joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c3b5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x875884]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x45c416
push esi
push dword [0x875880]
push 8
push dword [0x871534]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x875884]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x87587c]
jmp 0x45c406
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x45c404
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x45c3f4
push edi
push 0x45c353
call fcn.00572d5b
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x45c420
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x45c436
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x875880]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x45c46f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x871534]
mov dword [0x875884], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x875884]
call ebx
mov esi, dword [0x875880]
lea eax, [edi + esi]
push eax
push dword [0x875884]
mov dword [0x875880], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x871534]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x875884]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x45c4ae
test ebx, ebx
je 0x45c4cf
push 0x14
push 0x87587c
call fcn.0045cd26
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x45c4cf
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x45ce30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x45ce69
push ecx
push dword [0x876014]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x45ce78
push ecx
push 0
push dword [0x876014]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.0045d1d0
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x45cef0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret
Function at 0x45d0b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x45d0ce
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x45d0f2
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x45d10d
cmp edx, 0x100000
jle 0x45d120
cmp ecx, 0x100000
jge 0x45d107
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x876014]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x45d140
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x45d180
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x45d1a7
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x45d1a7
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x45d1b0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x45d290
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x86dea8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4
Function at 0x470160
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x470215
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x5cc110]
xor edx, dword [ecx*4 + 0x5cbd10]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x5cc510]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x5cad10]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x5cb110]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x5ca910]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x5cb510]
xor edx, dword [eax*4 + 0x5cb910]
mov eax, edx
sub ebx, 1
jne ReadConsoleW
pop ebx
jmp 0x470219
mov eax, dword [esp + 0xc]
test edi, edi
je SetFilePointerEx
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x5ca910]
sub edi, 1
jne 0x470220
pop edi
pop esi
ret

Function at 0x476073
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00476b8f
mov edx, dword [esi + 0x14]
pop ecx
test edx, edx
je 0x4760ce
mov ecx, dword [esi + 0x10]
mov eax, dword [esi]
push ebp
push edi
mov edi, dword [esi + 0x20]
mov ebp, dword [eax + ecx*4]
cmp edi, edx
jae 0x4760cc
push ebx
mov ebx, dword [esi + 0x18]
push 0x18
pop ecx
sub ecx, edi
mov eax, ebp
shr eax, cl
add edi, 8
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x5cdca0]
xor ebx, ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], ebx
cmp edi, edx
jb 0x47609b
pop ebx
pop edi
pop ebp
mov ax, word [esi + 0x18]
pop esi
ret

Function at 0x476b8f
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0x1c]
mov edx, ecx
mov edi, dword [esi + 0x10]
cmp edi, ecx
jbe 0x476c0b
push ebx
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x476c0a
mov eax, dword [esi]
lea edx, [ecx + 1]
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [eax + ecx*4]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edx
mov dword [esp + 0x18], eax
cmp ebx, 0x20
jae 0x476c02
mov edx, eax
push 0x18
pop ecx
sub ecx, ebx
mov eax, ebp
shr eax, cl
add ebx, 8
movzx ecx, al
mov eax, edx
shr eax, 8
xor ecx, eax
movzx edx, dl
shl edx, 8
movzx ecx, word [ecx*2 + 0x5cdca0]
xor edx, ecx
mov dword [esi + 0x20], ebx
cmp ebx, 0x20
jb 0x476bc8
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
and dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
pop ebp
pop ebx
movzx eax, word [esi + 0x18]
sub edi, edx
push eax
mov eax, dword [esi]
push edi
lea eax, [eax + edx*4]
push eax
call fcn.0047a583
add esp, 0xc
movzx eax, ax
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ecx
ret
Function at 0x47a583
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp esi, 2
jb 0x47a61d
push ebp
mov ebp, esi
shr ebp, 1
mov ebx, dword [edi]
sub esi, 2
mov edx, dword [edi + 4]
movzx eax, cx
shr ebx, 0x10
xor ebx, eax
mov eax, edx
shr eax, 0x18
mov ecx, ebx
shr ecx, 8
mov cx, word [ecx*2 + 0x5ceaa0]
xor cx, word [eax*2 + 0x5ce2a0]
movzx eax, byte [edi + 5]
xor cx, word [eax*2 + 0x5cdea0]
movzx eax, byte [edi + 6]
xor cx, word [eax*2 + 0x5ce0a0]
movzx eax, byte [edi + 1]
xor cx, word [eax*2 + 0x5ce6a0]
movzx eax, bl
xor cx, word [eax*2 + 0x5ce8a0]
mov eax, dword [edi]
add edi, 8
movzx eax, al
xor cx, word [eax*2 + 0x5ce4a0]
movzx eax, dl
xor cx, word [eax*2 + 0x5cdca0]
movzx ecx, cx
sub ebp, 1
jne 0x47a5a0
pop ebp
test esi, esi
je 0x47a65f
mov ebx, dword [edi]
mov edx, ebx
movzx eax, cx
shr edx, 0x10
xor edx, eax
movzx eax, byte [edi + 1]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x5ce2a0]
xor cx, word [eax*2 + 0x5cdea0]
movzx eax, dl
xor cx, word [eax*2 + 0x5ce0a0]
movzx eax, bl
xor cx, word [eax*2 + 0x5cdca0]
movzx ecx, cx
pop edi
pop esi
mov ax, cx
pop ebx
ret

