joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5996f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x1f4
mov eax, dword [0x79b5e0]
xor eax, esp
mov dword [esp + 0x1f0], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [esp + 0x28]
push edi
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareGoogleChromeLoader
push bind
mov ebx, ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5997ad
push 0x1c8
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0061e3e0
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.0058de70
push dword [esp + 0x44]
lea edi, [ebx + 0x100]
push dword [esp + 0x44]
push str.0x_I64x
push edi
call fcn.0059a300
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x599780
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.hardwareid
push dword [esp + 0x40]
call edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftGoogle
push bind
call esi
test eax, eax
jne 0x59984a
push 0x1c8
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0061e3e0
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.0058de70
mov edx, dword [esp + 0x44]
lea esi, [ebx + 0x1ff]
mov ecx, dword [esp + 0x40]
call fcn.0062419f
mulsd xmm0, qword [0x6eee38]
sub esp, 8
movsd qword [esp], xmm0
push str.SPG_I64x
push esi
call fcn.00592530
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x599823
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.GoogleKey
push dword [esp + 0x3c]
call edi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1fc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x5a84e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
push esi
and eax, 0x1f
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 8
jb 0x5a85a0
shr eax, 3
mov dword [ebp - 0xc], eax
jmp 0x5a8510
cmp ecx, 1
jne 0x5a8526
movq xmm0, qword [esi]
movq qword [ebp + 8], xmm0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
jmp 0x5a852b
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push 0xc2b2ae3d
push 0x27d4eb4f
push ecx
push eax
call fcn.00620b50
mov ecx, eax
add esi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00620b50
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00620b50
mov ecx, dword [ebp + 0x10]
mov ebx, eax
mov eax, dword [ebp - 8]
add ebx, 0xc2b2ae63
mov edi, edx
adc edi, 0x85ebca77
sub eax, 8
dec dword [ebp - 0xc]
mov dword [ebp - 8], eax
jne 0x5a8510
cmp eax, 4
jb 0x5a85f6
mov eax, dword [esi]
add esi, 4
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
call fcn.00620b50
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.00620b50
mov ebx, eax
mov edi, edx
mov eax, dword [ebp - 8]
add ebx, 0x9e3779f9
adc edi, 0x165667b1
sub eax, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x5a8640
lea ebx, [ebx]
movzx eax, byte [esi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00620b50
xor ebx, eax
lea esi, [esi + 1]
xor edi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, edi, 0xb
push 0x85ebca87
shld edi, ebx, 0xb
push edi
push eax
call fcn.00620b50
dec dword [ebp - 8]
mov ebx, eax
mov edi, edx
jne 0x5a8600
push 0xc2b2ae3d
xor ecx, ecx
mov esi, edi
push 0x27d4eb4f
xor ecx, edi
shr esi, 1
push ecx
xor esi, ebx
push esi
call fcn.00620b50
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00620b50
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f1b00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov ecx, dword [0x82a77c]
sub esp, 0x10
test ecx, ecx
je 0x5f1b1f
cmp dword [0x82a778], 1
jl 0x5f1b1f
test ecx, ecx
je 0x5f1b1f
call fcn.0060fc70
call fcn.005f1ff0
mov eax, dword [0x7a1b24]
mov ecx, 0x1e
fstp dword [0x723bf8]
movss xmm2, dword [0x723bf8]
xorps xmm1, xmm1
subss xmm2, dword [0x7a1b20]
movss dword [eax*4 + 0x7a1b28], xmm2
inc eax
cdq
idiv ecx
movss dword [0x723bfc], xmm2
mov eax, 0x7a1b2c
mov dword [0x7a1b24], edx
jmp 0x5f1b70
addss xmm1, dword [eax - 4]
addss xmm1, dword [eax]
addss xmm1, dword [eax + 4]
addss xmm1, dword [eax + 8]
addss xmm1, dword [eax + 0xc]
addss xmm1, dword [eax + 0x10]
addss xmm1, dword [eax + 0x14]
addss xmm1, dword [eax + 0x18]
addss xmm1, dword [eax + 0x1c]
addss xmm1, dword [eax + 0x20]
add eax, 0x28
cmp eax, 0x7a1ba4
jl 0x5f1b70
mulss xmm1, dword [0x6cfb98]
movss xmm0, dword [0x6cfb94]
comiss xmm0, xmm2
movss dword [0x723c00], xmm1
jbe 0x5f1bd2
mov dword [0x723bfc], 0x3983126f
comiss xmm0, xmm1
jbe 0x5f1be1
mov dword [0x723c00], 0x3983126f
cmp dword [0x7a1ab4], 0
jne 0x5f1c1d
lea eax, [esp]
mov dword [0x7a1ab4], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.0062419f
push 0x7a1e10
movsd qword [0x7a1e08], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x7a1e10]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x7a1e14]
