joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2b40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
dec eax
fstp qword [esp]
push esi
call fcn.00598680
add esp, 0xc
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 8
call 0x620be8
lea ecx, [esp + 0x48]
mov byte [esp + 0xd4], 7
call fcn.00526350
lea ecx, [esp + 0x74]
mov byte [esp + 0xd4], 0xe
call 0x620be8
lea ecx, [esp + 0x68]
mov byte [esp + 0xd4], 0xd
call 0x620be8
lea ecx, [esp + 0x64]
mov byte [esp + 0xd4], 0xc
call 0x620be8
lea ecx, [esp + 0x5c]
mov byte [esp + 0xd4], 0xb
call 0x620be8
lea ecx, [esp + 0x58]
mov byte [esp + 0xd4], 0xa
call 0x620be8
lea ecx, [esp + 0x54]
mov byte [esp + 0xd4], 6
call 0x620be8
lea ecx, [esp + 0xc]
mov byte [esp + 0xd4], 5
call 0x620be8
lea ecx, [esp + 0x18]
mov byte [esp + 0xd4], 4
call 0x620be8
lea ecx, [esp + 0x10]
mov byte [esp + 0xd4], 3
call 0x620be8
lea ecx, [esp + 0x14]
mov byte [esp + 0xd4], 2
call 0x620be8
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd4], 1
call 0x620be8
lea ecx, [esp + 0x24]
mov byte [esp + 0xd4], bl
call 0x620be8
lea ecx, [esp + 0x30]
mov dword [esp + 0xd4], 0xffffffff
call 0x620be8
mov ecx, dword [esp + 0xcc]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0xcc
ret

Function at 0x4dd6b0
Capabilities:
Access peb ldr_data

Disassembly:
inc ecx
add byte fs:[esi - 0x18], dl
inc edi
mov al, 0xb
add bl, bl
xchg esp, esi
add byte [eax], al
add ch, bl
sbb al, 0x24
push esi
call fcn.00598680
push 0xfffffffffffffffd
push esi
call fcn.00598a40
push 0x644108
push esi
call fcn.00598700
fild dword [edi + 0xd4]
add esp, 0x14
fstp qword [esp]
push esi
call fcn.00598680
push 0xfffffffffffffffd
push esi
call fcn.00598a40
push 0x64346c
push esi
call fcn.00598700
fild dword [edi + 0xe0]
add esp, 0x14
fstp qword [esp]
push esi
call fcn.00598680
push 0xfffffffffffffffd
push esi

Function at 0x4dfa6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, 0xa0680066
mov ecx, 0x84c60066
and al, 0x9c
add byte [eax], al
add byte [ecx], al
mov edx, dword [ecx + 0x2c18]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], edx
call 0x620c56
push 0x66b9a0
lea ecx, [esp + 0x38]
mov byte [esp + 0x9c], 2
mov dword [esp + 0x40], ebx
call 0x620c56
push 1
push ecx
lea eax, [esp + 0x30]
xor ebp, ebp
mov ecx, esp
mov dword [esp + 0x50], esp

