call fcn.0042a640
push 0
push 0x94
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00414af0
mov eax, dword [esp + 0x38]
push 0
add eax, ebx
push edi
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00414a10
lea eax, [esp + 0x54]
push eax
push dword [esp + 0xfc]
mov eax, dword [esi + 0xd0]
push edi
push dword [eax + 0xc]
push esi
call fcn.004cf620
add esp, 0x40
test eax, eax
jne 0x4bac25
jmp 0x4bab6e
push 0
push 0x94
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00414af0
lea eax, [esp + 0x39]
mov byte [esp + 0x38], 0x75
push edi
push eax
call fcn.004d14d0
push dword [esp + 0xe4]
lea eax, [esp + 0x4b]
push eax
call fcn.004d1490
mov eax, dword [esp + 0x3c]
push 0
add eax, ebx
push edi
push eax
lea eax, [esp + 0x5d]
push eax
call fcn.00414a10
lea eax, [esp + 0x58]
push eax
push 0x3d
push esi
call fcn.004ddba0
add esp, 0x3c
test eax, eax
je 0x4bac25
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004dc560
add esp, 8
cmp ax, 0x4f
jne 0x4bac18
push esi
call fcn.004bbe40
add esp, 4
cmp eax, 1
mov eax, dword [esp + 0x14]
push 0
push edi
jne 0x4baba0
add eax, 0xe
jmp 0x4baba3
add eax, 0x17
push eax
push ebx
call fcn.00414a10
add esp, 0x10
push dword [esp + 0x14]
push esi
call fcn.004dc390
sub ebp, 0x78
add esp, 8
add ebx, 0x78
test ebp, ebp
jg 0x4baa90
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push 0
push ebx
push eax
push edi
call fcn.00414a10
mov bl, byte [esp + 0x23]
add esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4babf6
push eax
call fcn.004bace0
add esp, 4
mov ecx, dword [esp + 0xbc]
xor eax, eax
test bl, bl
cmovne edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0xb0
ret
push dword [esp + 0x14]
push esi
call fcn.004dc350
add esp, 8
mov edi, dword [esp + 0x18]
mov bl, 1
jmp 0x4babe5
Function at 0x4c2be0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4c4910
cmp dword [edi], 0x66
jne 0x4c4910
push 0x1c
push edi
call fcn.004bb4a0
add esp, 8
cmp eax, 0x336
je 0x4c2c40
push 0
push 0xff
push 0
push 0
push 0xcc
push 0xffffffffffffffd3
push edi
mov dword [edi + 0x80], 0xffffffd3
call fcn.004bbb10
add esp, 0x1c
mov eax, 0xffffffd3
pop edi
pop ebx
add esp, 8
ret
push ebp
mov ebp, dword [esp + 0x1c]
push esi
lea eax, [ebp - 2]
cmp eax, 0x222
ja 0x4c48ef
movzx eax, byte [eax + 0x4c4b64]
jmp dword [eax*4 + 0x4c491c]
push edi
call fcn.004bbb10
mov edi, dword [edi + 0x80]
add esp, 0x1c
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret
push 0
push 0xff
push 0
push 0
push 0xd2
mov dword [edi + 0x80], 0xffffffe0
push 0xffffffffffffffe0
jmp 0x4c318a
pop edi
mov eax, 0xffffffcd
pop ebx
add esp, 8
ret