Function at 0x47a666
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x47a68a
push esi
mov esi, dword [esp + 8]
movzx ecx, byte [esi]
movzx eax, al
xor ecx, eax
inc esi
mov al, byte [ecx + 0x5ceca0]
sub edx, 1
jne 0x47a675
pop esi
ret
Function at 0x4b07e0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x4b098f
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4b098f
push esi
mov esi, dword [esp + 0x24]
push edi
test esi, esi
je 0x4b0816
mov eax, dword [esi + 4]
test eax, eax
je 0x4b0826
push dword [esi]
push 0x18
call eax
add esp, 8
jmp 0x4b0820
push 0x18
call fcn.00573b44
add esp, 4
mov edi, eax
test edi, edi
jne 0x4b0830
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
lea eax, [edi + 8]
mov dword [edi], ebx
test eax, eax
je 0x4b0890
test esi, esi
je 0x4b0875
cmp dword [esi], 0
jne 0x4b085b
cmp dword [esi + 0xc], 0
jne 0x4b0861
cmp dword [esi + 4], 0
jne 0x4b085b
cmp dword [esi + 8], 0
je 0x4b0875
cmp dword [esi + 0xc], 0
je 0x4b0890
cmp dword [esi + 4], 0
jne 0x4b086d
cmp dword [esi + 8], 0
je 0x4b0890
movups xmm0, xmmword [esi]
movups xmmword [eax], xmm0
jmp 0x4b0890
mov dword [eax], 0
mov dword [eax + 4], 0x47cdc0
mov dword [eax + 8], 0x47cdd0
mov dword [eax + 0xc], 0x47cd50
lea eax, [esp + 0x14]
push eax
push 0
push edi
push 0x4b0aa0
push dword [esp + 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebp], ecx
test ecx, ecx
jne 0x4b08f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ad1c0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b0988
test esi, esi
je 0x4b08e5
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4b08ee
push dword [esi]
push edi
call ecx
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00573b4f
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [esp + 0x18]
add eax, 5
cmp eax, 6
ja case.0x4b0901.2
jmp dword [eax*4 + 0x4b0998]
mov eax, 0xfffffff1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
or eax, 0xffffffff
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 2
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0xf
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
xor eax, eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x4b6540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movzx eax, word [esi + 0x20]
cmp eax, 6
ja case.0x4b6558.12
jmp dword [eax*4 + 0x4b6738]
cmp word [esi + 0x18], 8
je case.0x4b6558.12
movzx eax, word [esi + 0x18]
mov edi, 1
mov cl, al
shl edi, cl
mov ecx, 0xff
dec edi
cmp eax, 0x10
cmove edi, ecx
lea eax, [edi + 1]
push eax
call fcn.004b1840
add esp, 4
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4b65c0
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.004b2130
add esp, 4
push eax
mov eax, dword [esi]
push dword [eax + 0x304]
call fcn.004bc680
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
cmp word [esi + 0x20], bx
jne 0x4b65ea
test edi, edi
js 0x4b6606
imul ebp, edi, 0xff
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
sub ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x4b65d2
jmp 0x4b6606
test edi, edi
js 0x4b6606
xor ebp, ebp
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
add ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x4b65f0
cmp word [esi + 0x18], 0x10
ja case.0x4b6558.12
movzx eax, word [esi + 0x20]
cmp eax, 1
je 0x4b661b
test ax, ax
jne case.0x4b6558.12
push esi
call fcn.004b7950
add esp, 4
test eax, eax
jne 0x4b6630
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [esi + 0x38]
call fcn.004b1830
add esp, 4
mov dword [esi + 0x38], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov ebp, dword [esi + 0x24]
mov edx, ebp
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
shl eax, cl
mov ecx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x4b66ac
mov dword [esp + 0x1c], 0x100
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [esp + 0x1c]
jae 0x4b66ee
mov ax, word [edi]
add edi, 2
cmp ax, word [esp + 0x1c]
jae 0x4b66ee
mov ax, word [ebx]
add ebx, 2
cmp ax, word [esp + 0x1c]
jae 0x4b66ee
test ecx, ecx
jg 0x4b6680
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.004b2130
add esp, 4
push eax
mov eax, dword [esi]
push dword [eax + 0x304]
call fcn.004bc640
add esp, 0xc
cmp word [esi + 0x18], 8
ja case.0x4b6558.12
push esi
call fcn.004b7c00
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
add edx, 0xffffffff
js 0x4b66cc
mov eax, dword [esi + 0x28]
sub ebp, eax
mov ebx, dword [esp + 0x14]
sub ebx, eax
lea ecx, [eax + edx*2]
nop word [eax + eax]
sub edx, 1
movzx eax, byte [ecx + ebp + 1]
mov word [ecx + ebp], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [ebx + ecx + 3]
mov word [ebx + ecx + 2], ax
jns 0x4b6710
jmp 0x4b66cc
Function at 0x4f3710
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4f3730
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4f3730
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4f3730
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x53dd90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x53ddc4
push esi
call fcn.0053d3b0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x53ddbb
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x53ddcb
cmp eax, 0xcb
jne 0x53de43
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x53de2e
mov eax, dword [esi + 8]
test eax, eax
je 0x53dde6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x53de29
cmp eax, 2
je 0x53de2e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x53ddd7
cmp eax, 3
je 0x53de0e
cmp eax, 1
jne 0x53ddd7
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x53ddd7
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x53ddd7
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0053de80
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x53de65
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0053de80
add esp, 4
pop edi
pop esi
ret