call fcn.0062419f
divsd xmm0, qword [0x7a1e08]
movsd xmm1, qword [0x7a1ab8]
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm0
movaps xmm0, xmm2
subss xmm0, dword [0x7a1ac4]
comiss xmm0, dword [0x6cfb9c]
jbe 0x5f1c97
movd xmm0, dword [0x7a1ac0]
xor eax, eax
cvtdq2pd xmm0, xmm0
movss dword [0x7a1ac4], xmm2
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
xorps xmm1, xmm1
movss dword [0x7a1ac8], xmm0
jmp 0x5f1c9c
mov eax, dword [0x7a1ac0]
movss xmm0, dword [0x6eee34]
inc eax
divss xmm0, dword [0x723bfc]
mov dword [0x7a1ac0], eax
cvtps2pd xmm0, xmm0
addsd xmm0, xmm1
movsd qword [0x7a1ab8], xmm0
add esp, 0x10
jmp 0x608f90
push ecx
call fcn.005f1ff0
fstp dword [esp]
movss xmm0, dword [esp]
subss xmm0, dword [0x82a760]
comiss xmm0, dword [0x6eee34]
jbe 0x608fde
mov eax, dword [0x82a728]
test eax, eax
je 0x608fde
push eax
push str.Loads_unloads_collapsed:__d_n
call fcn.005f20b0
movss xmm0, dword [esp + 8]
add esp, 8
mov dword [0x82a728], 0
movss dword [0x82a760], xmm0
pop ecx
ret
Function at 0x5f1ff0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
cmp dword [0x7a1ab4], 0
jne 0x5f202f
lea eax, [esp]
mov dword [0x7a1ab4], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.0062419f
push 0x7a1e10
movsd qword [0x7a1e08], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x7a1e10]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x7a1e14]
call fcn.0062419f
divsd xmm0, qword [0x7a1e08]
cvtsd2ss xmm0, xmm0
movss dword [esp], xmm0
fld dword [esp]
add esp, 0x10
ret
Function at 0x5f28b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
je 0x5f28dc
push esi
mov esi, dword [esp + 8]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x723c08]
dec edx
jne 0x5f28c0
pop esi
not eax
ret

Function at 0x5f28e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
test ebx, ebx
jne 0x5f2902
push ebx
push 0x19d
push str.SourceFileSystem_r3dFSCompress.cpp
push str.out_crc32
call fcn.005f2580
add esp, 0x10
push 0x6cfc7c
push dword [esp + 0x10]
call fcn.0061d2a7
mov esi, eax
add esp, 8
test esi, esi
jne 0x5f291e
pop esi
xor al, al
pop ebx
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.00622310
push esi
call fcn.00622739
push 0
push 0
push esi
mov edi, eax
call fcn.00622310
lea ecx, [edi + 1]
push 1
push ecx
call fcn.005f13f0
push esi
push edi
mov ebp, eax
push 1
push ebp
call fcn.006229b6
add esp, 0x34
cmp eax, edi
je 0x5f297f
push esi
call fcn.0061c773
push ebp
call fcn.005f1450
push edi
push dword [esp + 0x20]
push str.failed_to_read__s__d_n
call fcn.005f1cd0
add esp, 0x14
xor al, al
pop edi
pop ebp
pop esi
pop ebx
ret
push edi
push ebp
call fcn.005f28b0
push ebp
mov dword [esp + 0x24], eax
call fcn.005f1450
push esi
call fcn.0061c773
mov ecx, dword [esp + 0x2c]
add esp, 0x10
test ecx, ecx
je 0x5f29a3
mov dword [ecx], edi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
ret

Function at 0x5f2a20
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x5f2a9f
lea ecx, [esi - 1]
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x5f2a40
mov eax, dword [str.Winghorizon_]
mov dword [ecx], eax
mov eax, dword [0x6d0208]
mov dword [ecx + 4], eax
mov eax, dword [0x6d020c]
mov dword [ecx + 8], eax
mov ax, word [0x6d0210]
push esi
mov word [ecx + 0xc], ax
call fcn.006234e2
add esp, 4
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x5f2a77
mov eax, dword [str.FatZ_]
mov dword [ecx], eax
mov ax, word [0x6d0218]
push esi
mov word [ecx + 4], ax
call fcn.006234e2
add esp, 4
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x5f3160
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 0x10]
push edi
call fcn.0061d2a7
mov esi, eax
add esp, 8
test esi, esi
jne 0x5f31a2
call fcn.00624201
push dword [eax]
call fcn.005f2ab0
push eax
push edi
push str.__warning____cant_open__s_for_writing_nError:__s__d__n
call fcn.005f1cd0
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret
Function at 0x5f31b0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x5f31c5
pop edi
mov dword [esp + 0x10], eax
jmp fcn.006229b6
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0x114]
push esi
mov esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jb 0x5f31e3
mov esi, ecx
sub esi, edx
test esi, esi
jne 0x5f31ec
pop esi
xor eax, eax
pop edi
ret
mov ecx, dword [edi + 4]
push esi
add ecx, edx
push ecx
push dword [esp + 0x14]
call fcn.0061e470
add dword [edi + 8], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [esp + 0x10]
pop esi
pop edi
ret

Function at 0x5f3730
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4048
call fcn.0061e3b0
push ebx
push esi
mov esi, dword [esp + 0x4054]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.006247fd
mov ebx, dword [esp + 0x4060]
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.006247fd
mov eax, dword [esp + 0x50]
add esp, 0x10
cmp eax, dword [esp + 0x1c]
je 0x5f3778
pop esi
xor eax, eax
pop ebx
add esp, 0x4048
ret
push edi
push 0x6cfc7c
push esi
call fcn.0061d2a7
push 0x6cfc7c
push ebx
mov edi, eax
call fcn.0061d2a7
add esp, 0x10
mov ebx, eax
test edi, edi
je 0x5f38a9
test ebx, ebx
je 0x5f3894
push ebp
push edi
mov ebp, 1
call fcn.006227a5
add esp, 4
test eax, eax
jne 0x5f3878
lea ecx, [ecx]
push edi
push 0x2000
lea eax, [esp + 0x60]
push 1
push eax
call fcn.006229b6
push ebx
push 0x2000
mov esi, eax
lea eax, [esp + 0x2070]
push 1
push eax
call fcn.006229b6
add esp, 0x20
cmp esi, eax
je 0x5f3809
push 0
push 0x6d7
push str.Source_r3dFileMan.cpp
push str.read0__read1
call fcn.005f2580
add esp, 0x10
lea ecx, [esp + 0x58]
lea edx, [esp + 0x2058]
sub esi, 4
jb 0x5f3831
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x5f3836
add ecx, 4
add edx, 4
sub esi, 4
jae 0x5f3820
cmp esi, 0xfffffffc
je 0x5f3863
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x5f3876
cmp esi, 0xfffffffd
je 0x5f3863
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x5f3876
cmp esi, 0xfffffffe
je 0x5f3863
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x5f3876
cmp esi, 0xffffffff
je 0x5f3863
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x5f3876
push edi
call fcn.006227a5
add esp, 4
test eax, eax
je 0x5f37c0
jmp 0x5f3878
xor ebp, ebp
push edi
call fcn.0061c773
push ebx
call fcn.0061c773
add esp, 8
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4048
ret
push edi
call fcn.0061c773
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x4048
ret
test ebx, ebx
je 0x5f38b6
push ebx
call fcn.0061c773
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4048
ret
Function at 0x5f3aa0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
cmp dword [0x7a346c], 0
jne 0x5f3ac5
push 0
push 0x216
push 0x6d0244
push str.hInstance___NULL
call fcn.005f2580
add esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push 0
mov dword [esp + 0x10], 0x4008
mov dword [esp + 0x14], 0x5f3d70
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call ebx
mov dword [esp + 0x1c], eax
mov eax, dword [0x7a3474]
test eax, eax
jne 0x5f3b0b
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x28], eax
mov eax, dword [str.r3dWin]
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [0x7a33b8], eax
call esi
push edi
mov dword [0x7a33bc], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 0
call ebx
mov ecx, dword [0x724010]
mov esi, dword [0x724014]
push eax
mov eax, dword [0x7a33bc]
push 0
sub eax, ecx
push 0
cdq
push ecx
sub eax, edx
push esi
sar eax, 1
push eax
mov eax, dword [0x7a33b8]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10cf0000
push dword [0x724024]
push dword [0x72405c]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x7a3470], eax
test eax, eax
jne 0x5f3bf2
push eax
push str.Error
push str.Window_Creation_Failed
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
push dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push eax
call esi
push dword [esp + 0x20]
push 0
push 0x80
push dword [0x7a3470]
call esi
mov esi, dword [0x7a3470]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffff0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
and eax, 0xfffbffff
push eax
push 0xfffffffffffffff0
push esi
call edi
mov esi, dword [0x7a3470]
push 0xfffffffffffffff0
push esi
call ebx
and eax, 0xfffeffff
push eax
push 0xfffffffffffffff0
push esi
call edi
push 0
push dword [0x7a3470]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push dword [0x7a3470]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x7a3470]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x7a3470]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x5f4970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1f
xor eax, eax
nop
mov dl, byte [edi + eax - 0x50518384]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5f499d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x21
jl 0x5f4980
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret 4

Function at 0x5f4ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x64
xor eax, eax
nop
mov dl, byte [edi + eax - 0x60fb972f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5f4aed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x21
jl 0x5f4ad0
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret 4

Function at 0x5f4ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb5
xor eax, eax
nop
mov dl, byte [edi + eax - 0x4eb4e61c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5f4ccd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x5f4cb0
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret 4

Function at 0x5f4d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xdf
xor eax, eax
nop
mov dl, byte [edi + eax + 0x56ba2388]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5f4dad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x5f4d90
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x5f4e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xfd
xor eax, eax
nop
mov dl, byte [edi + eax + 0x36a036a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5f4e6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x5f4e50
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4
Function at 0x5f7470
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64dbb8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x5f75c2
cmp byte [ebx + 0x45], 0
je 0x5f75c2
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x5f74bd
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, 0xf
mov byte [esp + 8], 0
xorps xmm0, xmm0
mov dword [esp + 0x1c], ecx
cmp ecx, 0x10
movq qword [esp + 8], xmm0
lea eax, [esp + 8]
mov dword [esp + 0x18], 8
cmovae eax, dword [esp + 8]
push ebp
push esi
push edi
mov byte [eax + 8], 0
mov dword [esp + 0x34], 0
lea ebp, [ebx + 0x48]
lea ebx, [ebx]
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
push ebp
call dword [edx + 0x20]
sub eax, 0
je 0x5f753e
dec eax
je 0x5f7542
sub eax, 2
je 0x5f7598
xor bl, bl
jmp 0x5f759a
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x5f7579
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0061d9f4
add esp, 0x10
cmp esi, eax
jne 0x5f753a
cmp byte [ebx + 0x45], 0
je 0x5f7598
test esi, esi
jne 0x5f7500
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.0059a080
jmp 0x5f7500
mov bl, 1
cmp dword [esp + 0x28], 0x10
pop edi
pop esi
pop ebp
jb 0x5f75b0
push dword [esp + 8]
call fcn.005f1450
add esp, 4
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, dword [esp + 0x20]
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x5f7fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov ebp, dword [eax + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
cmp ecx, 0x10
jb 0x5f7ff0
mov esi, dword [eax]
jmp 0x5f7ff2
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test ebp, ebp
je 0x5f8011
lea ecx, [ecx]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x5f8000
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x5f8026
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov dword [esp + 0x14], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
cmp edi, edx
jne 0x5f804f
mov eax, edx
jmp 0x5f8053
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x5f817f
cmp dword [esp + 0x10], 0x10
lea ecx, [esi + 8]
jb 0x5f806d
mov eax, dword [esp + 0x28]
mov edi, dword [eax]
jmp 0x5f8071
mov edi, dword [esp + 0x28]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x5f807c
mov ecx, dword [ecx]
cmp ebx, ebp
mov edx, ebp
cmovb edx, ebx
test edx, edx
je 0x5f80e0
sub edx, 4
jb 0x5f80a1
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x5f80a6
add ecx, 4
add edi, 4
sub edx, 4
jae 0x5f8090
cmp edx, 0xfffffffc
je 0x5f80da
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x5f80d3
cmp edx, 0xfffffffd
je 0x5f80da
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x5f80d3
cmp edx, 0xfffffffe
je 0x5f80da
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x5f80d3
cmp edx, 0xffffffff
je 0x5f80da
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x5f80da
sbb eax, eax
or eax, 1
jmp 0x5f80dc
xor eax, eax
test eax, eax
jne 0x5f80ef
cmp ebx, ebp
jb 0x5f80ef
xor eax, eax
cmp ebx, ebp
setne al
test eax, eax
je 0x5f8102
mov esi, dword [esi]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp 0x5f8047
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x5f8110
mov ecx, dword [ecx]
cmp dword [esp + 0x10], 0x10
jb 0x5f8121
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
cmp ebp, edi
mov eax, edi
cmovb eax, ebp
push eax
push ecx
push dword [esp + 0x30]
call fcn.005f3ca0
add esp, 0xc
test eax, eax
jne 0x5f8161
cmp ebp, edi
jb 0x5f8161
cmp ebp, edi
setne al
test eax, eax
jne 0x5f8161
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
pop edi
mov dword [esp + 0x24], esi
mov ecx, dword [ecx]
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
pop edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [ecx]
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x10
ret 8