joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f0e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x431f3c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x431f43
cmp ebx, dword [eax + 4]
jae 0x431f43
xor eax, eax
jmp 0x432133
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x431f54
xor eax, eax
inc eax
jmp 0x432132
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x431f6a
cmp ecx, edx
jae 0x4320af
cmp dword [eax + 4], 0
je 0x431f73
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x431f5b
cmp dword [ebp + 8], 0
je 0x431f95
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4320af
cmp eax, esi
jae 0x4320af
mov eax, dword [0x51d5a0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x431fba
cmp dword [esi*4 + 0x51d5a8], edi
je 0x4320b3
inc esi
cmp esi, eax
jl 0x431fa8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x434170]
test eax, eax
je 0x43212f
cmp dword [ebp - 8], 0x1000000
jne 0x43212f
test byte [ebp - 0xc], 0xcc
je 0x432038
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x43212f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x43212f
cmp word [eax + 0x18], 0x10b
jne 0x43212f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x43212f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x432038
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x432038
test byte [ecx + 0x27], 0x80
jne 0x4320af
push 1
push 0x51d5e8
call dword [0x434174]
test eax, eax
jne 0x431f4c
mov ecx, dword [0x51d5a0]
test ecx, ecx
mov edx, ecx
jle 0x43206c
lea eax, [ecx*4 + 0x51d5a4]
cmp dword [eax], edi
je 0x43206c
dec edx
sub eax, 4
test edx, edx
jg 0x432060
test edx, edx
jne 0x43209d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x432079
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x432091
lea eax, [edx*4 + 0x51d5a8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x43207f
cmp ecx, 0x10
jge 0x43209d
inc ecx
mov dword [0x51d5a0], ecx
push 0
push 0x51d5e8
call dword [0x434174]
jmp 0x431f4c
xor eax, eax
jmp 0x432132
test esi, esi
jle 0x431f4c
mov ebx, dword [0x434174]
push 1
push 0x51d5e8
call ebx
test eax, eax
jne 0x431f4c
cmp dword [esi*4 + 0x51d5a8], edi
je 0x432109
mov eax, dword [0x51d5a0]
lea esi, [eax - 1]
test esi, esi
jl 0x4320f7
cmp dword [esi*4 + 0x51d5a8], edi
je 0x4320f3
dec esi
jns 0x4320e7
test esi, esi
jge 0x432107
cmp eax, 0x10
jge 0x432102
inc eax
mov dword [0x51d5a0], eax
lea esi, [eax - 1]
jmp 0x432109
je 0x432121
xor ecx, ecx
test esi, esi
jl 0x432121
lea eax, [ecx*4 + 0x51d5a8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x43210f
push 0
push 0x51d5e8
call ebx
jmp 0x431f4c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x524692
Capabilities:
Terminate process

Disassembly:
push ebx
push 0x529618
call fcn.005312a2
mov eax, dword [esp + 8]
xor ebx, ebx
cmp eax, ebx
jl 0x524703
mov eax, 0x444100
jne 0x5246b3
mov eax, 0x4440fc
cmp dword [0x5293f0], ebx
je 0x5246c6
cmp dword [0x529bf0], 1
jbe 0x5246ee
jmp 0x5246e0
cmp dword [0x529bf4], ebx
jne 0x5246ee
cmp dword [0x529c2c], ebx
jne 0x5246e0
mov dword [0x529c2c], 1
push 0x527f70
push eax
call fcn.00522a12
add esp, 8
cmp byte [0x529bde], bl
je 0x524703
push 0x527f70
call fcn.00550243
add esp, 4
cmp dword [0x450444], ebx
je 0x524731
mov eax, dword [0x450438]
push eax
mov dword [0x450444], ebx
mov dword [0x450440], ebx
call fcn.00529492
add esp, 4
mov dword [0x450438], ebx
mov dword [0x45043c], ebx
cmp dword [0x450458], ebx
je 0x524760
mov ecx, dword [0x45044c]
push ecx
mov dword [0x450458], ebx
mov dword [0x450454], ebx
call fcn.00529492
add esp, 4
mov dword [0x45044c], ebx
mov dword [0x450450], ebx
cmp dword [0x45046c], ebx
je 0x52478f
mov edx, dword [0x450460]
push edx
mov dword [0x45046c], ebx
mov dword [0x450468], ebx
call fcn.00529492
add esp, 4
mov dword [0x450460], ebx
mov dword [0x450464], ebx
mov eax, dword [0x529c08]
push eax
call fcn.00529492
mov ecx, dword [0x529c00]
push ecx
call fcn.00529492
mov edx, dword [0x529410]
push edx
call fcn.00529492
mov eax, dword [0x5293bc]
push eax
call fcn.00529492
mov ecx, dword [0x529180]
push ecx
call fcn.00529492
mov edx, dword [0x529c04]
push edx
call fcn.00529492
mov eax, dword [0x529c14]
push eax
call fcn.00529492
mov ecx, dword [0x529c18]
push ecx
call fcn.00529492
mov edx, dword [0x529c1c]
push edx
call fcn.00529492
mov eax, dword [0x529c24]
push eax
call fcn.00529492
mov ecx, dword [0x529c0c]
push ecx
call fcn.00529492
add esp, 0x2c
call fcn.005371e2
mov edx, dword [0x529184]
push edx
call fcn.0052b5f2
mov al, byte [0x529bd8]
neg al
sbb eax, eax
and eax, 3
push eax
call fcn.0052c7e2
mov ecx, dword [0x5293e0]
add esp, 8
push ecx
call fcn.0055064d
pop ebx
int3
Function at 0x524d72
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.00533182
push 0x4441b0
mov esi, eax
call fcn.0055070e
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x524d9e
push 0x10
push eax
call fcn.005294f2
add esp, 8
mov dword [0x529180], eax
push 0x4441a8
call fcn.0055070e
add esp, 4
cmp eax, ebx
jne 0x524dc7
push 0x4441a0
push 0x528f80
call fcn.005379d2
mov byte [0x44f067], 1
jmp 0x524dd2
push eax
push 0x528f80
call fcn.005379d2
add esp, 8
push 0x528f80
push 0x529418
call fcn.005379d2
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [0x5293f8], ecx
mov edx, dword [esi + 4]
mov eax, dword [edx]
push 0x403940
push 0x44f3e8
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [0x52940c], eax
call fcn.0052acb2
add esp, 0x18
cmp eax, ebx
je 0x524e1e
push eax
call fcn.0055064d
mov eax, dword [esi]
mov ecx, dword [0x5293f8]
mov dword [eax], ecx
mov eax, dword [0x52940c]
mov edx, dword [esi + 4]
mov dword [edx], eax
cmp dword [0x5293f0], ebx
je 0x524e7a
push 0x4441a0
push 0x529418
call fcn.005379d2
push 0x4441a0
push 0x528f80
call fcn.005379d2
add esp, 0x10
mov byte [0x44f067], 1
mov byte [0x529bee], bl
mov byte [0x529be8], bl
mov byte [0x44f068], bl
mov dword [0x44f06c], ebx
mov ecx, dword [0x44f0f0]
mov esi, dword [ecx + 0x10]
push edi
mov edi, dword [0x44f070]
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x524eb6
cmp cl, bl
je 0x524eb2
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x524eb6
add eax, 2
add esi, 2
cmp cl, bl
jne 0x524e92
xor eax, eax
jmp 0x524ebb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x524edc
push 0x10
push 0x20
push edi
call fcn.0052a062
add esp, 0xc
cmp eax, ebx
mov dword [0x44f0f0], eax
jne 0x524edc
push 1
call fcn.0055064d
mov eax, dword [esp + 0x10]
cmp eax, 1
jle 0x524ef5
push ebx
call fcn.00522582
add esp, 4
push 1
call fcn.0055064d
jne 0x524f1e
mov eax, dword [0x5293bc]
push eax
mov byte [0x529be0], bl
call fcn.00529492
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push 0x10
push edx
call fcn.005294f2
add esp, 0xc
mov dword [0x5293bc], eax
cmp byte [0x529bea], bl
je 0x524f34
push ebx
call fcn.00537d82
add esp, 4
mov dword [0x529c08], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x529402
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x529411
mov edi, 1
push edi
call fcn.005512f5
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x529465
push esi
call fcn.0055074d
mov esi, eax
call fcn.0052dbd2
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x529448
mov edx, dword [0x4504e8]
mov dword [0x4504e4], edx
test al, 0x18
je 0x529459
push edi
push 0x24
push 5
call fcn.0052d8a2
add esp, 0xc
test esi, esi
pop esi
je 0x529480
push 1
call fcn.0055064d
test byte [esp + 0x10], 0x20
je 0x529480
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x543e62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
je 0x543fb7
cmp byte [esi], 0
je 0x543faa
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 0x14], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x543e98
sub eax, ecx
push eax
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.00543d92
push 8
lea edx, [esp + 0x28]
push edi
push edx
call fcn.00543d92
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
xor eax, ecx
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
xor eax, edi
add esp, 0x18
mov esi, edx
xor edx, edx
div ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov edi, edx
jae 0x543f52
sub eax, ecx
mov dword [esp + 0x10], eax
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov esi, edx
lea eax, [edi + esi + 0x21]
xor edx, edx
div ecx
test esi, esi
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
mov edi, edx
jge 0x543f1f
fadd qword [0x443a38]
fmul qword [0x447e48]
sub esp, 8
fmul qword [0x447e40]
fstp qword [esp]
call fcn.0054f762
fadd qword [0x447e38]
add esp, 8
call fcn.0054f8ea
mov byte [ebx], al
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x543ef3
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
test edx, edx
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jge 0x543f72
fadd qword [0x443a38]
fmul qword [0x447e48]
sub esp, 8
fmul qword [0x447e40]
fstp qword [esp]
call fcn.0054f762
add esp, 8
call fcn.0054f8ea
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x543fa0
xor byte [ecx], al
inc ecx
cmp ecx, ebx
jne 0x543f99
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x544462
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00547b62
mov edx, dword [esp + 0xa4]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x544482
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x34]
push ecx
call fcn.00548392
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00548332
lea ecx, [esp + 0x40]
push ecx
call fcn.00547b62
push 0x14
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00548392
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.00548332
lea eax, [esp + 0x58]
push eax
call fcn.00547b62
mov ecx, dword [esp + 0xcc]
push 0x14
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.00548392
push 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.00548392
mov esi, dword [esp + 0xe0]
add esp, 0x48
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00548332
lea ecx, [esi + 0x14]
add esp, 8
cmp esi, ecx
mov eax, esi
jae 0x544538
push ebx
push edi
lea edi, [esp + 0xc]
sub edi, esi
mov bl, byte [eax]
mov dl, byte [edi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x544528
pop edi
pop ebx
pop esi
add esp, 0x90
ret

Function at 0x547b62
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret
Function at 0x55bc39
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x55bc67
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x55bc6e
cmp ebx, dword [eax + 4]
jae 0x55bc6e
xor eax, eax
jmp 0x55be5e
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x55bc7f
xor eax, eax
inc eax
jmp 0x55be5d
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x55bc95
cmp ecx, edx
jae 0x55bdda
cmp dword [eax + 4], 0
je 0x55bc9e
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x55bc86
cmp dword [ebp + 8], 0
je 0x55bcc0
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x55bdda
cmp eax, esi
jae 0x55bdda
mov eax, dword [0x52ae38]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x55bce5
cmp dword [esi*4 + 0x52ae40], edi
je 0x55bdde
inc esi
cmp esi, eax
jl 0x55bcd3
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4421dc]
test eax, eax
je 0x55be5a
cmp dword [ebp - 8], 0x1000000
jne 0x55be5a
test byte [ebp - 0xc], 0xcc
je 0x55bd63
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x55be5a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x55be5a
cmp word [eax + 0x18], 0x10b
jne 0x55be5a
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x55be5a
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x55bd63
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x55bd63
test byte [ecx + 0x27], 0x80
jne 0x55bdda
push 1
push 0x52ae80
call dword [0x4421e0]
test eax, eax
jne 0x55bc77
mov ecx, dword [0x52ae38]
test ecx, ecx
mov edx, ecx
jle 0x55bd97
lea eax, [ecx*4 + 0x52ae3c]
cmp dword [eax], edi
je 0x55bd97
dec edx
sub eax, 4
test edx, edx
jg 0x55bd8b
test edx, edx
jne 0x55bdc8
push 0xf
pop ebx
cmp ecx, ebx
jg 0x55bda4
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x55bdbc
lea eax, [edx*4 + 0x52ae40]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x55bdaa
cmp ecx, 0x10
jge 0x55bdc8
inc ecx
mov dword [0x52ae38], ecx
push 0
push 0x52ae80
call dword [0x4421e0]
jmp 0x55bc77
xor eax, eax
jmp 0x55be5d
test esi, esi
jle 0x55bc77
mov ebx, dword [0x4421e0]
push 1
push 0x52ae80
call ebx
test eax, eax
jne 0x55bc77
cmp dword [esi*4 + 0x52ae40], edi
je 0x55be34
mov eax, dword [0x52ae38]
lea esi, [eax - 1]
test esi, esi
jl 0x55be22
cmp dword [esi*4 + 0x52ae40], edi
je 0x55be1e
dec esi
jns 0x55be12
test esi, esi
jge 0x55be32
cmp eax, 0x10
jge 0x55be2d
inc eax
mov dword [0x52ae38], eax
lea esi, [eax - 1]
jmp 0x55be34
je 0x55be4c
xor ecx, ecx
test esi, esi
jl 0x55be4c
lea eax, [ecx*4 + 0x52ae40]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x55be3a
push 0
push 0x52ae80
call ebx
jmp 0x55bc77
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x651344
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x651353
mov edi, 1
push edi
call fcn.0066e458
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x6513a7
push esi
call fcn.0066df0c
mov esi, eax
call fcn.006522a4
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x65138a
mov edx, dword [0x43d854]
mov dword [fcn.0043d850], edx
test al, 0x18
je 0x65139b
push edi
push 0x24
push 5
call fcn.0064e524
add esp, 0xc
test esi, esi
pop esi
je 0x6513c2
push 1
call fcn.0066d76e
test byte [esp + 0x10], 0x20
je 0x6513c2
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x658194
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
je 0x6582e9
cmp byte [esi], 0
je 0x6582dc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 0x14], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6581ca
sub eax, ecx
push eax
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.006580c4
push 8
lea edx, [esp + 0x28]
push edi
push edx
call fcn.006580c4
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
xor eax, ecx
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
xor eax, edi
add esp, 0x18
mov esi, edx
xor edx, edx
div ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov edi, edx
jae 0x658284
sub eax, ecx
mov dword [esp + 0x10], eax
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov esi, edx
lea eax, [edi + esi + 0x21]
xor edx, edx
div ecx
test esi, esi
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
mov edi, edx
jge 0x658251
fadd qword [0x433ba0]
fmul qword [0x433bc8]
sub esp, 8
fmul qword [0x433bc0]
fstp qword [esp]
call fcn.0066ffa4
fadd qword [0x433bb8]
add esp, 8
call fcn.0066fe74
mov byte [ebx], al
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x658225
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
test edx, edx
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jge 0x6582a4
fadd qword [0x433ba0]
fmul qword [0x433bc8]
sub esp, 8
fmul qword [0x433bc0]
fstp qword [esp]
call fcn.0066ffa4
add esp, 8
call fcn.0066fe74
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x6582d2
xor byte [ecx], al
inc ecx
cmp ecx, ebx
jne 0x6582cb
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6583d4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00664ab4
mov edx, dword [esp + 0xa4]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6583f4
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x34]
push ecx
call fcn.006652e4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00665284
lea ecx, [esp + 0x40]
push ecx
call fcn.00664ab4
push 0x14
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.006652e4
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.00665284
lea eax, [esp + 0x58]
push eax
call fcn.00664ab4
mov ecx, dword [esp + 0xcc]
push 0x14
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.006652e4
push 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.006652e4
mov esi, dword [esp + 0xe0]
add esp, 0x48
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00665284
lea ecx, [esi + 0x14]
add esp, 8
cmp esi, ecx
mov eax, esi
jae 0x6584aa
push ebx
push edi
lea edi, [esp + 0xc]
sub edi, esi
mov bl, byte [eax]
mov dl, byte [edi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x65849a
pop edi
pop ebx
pop esi
add esp, 0x90
ret

Function at 0x664ab4
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret
Function at 0x67658d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x6765bb
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x6765c2
cmp ebx, dword [eax + 4]
jae 0x6765c2
xor eax, eax
jmp 0x6767b2
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x6765d3
xor eax, eax
inc eax
jmp 0x6767b1
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x6765e9
cmp ecx, edx
jae 0x67672e
cmp dword [eax + 4], 0
je 0x6765f2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x6765da
cmp dword [ebp + 8], 0
je 0x676614
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x67672e
cmp eax, esi
jae 0x67672e
mov eax, dword [0x538478]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x676639
cmp dword [esi*4 + 0x538480], edi
je 0x676732
inc esi
cmp esi, eax
jl 0x676627
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x43117c]
test eax, eax
je 0x6767ae
cmp dword [ebp - 8], 0x1000000
jne 0x6767ae
test byte [ebp - 0xc], 0xcc
je 0x6766b7
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x6767ae
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x6767ae
cmp word [eax + 0x18], 0x10b
jne 0x6767ae
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x6767ae
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x6766b7
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x6766b7
test byte [ecx + 0x27], 0x80
jne 0x67672e
push 1
push 0x5384c0
call dword [0x431188]
test eax, eax
jne 0x6765cb
mov ecx, dword [0x538478]
test ecx, ecx
mov edx, ecx
jle 0x6766eb
lea eax, [ecx*4 + 0x53847c]
cmp dword [eax], edi
je 0x6766eb
dec edx
sub eax, 4
test edx, edx
jg 0x6766df
test edx, edx
jne 0x67671c
push 0xf
pop ebx
cmp ecx, ebx
jg 0x6766f8
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x676710
lea eax, [edx*4 + 0x538480]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x6766fe
cmp ecx, 0x10
jge 0x67671c
inc ecx
mov dword [0x538478], ecx
push 0
push 0x5384c0
call dword [0x431188]
jmp 0x6765cb
xor eax, eax
jmp 0x6767b1
test esi, esi
jle 0x6765cb
mov ebx, dword [0x431188]
push 1
push 0x5384c0
call ebx
test eax, eax
jne 0x6765cb
cmp dword [esi*4 + 0x538480], edi
je 0x676788
mov eax, dword [0x538478]
lea esi, [eax - 1]
test esi, esi
jl 0x676776
cmp dword [esi*4 + 0x538480], edi
je 0x676772
dec esi
jns 0x676766
test esi, esi
jge 0x676786
cmp eax, 0x10
jge 0x676781
inc eax
mov dword [0x538478], eax
lea esi, [eax - 1]
jmp 0x676788
je 0x6767a0
xor ecx, ecx
test esi, esi
jl 0x6767a0
lea eax, [ecx*4 + 0x538480]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x67678e
push 0
push 0x5384c0
call ebx
jmp 0x6765cb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x76c552
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d4ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00785a72
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
push edi
push ecx
mov dword [esi], 0x5e04a0
lea ebx, [esi + 4]
push edx
mov ecx, ebx
mov dword [esp + 0x24], 0
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], eax
call fcn.00820182
mov ecx, ebx
call fcn.0081fa72
imul eax, dword [edi + 0x50]
push edi
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x24]
push 0
push eax
mov ecx, esi
call fcn.00782f92
mov ecx, dword [esp + 0x10]
pop edi
mov byte [esi + 0x25], 0x1f
mov byte [esi + 0x2a], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x76c569
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d4ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00785a72
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
push edi
push ecx
mov dword [esi], 0x5e04a0
lea ebx, [esi + 4]
push edx
mov ecx, ebx
mov dword [esp + 0x24], 0
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], eax
call fcn.00820182
mov ecx, ebx
call fcn.0081fa72
imul eax, dword [edi + 0x50]
push edi
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x24]
push 0
push eax
mov ecx, esi
call fcn.00782f92
mov ecx, dword [esp + 0x10]
pop edi
mov byte [esi + 0x25], 0x1f
mov byte [esi + 0x2a], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14