Function at 0x4c5340
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [esp + 4]
call fcn.004bb720
add esp, 4
jmp fcn.004c2be0
Function at 0x4c9bf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x28]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, dword [esp + 0x30]
lea esi, [eax + 3]
push 0x1000
push ebp
mov byte [esp + 0x18], 0
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
call fcn.004ce010
add esp, 8
test eax, eax
je 0x4c9c69
mov eax, dword [ebp + 0x1b0]
mov eax, dword [eax + 0x1cb8]
mov ecx, dword [eax + 0x524]
test ecx, ecx
je 0x4c9c69
push ebx
add eax, 0x528
push edi
push eax
call ecx
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00424604
add esp, 0x18
ret
push 4
lea eax, [esp + 0x18]
push eax
lea eax, [ebx + 0xc]
push eax
push edi
call fcn.004de3f0
mov al, byte [edi]
add esp, 0x10
xor cl, cl
mov dword [esp + 0x10], 0
xor ah, ah
xor ch, ch
test al, al
je 0x4c9cb0
mov ecx, esi
xor byte [esp + esi + 0x10], al
lea edi, [edi + 1]
mov al, byte [edi]
dec esi
cmovs esi, ecx
test al, al
jne 0x4c9c93
mov cl, byte [esp + 0x13]
mov ah, byte [esp + 0x12]
mov ch, byte [esp + 0x11]
mov edi, dword [ebx + 4]
mov ebp, dword [ebx + 8]
mov esi, ebp
movsx eax, ah
movsx edx, cl
shl edx, 8
or edx, eax
movsx eax, ch
shl edx, 8
or edx, eax
movsx eax, byte [esp + 0x10]
shl edx, 8
or edx, eax
mov eax, dword [ebx + 4]
xor edi, edx
xor esi, edx
xor edi, dword [esp + 0x18]
xor esi, dword [esp + 0x18]
xor edi, dword [esp + 0x1c]
xor esi, dword [esp + 0x1c]
xor edi, 0x6f7330b8
xor esi, 0x6f7330b8
cmp edi, eax
jne 0x4c9d04
mov edi, eax
xor edi, 0x6f7330b8
cmp esi, ebp
jne 0x4c9d10
mov esi, ebp
xor esi, 0x6f7330b8
mov ecx, dword [esp + 0x24]
mov dword [ebx + 4], edi
pop edi
mov dword [ebx + 8], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0x18
ret
Function at 0x4cd840
Capabilities:
Move file

Disassembly:
call fcn.004e4460
cmp eax, 2
je 0x4cdd30
jmp 0x4cddc0
push ecx
mov eax, dword [esp + 0xc]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
mov dword [esp + 8], edi
test eax, eax
je 0x4cddb0
cmp dword [esp + 0x18], edi
je 0x4cddb0
push ebx
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.004e3f60
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4cdda9
cmp dword [esp + 0xc], edi
je 0x4cdd93
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edi
push eax
push dword [esp + 0x20]
call fcn.004e3f60
mov edi, eax
add esp, 8
test edi, edi
je 0x4cdd93
cmp dword [esp + 0xc], 0
je 0x4cdd93
push edi
push ebx
call fcn.00451bb7
add esp, 8
mov esi, eax
push ebx
call fcn.004bace0
add esp, 4
test edi, edi
je 0x4cdda9
push edi
call fcn.004bace0
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ecx
ret
push ecx
mov eax, dword [esp + 0xc]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
mov dword [esp + 8], edi
test eax, eax
je 0x4cde40
cmp dword [esp + 0x18], edi
je 0x4cde40
push ebx
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.004e4100
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4cde39
cmp dword [esp + 0xc], edi
je 0x4cde23
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edi
push eax
push dword [esp + 0x20]
call fcn.004e4100
mov edi, eax
add esp, 8
test edi, edi
je 0x4cde23
cmp dword [esp + 0xc], 0
je 0x4cde23
push edi
push ebx
call fcn.00452036
add esp, 8
mov esi, eax
push ebx
call fcn.004bace0
add esp, 4
test edi, edi
je 0x4cde39
push edi
call fcn.004bace0
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4de3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x1bec6235
push edi
cmp dword [ebp], eax
mov edi, 0xebe86632
cmove edi, ecx
cmp byte [esi], al
je 0x4de42f
movsx edx, byte [esi]
lea ecx, [eax*8]
shl edx, cl
lea esi, [esi + 1]
inc eax
xor ecx, ecx
xor edi, edx
cmp eax, 4
cmovge eax, ecx
cmp byte [esi], cl
jne 0x4de411
xor esi, esi
cmp dword [esp + 0x1c], esi
jle 0x4de47d
push ebx
mov ebx, dword [esp + 0x1c]
lea esp, [esp]
test esi, esi
je 0x4de45d
push dword [ebp + esi*4]
call fcn.004de280
xor eax, dword [ebx + esi*4 - 4]
add esp, 4
xor eax, dword [ebp + esi*4 - 4]
mov dword [ebx + esi*4], eax
jmp 0x4de475
mov eax, dword [ebp]
test eax, eax
je 0x4de473
push eax
call fcn.004de280
add esp, 4
xor eax, edi
mov dword [ebx], eax
jmp 0x4de475
mov dword [ebx], edi
inc esi
cmp esi, dword [esp + 0x20]
jl 0x4de440
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4f7220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x596480], ebx
jne 0x4f72ae
push ebp
xor edi, edi
mov ebp, 0x596488
mov ebx, 0x100
lea ecx, [ecx]
movzx eax, di
mov esi, 8
mov dword [esp + 0x10], 0
mov dx, ax
mov dword [esp + 0x14], eax
mov ax, word [esp + 0x10]
lea esp, [esp]
mov cl, byte [esp + 0x14]
xor cl, byte [esp + 0x10]
test cl, 1
je 0x4f7281
mov ecx, 0x74ba
xor cx, ax
shr cx, 1
movzx eax, cx
mov dword [esp + 0x10], eax
jmp 0x4f7289
shr ax, 1
mov word [esp + 0x10], ax
shr dx, 1
mov word [esp + 0x14], dx
dec esi
jne 0x4f7260
mov word [ebp], ax
inc edi
add ebp, 2
cmp di, bx
jb 0x4f7240
mov dword [0x596480], 1
xor ebx, ebx
pop ebp
mov esi, dword [esp + 0x1c]
xor edx, edx
test esi, esi
jle 0x4f72dd
mov edi, dword [esp + 0x18]
lea esp, [esp]
movzx ecx, byte [edx + edi]
inc edx
movzx eax, bl
xor ecx, eax
shr bx, 8
xor bx, word [ecx*2 + 0x596488]
movzx ebx, bx
cmp edx, esi
jl 0x4f72c0
pop edi
pop esi
mov ax, bx
pop ebx
add esp, 8
ret
Function at 0x5088d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, edx
sar eax, 8
push esi
mov esi, dword [esp + 8]
mov byte [esp + 9], al
mov eax, edx
mov byte [esp + 8], dl
sar edx, 0x18
sar eax, 0x10
mov byte [esp + 0xb], dl
mov edx, dword [esp + 0xc]
mov byte [esp + 0xa], al
push edi
mov edi, esi
test edx, edx
je 0x508919
mov al, byte [esp + ecx + 0xc]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
xor eax, eax
cmp ecx, 3
cmovg ecx, eax
dec edx
jne 0x508903
mov eax, edi
pop edi
pop esi
ret

Function at 0x508920
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 8]
mov eax, edx
push esi
sar eax, 8
mov esi, ebx
push edi
mov edi, dword [esp + 0x14]
mov byte [esp + 0x15], al
mov eax, edx
mov byte [esp + 0x14], dl
sar eax, 0x10
sar edx, 0x18
mov byte [esp + 0x16], al
mov byte [esp + 0x17], dl
test edi, edi
je 0x50896a
mov al, byte [esp + ecx + 0x14]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
xor eax, eax
cmp ecx, 3
cmovg ecx, eax
dec edi
jne 0x508954
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x509640
Capabilities:
Create thread

Disassembly:
cmp dword [0x5976d8], 0
mov dword [0x5a3a0c], 0xffffffff
je 0x509660
push dword [0x5a3a04]
call dword [0x56b0a4]
ret
push esi
push 0
push 0
push 1
push 0
call dword [0x56b0ac]
mov esi, eax
mov dword [0x5a3a04], esi
test esi, esi
je 0x5096aa
push 4
push 1
call fcn.004475d8
add esp, 8
test eax, eax
je 0x5096aa
push eax
push 0
push 0x509740
mov dword [eax], esi
call fcn.00456071
add esp, 0xc
mov dword [0x5976d8], eax
push 0
call dword [0x56b2b8]
pop esi
ret

Function at 0x5096b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0xc]
or ecx, 0xffffffff
test eax, eax
push esi
cmovne ecx, eax
cmp dword [0x5976d8], 0
mov eax, dword [esp + 0x14]
mov dword [0x5a3a0c], ecx
mov dword [0x5a3a08], eax
je 0x5096e8
push dword [0x5a3a04]
call dword [0x56b0a4]
mov eax, dword [0x5976d8]
pop esi
ret
push 0
push 0
push 1
push 0
call dword [0x56b0ac]
mov esi, eax
mov dword [0x5a3a04], esi
test esi, esi
je 0x50973a
push 4
push 1
call fcn.004475d8
add esp, 8
test eax, eax
je 0x50973a
push eax
push 0
push 0x509740
mov dword [eax], esi
call fcn.00456071
add esp, 0xc
mov dword [0x5976d8], eax
push 0
call dword [0x56b2b8]
mov eax, dword [0x5976d8]
test eax, eax
jne 0x50973c
xor eax, eax
pop esi
ret
Function at 0x5263a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push 0x56b5f8
push edi
push esi
call fcn.004cd6e0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x52648a
push ebx
push 2
push 0
push ebp
call fcn.00432ad5
push ebp
call fcn.0043310b
push 0
push 0
push ebp
mov edi, eax
call fcn.00432ad5
lea ebx, [edi + 1]
push ebx
call fcn.00444a76
mov esi, eax
add esp, 0x20
test esi, esi
je 0x52647a
cmp edi, 0xffffffff
je 0x52647a
push 0
push ebx
push 0
push esi
call fcn.00414af0
push ebp
push 1
push edi
push esi
call fcn.0043263a
mov byte [edi + esi], 0
add esp, 0x20
mov al, byte [esi]
mov ecx, esi
mov edx, esi
test al, al
je 0x52643e
cmp al, 0xd
jne 0x526434
cmp byte [esi + 1], 0xa
jne 0x526434
mov al, byte [esi + 1]
inc esi
mov byte [ecx], al
jmp 0x526438
mov byte [ecx], al
inc ecx
inc esi
mov al, byte [esi]
test al, al
jne 0x526422
mov byte [ecx], 0
mov esi, edx
cmp byte [edx], 0
mov ecx, edx
je 0x526477
lea ebx, [ebx]
mov al, byte [ecx]
cmp al, 0x5c
jne 0x526461
cmp byte [ecx + 1], 0xa
jne 0x526461
add ecx, 2
jmp 0x526472
cmp al, 0x93
je 0x526469
cmp al, 0x94
jne 0x52646c
mov byte [ecx], 0x22
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
cmp byte [ecx], 0
jne 0x526450
mov byte [edx], 0
push ebp
call fcn.00432051
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.004459f9
mov eax, dword [eax]
dec eax
je 0x5264c9
sub eax, 0xc
je 0x5264c9
test esi, esi
je 0x5264f3
mov dword [esi + 0x80], 0xffffffff
call fcn.004459f9
push 0
push 0xff
push edi
push dword [eax]
push 0x5c
push 0xffffffffffffffff
push esi
call fcn.004bbb10
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebp
ret
test esi, esi
je 0x5264f3
mov dword [esi + 0x80], 0xffffffe2
call fcn.004459f9
push 0
push 0xff
push edi
push dword [eax]
push 0x5b
push 0xffffffffffffffe2
push esi
call fcn.004bbb10
add esp, 0x1c
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x529cb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push esi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x38]
movzx esi, byte [ecx]
movzx eax, byte [ecx + 1]
shl esi, 8
add esi, eax
mov dword [esp + 0xc], edi
movzx eax, byte [ecx + 2]
shl esi, 8
add esi, eax
je 0x529def
push ebx
push ebp
xor ebp, ebp
lea ebx, [ecx + 3]
xor edx, edx
mov dword [esp + 0x18], ebx
test esi, esi
jle 0x529d30
mov edi, 0x100
jmp 0x529d10
movzx ecx, byte [ebx + edx]
movzx eax, byte [ebx + edx + 1]
add edx, 2
imul cx, di
add cx, ax
movzx eax, cx
xor ebp, eax
cmp edx, esi
jl 0x529d10
mov edi, dword [esp + 0x14]
movsx ecx, byte [ebx + edx]
lea edx, [edx + 1]
mov dword [esp + 0x20], ecx
test ecx, ecx
jle 0x529d51
lea eax, [ebx + edx]
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00429b40
add esp, 0xc
push esi
push edi
call fcn.004bad00
add esp, 8
mov dword [esp + 0x28], eax
test eax, eax
je 0x529ded
mov edx, eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], edx
xor ebx, ebx
mov dword [esp + 0x10], eax
lea edi, [eax + 1]
test esi, esi
jle 0x529dc9
mov edi, edi
cmp ecx, 0xf
jl 0x529d8c
xor ecx, ecx
mov edi, 1
mov eax, edi
and eax, ebp
test ax, ax
je 0x529dbd
mov eax, ebx
cdq
idiv dword [esp + 0x20]
mov al, byte [esp + edx + 0x2c]
mov edx, dword [esp + 0x18]
xor al, byte [edx + ebx]
mov edx, dword [esp + 0x14]
mov byte [edx], al
inc edx
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x529dc1
mov eax, dword [esp + 0x10]
inc ebx
inc ecx
add edi, edi
cmp ebx, esi
jl 0x529d80
push 0
sub esi, eax
push esi
push 0
push edx
call fcn.00414af0
mov ecx, dword [esp + 0x2c]
add esp, 0x10
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor ecx, esp
call fcn.00424604
add esp, 0x2c
ret

Function at 0x529e00
Capabilities:
Encode data using xor

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov word [esp + 4], 0x5347
mov byte [esp + 6], 0x49
test edi, edi
jle 0x529e40
push esi
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
mov eax, 0xaaaaaaab
lea esi, [esi + 1]
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
inc ecx
mov al, byte [esp + edx + 8]
xor byte [esi - 1], al
cmp ecx, edi
jl 0x529e20
pop esi
pop edi
pop ecx
ret
Function at 0x533790
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0x60
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042a640
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
xor eax, eax
pop ebp
ret

Function at 0x53d390
Capabilities:
Terminate process

Disassembly:
push 0
mov dword [0x59c358], 1
call fcn.005468f0
add esp, 4
call fcn.005463c0
test eax, eax
je 0x53d3c3
push 0
push 0
push 0
push 0
push 0
push 0
push 0x11
call fcn.00546200
add esp, 0x1c
push esi
push 0
push 0
call fcn.005465e0
mov esi, dword [esp + 0x10]
add esp, 8
push 0
push 1
call fcn.0053dde0
cmp esi, 0x18
jne 0x53d3f1
push str.daemon_shutdown_requested___shutting_down_n
call fcn.0053d620
add esp, 0xc
jmp 0x53d418
cmp esi, 0x17
jle 0x53d40a
lea eax, [esi - 0x17]
push eax
push esi
push str.EXITING_DUE_TO_SIGNAL__d_Exit_reason__d_n
call fcn.0053d620
add esp, 0x14
jmp 0x53d418
push esi
push str.EXITING_DUE_TO_SIGNAL__d_n
call fcn.0053d620
add esp, 0x10
push edi
call fcn.0049ca20
call fcn.0047d560
mov edi, eax
test edi, edi
je 0x53d440
push 0
push 1
call fcn.0053dde0
push edi
push str.ts_cleanup_returns__d_n
call fcn.0053d620
add esp, 0x10
cmp dword [0x599b04], 0
pop edi
jne 0x53d454
push 1
call fcn.0053ed70
add esp, 4
push str.on_exit
push 0x593570
call fcn.0053eab0
push dword [0x59c53c]
call fcn.0053eaa0
add esp, 0xc
call fcn.0053ecc0
cmp esi, 0x20
je 0x53d485
push 1
call fcn.00490100
add esp, 4
cmp esi, 0x18
jne 0x53d491
push 0x25
call fcn.0044edcb
push esi
call fcn.0044edcb
int3
Function at 0x5c3eb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x967ea0
jmp 0x8c4947
push esp
push dword [esp]
pop ebp
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x8c4963
jmp 0x9113d9
jmp 0x8f96d9
push ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], esi
mov dword [esp], edi
mov dword [esp], ecx
pop edx
push 0x66678cf
mov dword [esp], ecx
push dword [esp]
pop edx
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push 0x1b342fc7
mov dword [esp], ebp
mov dword [esp], ecx
push dword [esp]
pop edx
add esp, 4
jmp 0x8f96ae
sub esi, 0xfc2e89bb
add eax, esi
pop esi
sub eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
mov dword [esp], ecx
jmp 0x8f97ac
xor esi, 0x3f2e8b88
jne 0x8f96ae
jmp 0x8f9661
push eax
push esp
pop eax
push esi
mov esi, 0x5b7f4a04
neg esi
js 0x8f979b
jmp 0x8f96c8
add esi, 0x1e7f4c3b
jbe 0x8f96ae
jmp 0x8f96c8
jmp 0x911b31
jmp 0x8fce79
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x8fce93
push edx
push esp
pop edx
add edx, 4
sub edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
jmp 0x8fce6e
jmp 0x9693fe
jmp 0x911510
sub esi, ebp
pop ebp
push esi
push dword [esp + 4]
mov esi, dword [esp]
add esp, 4
pop dword [esp]
pop esp
jmp 0x911527
push ecx
mov dword [esp], esi
mov esi, esp
add esi, 4
push ebp
mov ebp, 0x14
jmp 0x9113de
jmp 0x942eae
jmp 0x911bef
push esi
push esp
pop esi
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebx
mov dword [esp], esi
mov dword [esp], edx
jmp 0x911c63
jmp 0x93a3f2
jmp 0x93a456
rdtsc
jmp 0x93a50d
jmp 0x8fcd6f
jmp 0x942f67
sub esp, 4
mov dword [esp], ebp
push esi
mov esi, 0x6c93065e
mov dword [esp + 4], esi
mov esi, dword [esp]
add esp, 4
mov dword [esp], ebx
jmp 0x942fdb
jmp 0x8f965c
jmp 0x967f6e
mov esi, dword [esp]
add esp, 4
mov dword [esp], ebp
jmp 0x967fe7
push ebp
push 0x68408ee8
mov dword [esp], esi
mov esi, 0x11d1a356
mov dword [esp + 4], esi
jmp 0x967f00
jmp 0x8c4840
jmp fcn.00969515

Function at 0x60afc3
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop ebp
ret
Function at 0x43d45c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43d4d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43d4c0
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43d499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d4dd
lea eax, [ebp - 0xc]
call fcn.00404060
ret

Function at 0x444e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444e81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x444e6b
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404328
inc dword [ebp - 0xc]
dec esi
jne 0x444e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444e88
lea eax, [ebp - 0x10]
call fcn.00404060
ret

Function at 0x5707b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + 0x18]
bswap ecx
push 0xbacb5221
setbe ch
mov dx, dx
movzx ecx, word [edi + ebx*8 + 4]
pushfd
call fcn.00582328
test eax, eax
lea esp, [esp + 0x24]
js 0x57e1c8
pushal
lea esp, [esp + 0x20]
jns 0x5bff18
shld edx, esi, cl
btr bx, 0xe
neg dx
and eax, 0x7fffffff
shl bx, 4
inc edx
pushfd
add eax, dword [esi + 0x2c]
lea edx, [ecx*4 + 0x3022f083]
pop edx
xchg dx, bx
mov ebx, eax
movzx edx, dl
lea edx, [eax + 2]
pushal
lea esp, [esp + 0x20]
jmp 0x5e31c1
jmp 0x5a0374
push edi
mov word [esp], sp
pushal
lea esp, [esp + 0x24]
jns 0x5bff18
clc
and eax, 0x7fffffff
shrd ebx, esp, cl
movzx ebx, al
add eax, dword [esi + 0x2c]
jmp 0x541e4e
xchg edx, eax
pushfd
not eax
jmp 0x543611
cmc
mov cx, word [eax]
cmc
add eax, 2
call fcn.005c73b9