Function at 0x53de80
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x53deaf
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x53df32
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x53df06
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x53dee5
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x53df49
cmp eax, dword [esi + 0x60]
jb 0x53dec7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x53dec0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x543b50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1c0]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x543c83
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x543bce
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x543c14
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x543c02
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x543bf0
cmp dword [esp + 0x18], 1
jne 0x543c61
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x543c40
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x543bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x571140
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov ecx, dword [edi + 0x18]
cmp ecx, 0xc
jle 0x57115d
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], ecx
jge 0x57121d
lea esi, [edi + 0x44]
nop dword [eax + eax]
mov dl, byte [esi]
test dl, dl
jne 0x5711ef
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x57118b
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x57119b
push dword [ecx + 0x38]
push 1
push 1
push esi
call fcn.00589a16
add esp, 0x10
cmp eax, 1
jne 0x571276
mov al, byte [esi]
test al, al
je 0x571267
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x5711c8
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x5711d7
push dword [edx + 0x38]
push eax
push 1
push ebp
call fcn.00589a16
add esp, 0x10
mov dl, byte [esi]
mov ecx, eax
movzx eax, dl
cmp ecx, eax
jne 0x571276
mov al, byte [ebp]
mov byte [ebp], 2
jmp 0x5711fd
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
dec dl
movzx eax, al
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jl 0x571170
mov eax, dword [esp + 0x18]
movzx ecx, word [ecx*2 + 0x60512c]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x57125d
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x57125d
cmp ecx, 0xc
jge 0x57125d
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
mov eax, 0x70
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret
pop esi
pop ebp
mov eax, 0x66
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret

Function at 0x5715e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5715ff
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x571613
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.00589a16
add esp, 0x10
cmp eax, 1
jne 0x571669
mov al, byte [esp + 0xc]
lea ecx, [edi + 0x44]
test al, al
je 0x571675
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
mov byte [ecx], al
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x571647
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x57165e
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.00589a16
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x571689
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [ecx], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x5716a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5716bf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5716d3
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.00589a16
add esp, 0x10
cmp eax, 1
jne 0x571729
mov cl, byte [esp + 0xc]
test cl, cl
je 0x571735
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x571707
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x57171e
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.00589a16
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x57173f
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret