joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bc3d8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x6947e8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5bc41e
cmp word [ebx], dx
jne 0x5bc41e
or byte [eax + edi + 0x28], 4
jmp 0x5bc423
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x5bc586
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x5bc566
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x5bc464
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x5bc49a
cmp eax, edx
jae 0x5bc4a8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x5bc43f
jmp 0x5bc586
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5bc561
cmp dword [ebp - 0x18], 0
je 0x5bc561
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x6947e8]
test byte [eax + edi + 0x28], 0x48
je 0x5bc537
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x5bc4fb
mov word [esi], cx
jmp 0x5bc532
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x6947e8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x6947e8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x6947e8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x5bc586
pop eax
cmp word [ebp - 4], ax
jne 0x5bc547
cmp esi, ebx
jne 0x5bc547
mov word [esi], ax
jmp 0x5bc583
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.005bd12f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x5bc586
push 0xd
pop eax
jmp 0x5bc542
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x6947e8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x5bc580
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x5bc586
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5c3b73
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x5c3bbe
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.005c3f06
test al, al
jne 0x5c3bb8
sub edx, 2
cmp edx, edi
jne 0x5c3b9e
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x5c3be0
lea eax, [edi + 2]
cmp edx, eax
je 0x5c3be0
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005c383a
add esp, 0x10
jmp 0x5c3cda
push esi
lea ecx, [ebp - 0x255]
call fcn.005c3f06
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c3c23
push dword [ebp - 0x25c]
jmp 0x5c3bd0
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x5c3c60
cmp word [ebp - 0x226], 0
je 0x5c3c81
cmp word [ebp - 0x226], ax
jne 0x5c3c60
cmp word [ebp - 0x224], 0
je 0x5c3c81
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005c383a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x5c3ccd
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5c3c3a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x5c3cb5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x5c3cda
push 0x5c343c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.005a8d50
add esp, 0x10
jmp 0x5c3caa
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00530cbe
leave
ret
Function at 0x5c4fef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5c508c
push ebx
push esi
call fcn.005c4fab
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005bd279
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5c5039
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5c508b
push edi
push eax
call fcn.005b680b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5c5059
call int.0087b2e1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5c508a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005bd279
add esp, 0x20
test eax, eax
jne 0x5c5078
push edi
call int.0087b2e1
jmp 0x5c5080
push ebx
call int.0087b2e1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5c508f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5c50a0
pop esi
ret
push ebx
push edi
push esi
call fcn.005c4fab
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.005b680b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5c50c8
push ebx
push esi
push edi
call fcn.005683f0
add esp, 0xc
push 0
call int.0087b2e1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5c5f8d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c5e61

Function at 0x5c8174
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.005b64af
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c81e3
cmp esi, dword [ebp - 4]
je 0x5c81de
cmp dword [ebp + 0xc], 0
je 0x5c81de
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x5c81bb
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.005c7cc6
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x5c81e5
xor eax, eax
inc eax
jmp 0x5c81e5
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5c824a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.005b64af
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005b64af
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x5c82c1
cmp word [ecx], dx
je 0x5c82c1
mov eax, dword [0x63d1a4]
push edi
dec eax
push eax
push 0x63d090
call fcn.005c81e9
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5c8334
cmp word [eax], dx
je 0x5c8334
mov eax, dword [edi]
test eax, eax
je 0x5c82e5
cmp word [eax], dx
je 0x5c82e5
lea eax, [ebp - 0x10]
push eax
call fcn.005c7bcc
jmp 0x5c82ee
lea eax, [ebp - 0x10]
push eax
call fcn.005c7c67
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5c835e
mov eax, dword [0x63d08c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x63cd80
call fcn.005c81e9
add esp, 0xc
test al, al
je 0x5c835e
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5c8329
cmp word [eax], di
je 0x5c8329
lea eax, [ebp - 0x10]
push eax
call fcn.005c7bcc
pop ecx
jmp 0x5c8360
lea eax, [ebp - 0x10]
push eax
call fcn.005c7c67
jmp 0x5c8326
mov eax, dword [edi]
test eax, eax
je 0x5c834b
cmp word [eax], dx
je 0x5c834b
lea eax, [ebp - 0x10]
push eax
call fcn.005c7b63
pop ecx
jmp 0x5c835e
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5c8429
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.005c806e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5c8429
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5c8429
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5c8429
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5c83b6
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.005b76ce
test ebx, ebx
je 0x5c8424
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.005b76ce
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c8429
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c8429
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.005d06b6
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5c842b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00530cbe
leave
ret
Function at 0x5cc3a0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x5cc3e3
call fcn.005758ea
mov dword [eax], 0xf
call fcn.0087f949
mov dword [eax], 0xd
call fcn.0088c039
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00530cbe
leave
ret
test eax, eax
jne 0x5cc3ea
inc eax
jmp 0x5cc3d7
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x5cc3d5
xor eax, eax
cmp ecx, 1
setne al
jmp 0x5cc3d7

Function at 0x5d8760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5d878d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5d878d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5d8b24
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005e8541
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5d8b51
xor eax, eax
jmp 0x5d8c4d
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x56c66d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.005da581
push esi
push eax
call fcn.0056c680
add esp, 0x14
test eax, eax
je 0x5d8b8c
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005e86fc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005da563
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005dc482
add esp, 0x28
test eax, eax
jne 0x5d8bc3
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x5d8c04
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005e86cd
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5d8bff
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x5d8c34
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005e860e
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005e85c8
add esp, 0x14
jmp 0x5d8b4a
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.005e8490
push dword [ebp - 4]
call fcn.005d8f26
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x5dc12e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x5dc164
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x5dc157
push eax
call fcn.005e85b4
push 2
call fcn.005e852d
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.00870b9c
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x5dde9e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005e8541
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5ddecb
xor eax, eax
jmp 0x5de06f
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x56c66d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.005da581
push esi
push eax
call fcn.0056c680
add esp, 0x14
test eax, eax
je 0x5ddf18
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005e86fc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005da563
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005dc482
add esp, 0x28
test eax, eax
jne 0x5ddf4f
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x5ddf8b
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005e86cd
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5ddf8b
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x5dc686
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.005dc6d5
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x5de00b
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.005f03b3
add esp, 0xc
cmp eax, 0xfffffffa
je 0x5ddff4
cmp eax, 0xfffffffc
je 0x5ddfed
cmp eax, 0xfffffffe
je 0x5ddfe6
test eax, eax
je 0x5de006
push str.Unknown_zlib_error
jmp 0x5ddff9
push str.zlib_stream_error
jmp 0x5ddff9
push str.zlib_memory_error
jmp 0x5ddff9
push str.zlib_version_error
push dword [ebp - 4]
call fcn.005da59d
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x5de03b
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005e860e
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005e85c8
add esp, 0x14
jmp 0x5ddec4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.005e40d6
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x5ee8cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov dword [ebp - 0xc], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, edx
mov dword [ebp - 8], esi
cmp dword [edi + 0x6c], eax
jb 0x5ee974
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.005683f0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
mov esi, ecx
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
movzx ecx, bx
movzx eax, word [edi]
mov edx, eax
mov dword [ebp - 4], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x5ee922
mov edi, dword [ebp + 8]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, dword [ebp - 4]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x5ee94f
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x5eea98
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 4], edx
cmovbe esi, eax
test esi, esi
je 0x5ee9e2
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5ee9b5
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.005f254f
jmp 0x5ee9c5
cmp eax, 2
jne 0x5ee9ce
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.005f083b
mov edx, dword [ebp - 4]
add esp, 0xc
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push edx
call fcn.005683f0
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
lea edx, [ecx + esi]
mov dword [ebp - 8], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x5eea12
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
mov edx, dword [ebp - 8]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp edx, 0x106
jae 0x5eea2a
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x5eea2a
mov ebx, dword [ebp - 0xc]
jmp 0x5ee8e0
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x5eea98
mov ebx, dword [edi + 0x6c]
add ebx, edx
cmp ecx, ebx
jae 0x5eea68
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ebx
push 0
push eax
call fcn.00870b9c
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x5eea98
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x5eea98
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ecx
push 0
push eax
call fcn.00870b9c
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5f083b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5f0848
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005f093f

Function at 0x70b012
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [edx]
and eax, 0x96b940c0
daa
rcl byte [0xc025128a], 9
mov ecx, 0x41c02796
mov dl, byte [edx]
and eax, 0xf03e0bc0
and al, 0xc0
xor al, byte [eax]
add byte [eax], al
add byte [eax + 0x68], bh
add byte [eax], al
js 0x70b01b
adc eax, 0x51152179
push edx
push ebx
push eax
push esi
pushfd
call fcn.0072e9e7
loop 0x70af8f
test byte [esi], 0x7e
xor byte [ebx + 0x34], dh
scasb al, byte es:[edi]
sub byte [ebx - 0x4e], al
xor ch, byte [esi + 0x3473301a]
scasb al, byte es:[edi]
sub al, 0x30
jae 0x70b00d
scasb al, byte es:[edi]
aaa
xor byte [ebx + 0x34], dh
scasb al, byte es:[edi]
cmp al, 0x43
mov dl, 0x32
scasb al, byte es:[edi]
pop ss
xor byte [ebx + 0x34], dh
scasb al, byte es:[edi]
add edx, dword [edx + 0x2d]
xor ch, byte [esi + 0x29a2c811]
xchg byte [ecx + 0x238a8ebd], bh
add eax, 0x5ca43e9a
mov ch, byte [edi + 0x52948c]
add byte [eax], al
add byte [esi + edx*2 - 0x64], dh
push ebp
push edi
jmp fcn.0040c8d5
les ebx, [eax]
sar bh, 1
jnp 0x70b07b
invalid
push 0x72178ae
scasb al, byte es:[edi]
js 0x70b037
pop es
push ecx
push edx
push ebx
push eax
call fcn.00749bcd
ja 0x70afaf
invalid
and al, 4
out dx, eax
mov cs, word [edx - 0x6711b71e]
loop 0x70b081
out dx, al
cwde
ja 0x70b034
inc ebx
lds esp, [edx]
sal dword [eax], cl
scasb al, byte es:[edi]
or ah, byte [eax]
retf
daa
shl byte [ecx + edi*4], 0x96
daa
sal byte [ebx], 0x20
retf

Function at 0x7319af
Capabilities:
Encode data using xor

Disassembly:
jb 0x7319fe
int 0x77
mov eax, dword [0x53525119]
push eax
jmp 0x732a6a
push 0x25a1789d
push ecx
call 0x714d99
jl 0x7319f5
mov dh, 0x26
ror byte [ebx], 0x3c
and cl, byte [esi - 0x13f5a976]
cwde
clc
inc byte [ebp - 0x3b]
sbb byte [ecx + 0x1a8c8674], dl
xor ch, byte [esi + 0x23cb2038]
sar byte [eax], 0xf5
cmc
mov dword [0x6b0bbff4], eax
out dx, eax
mov cs, word [edx - 0x6713f9c9]
loope 0x7319da
inc esp
lds ebp, [ebx]
sal byte [edx - 0x7a], 1
mov ebx, 0x31ae349e
mov ecx, 0x31c02796
cmp dword [esi + 0x6b0bc026], esi
xchg esi, eax
daa
sal byte [ecx], 0x39
mov dh, 0x26
ror byte [ebx], 0x6b
imul ebp, edi, 0xffffff8e
mov bl, byte [eax]
add ch, ah
cwde
out dx, eax
mov cs, word [edx - 0x6713fde8]
or edx, dword [edx + 0x46]
lds ecx, [ecx + 0x67]
jno 0x731994
and dl, bl
xor byte [esi + 0x25a1b31c], ch
rcr byte [edi + esi*8], 0xe2
and eax, 0xfffffffe
loopne 0x731a1b
push edi
cmp esp, ebp
pop ss
dec esi
xor dword [esi - 0x78c7aec6], ebp
loopne 0x731a1b
push ecx
popal
or dword [edx + 0x3ac02512], ecx
mov dl, byte [edx]
and eax, 0x96b916c0
daa
sar byte [eax], 0x20
retf
push esi
pushfd
call fcn.00735674
call 0xa1eb60de
in eax, 0x51
push edx
push ebx
push eax
push esi
call fcn.00738e21
ljmp 0xfffd
Function at 0x73e098
Capabilities:
Encode data using xor

Disassembly:
push 0xd8a17833
push ecx
push edx
call fcn.004047b4
jae 0x73e10e
lahf
ja 0x73e0ca
cmp dl, byte [ecx - 0x18]
in al, dx
push cs
invalid
and bl, cl
and eax, eax
push ds
mov ecx, 0x16c02796
and bl, cl
and eax, eax
aaa
and bl, cl
and eax, eax
sbb cl, byte [edx + 0x9c02512]
mov ecx, 0x19c02796
mov ecx, 0x17c02796
and bl, cl
and eax, eax
xor dword [esi], edi
invalid
xor byte [ebx + 0x34], dh
scasb al, byte es:[edi]
sbb dword [ecx + 0x49], esp
xor dword [esi + 0x32b24334], ebp
scasb al, byte es:[edi]
or dword [ecx + 0x49], esp
xor dword [esi + 0x16a751a], ebp
scasb al, byte es:[edi]
aaa
add dword [edx], eax
daa
xchg byte [ebx + 0x34c025a1], dh
lodsd eax, dword [esi]
out 0x83, eax
loopne 0x73e11b
pop edx
int3

Function at 0x81f5cb
Capabilities:
Encode data using xor

Disassembly:
push eax
push esi
pushfd
push ebp
push edi
jmp fcn.00815b62
lea esp, [esp + 4]
push esi
pushfd
push ebp
push edi
call fcn.008051fe
jne 0x81f642
dec eax
and byte [ecx], 0xf8
push ecx
push edx
push ebx
jmp 0x80ce88
in al, 0x35
rcr byte [ebx], 0x9f
rcr byte [ebp - 0x23353176], 1
cwde
mov ah, 0xd
push ebp
invalid