Function at 0x4dfab9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov byte [esp + 0xa4], 3
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x50], ebx
mov dword [esp + 0x3c], ebx
call 0x62095d
mov ecx, dword [0x66bc28]
call fcn.00533460
mov edi, eax
call 0x626920
test eax, eax
je 0x4dfb00
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x4dfb0a
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x48], eax
Function at 0x4dfb08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4dfb11
test edi, edi
je 0x4e0705
lea eax, [edi + 0xc]
push esi
mov byte [esp + 0x17], 0
mov ecx, dword [eax]
mov dword [esp + 0x54], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x58], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x5c], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x60], edx
call fcn.00598660
push 2
push esi
call fcn.00598d80
add esp, 0xc
test eax, eax
je 0x4e070d
invalid
or eax, dword [eax]
invalid
push 0xfffffffffffffffe
push esi
call fcn.005984e0
add esp, 8
lea ecx, [esp + 0x14]
push eax
call 0x620d71
mov eax, dword [esp + 0x14]
push 0x63f60c
push eax
call 0x604853
add esp, 8
test eax, eax
jne 0x4dfbb8
push 0xffffffffffffffff
push esi
call fcn.005983a0
add esp, 8
test eax, eax
je 0x4dfe1b
push 0xffffffffffffffff
push esi
call fcn.005984e0
invalid
invalid
Function at 0x51f7b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5e5ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call 0x6212c0
mov eax, dword [0x666d08]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x68], eax
push fcn.004242a0
push fcn.004241e0
push 0xf
lea ecx, [esi + 0x78]
push 0x45c
push ecx
mov byte [esp + 0x30], 1
call 0x604c70
lea ecx, [esi + 0x4218]
mov byte [esp + 0x1c], 2
call fcn.0053b0b0
mov edx, dword [0x666d08]
lea ebx, [esi + 0x42b0]
mov dword [ebx], edx
mov dword [esi + 0x42bc], edi
mov dword [esi + 0x42b8], 0x5ecaf4
lea ebp, [esi + 0x42c8]
mov byte [esp + 0x1c], 5
mov ecx, ebp
call fcn.004841e0
lea ecx, [esi + 0x4724]
mov byte [esp + 0x1c], 6
call fcn.004841e0
mov eax, dword [0x666d08]
mov dword [esi + 0x4b8c], eax
mov eax, 1
mov ecx, ebx
mov byte [esp + 0x1c], 8
mov dword [esi], 0x5f05dc
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x54], 0xc0c0c0
mov dword [esi + 0x58], edi
call 0x620b73
mov edx, dword [ebp]
mov ecx, ebp
mov dword [esi + 0x5c], edi
call dword [edx + 4]
mov eax, 0x64
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4b80], eax
mov dword [esi + 0x4b84], eax
mov eax, 1
mov dword [esi + 0x4b88], edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x60], eax
xor eax, eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x74], 0x10
mov dword [esi + 0x428c], edi
mov dword [esi + 0x4290], edi
mov dword [esi + 0x4294], edi
mov dword [esi + 0x4298], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x420c], eax
mov dword [esi + 0x4210], eax
mov dword [esi + 0x4214], eax
mov dword [esi + 0x429c], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x52b940
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x532b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e7f28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], 2
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x532baf
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
call 0x620be8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call 0x620be8
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call 0x620be8
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x30]
push 0x648278
lea edx, [esp + 0x14]
push ecx
push edx
call 0x620e7d
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 3
call 0x620e17
push 0x640224
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 4
push eax
call 0x620e7d
lea ecx, [esp + 0x28]
lea edx, [esp + 4]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 5
call 0x620e17
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 6
call 0x620d21
lea ecx, [esp + 4]
mov byte [esp + 0x20], 5
call 0x620be8
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call 0x620be8
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call 0x620be8
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call 0x620be8
lea eax, [esp + 0x2c]
lea ecx, [esi + 0x2ab0]
push eax
call 0x620d21
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call 0x62095d
lea ecx, [esi + 0x60]
call fcn.00528760
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x20], 1
call 0x620be8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call 0x620be8
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call 0x620be8
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc

Function at 0x533000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e7fe7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov eax, dword [0x666d08]
mov esi, dword [ecx + 0x64]
mov dword [esp + 0x14], 1
mov dword [esp + 4], eax
push 0x6491c8
push esi
mov byte [esp + 0x1c], 2
call fcn.00598700
push 0xffffd8ef
push esi
call fcn.00598880
mov ecx, dword [esp + 0x30]
push ecx
push esi
call fcn.00598700
push 0xfffffffffffffffe
push esi
call fcn.00598880
push 0xffffffffffffffff
push esi
call fcn.005984e0
add esp, 0x28
lea ecx, [esp + 4]
push eax
call 0x620d71
push 0xfffffffffffffffe
push esi
call fcn.005980d0
push 0xfffffffffffffffe
push esi
call fcn.005980d0
mov esi, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x62095d
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call 0x620be8
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call 0x620be8
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x534f70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5e8222
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
xor ebx, ebx
push 0x4b90
mov dword [edi], 0x64
mov dword [esp + 0x2c], ebx
mov dword [ebp], 0x32
call 0x620929
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov byte [esp + 0x28], 1
je 0x534fcc
mov ecx, eax
call fcn.0051f7b0
mov esi, eax
jmp 0x534fce
xor esi, esi
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x28], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x44], eax
call 0x626920
cmp eax, ebx
je 0x534fee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x534ff0
xor eax, eax
mov edx, dword [esi]
push ebx
push 0x270f
push eax
lea eax, [esp + 0x1c]
mov ecx, 0x64
push eax
push 0x40000000
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
push 0x64228c
push ebx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [edx + 0x54]
test eax, eax
je 0x53508a
push ebx
mov ecx, esi
call 0x6243b3
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call 0x62095d
mov ecx, esi
call fcn.005215e0
mov ecx, dword [esi + 0x3c]
push ebx
call 0x6243f5
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x10]
push eax
call fcn.00523c20
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [ebp], edx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
cmp esi, ebx
je 0x53507e
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 4]
cmp dword [esp + 0x3c], ebx
je 0x535097
add dword [ebp], 0x19
jmp 0x535097
cmp esi, ebx
je 0x535097
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call 0x620be8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x24
Function at 0x535f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e8412
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
push 0x66b9a0
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0
call 0x620c56
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 1
call fcn.0047a3a0
mov eax, dword [0x666d08]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
push 1
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x6401e0
mov byte [esp + 0x13c], 3
call 0x620c56
push ecx
mov byte [esp + 0x13c], 4
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x6445f4
call 0x620c56
push ecx
mov byte [esp + 0x140], 5
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x6445c0
call 0x620c56
push 3
lea ecx, [esp + 0x28]
mov byte [esp + 0x144], 3
call fcn.0047ade0
test eax, eax
je 0x53606e
mov edx, dword [esp + 0xc]
push 0x6401e0
push edx
call 0x604853
add esp, 8
test eax, eax
je 0x53606e
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x53606e
push 0x63d3a0
lea ecx, [esp + 0x10]
call 0x61d2aa
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call 0x62095d
push 0x6445ac
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 6
call 0x620fc4
mov edx, dword [esp + 8]
push edx
call dword [0x5ec3c4]
cmp eax, 0xffffffff
je 0x53605d
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
call 0x620d21
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 3
call 0x620be8
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x536125
push 0x6445b8
call dword [0x5ec3ac]
mov esi, eax
test esi, esi
je 0x536125
lea edx, [esp + 0x20]
push 0x104
push edx
push esi
call dword [0x5ec47c]
test eax, eax
jbe 0x53611e
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
call 0x620c56
push 0x5c
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 7
call 0x61cea6
cmp eax, 0xffffffff
je 0x53610d
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x10]
call 0x61ce2e
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x130], 8
call 0x620d21
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 7
call 0x620be8
push 0x63d3a0
lea ecx, [esp + 8]
call 0x61d2aa
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 3
call 0x620be8
push esi
call dword [0x5ec3a4]
mov edx, dword [esp + 4]
mov eax, dword [edx - 8]
test eax, eax
jne 0x53615c
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [0x5ec39c]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 8]
call 0x620d71
push 0x63d3a0
lea ecx, [esp + 8]
call 0x61d2aa
mov esi, dword [esp + 0x134]
lea edx, [esp + 4]
push edx
mov ecx, esi
call 0x62095d
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 2
call 0x620be8
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 1
call fcn.0047a3d0
lea ecx, [esp + 4]
mov byte [esp + 0x12c], 0
call 0x620be8
mov ecx, dword [esp + 0x124]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x12c
ret
Function at 0x5406e7
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
xor edx, edx
mov al, 1
shl al, cl
inc ecx
dec edx
cmp edx, 0xfffffff8
mov byte [ecx + 0x66bdaf], al
mov byte [edx + 0x67cdf0], al
not al
mov byte [ecx + 0x67bddf], al
jg 0x5406eb
xor ecx, ecx
mov dl, cl
mov al, cl
shl dl, 4
shr al, 4
xor al, dl
and al, 0xf
xor al, dl
mov dl, al
shl dl, 2
shr al, 2
xor al, dl
and al, 0x33
xor al, dl
mov dl, al
add dl, dl
shr al, 1
xor al, dl
and al, 0x55
xor al, dl
mov byte [ecx + 0x66bc50], al
inc ecx
cmp ecx, 0x100
jl 0x54070c
push ebx
push ebp
push esi
push edi
push 7
mov esi, 0x66bd70
pop edi
mov edx, 0xff
mov ecx, edi
xor eax, eax
sar edx, cl
or bl, 0xff
mov ecx, eax
shl bl, cl
and bl, dl
mov byte [esi + eax], bl
inc eax
cmp eax, 8
jl 0x54075c
dec edi
add esi, 8
cmp edi, 0xffffffff
jg 0x540751
xor esi, esi
mov eax, esi
xor ecx, ecx
shl eax, 3
lea edi, [eax + 0x67bdef]
mov ebp, edi
xor edx, edx
inc edx
shl edx, cl
test esi, edx
setne dl
mov byte [ebp], dl
inc ecx
dec ebp
cmp ecx, 8
jl 0x540788
lea ecx, [eax + 0x67bdea]
xor edx, edx
mov dh, byte [ecx + 1]
mov dl, byte [ecx]
movzx ebx, byte [ecx - 1]
movzx ecx, byte [ecx - 2]
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax + 0x67bdee]
mov dword [eax + 0x67c5e8], edx
mov ch, byte [edi]
movzx edx, byte [eax + 0x67bded]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x67bdec]
shl ecx, 8
or ecx, edx
inc esi
cmp esi, 0x100
mov dword [eax + 0x67c5ec], ecx
jl 0x540779
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x54f967
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x140
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00565305
add esp, 0x14
test eax, eax
je 0x54f9a3
push 3
pop ecx
jmp 0x54f9a6
mov ecx, dword [ebp + 0x10]
movzx eax, cx
cmp eax, ebx
jl 0x54faac
xor edx, edx
inc edx
cmp eax, edx
jle 0x54fab5
cmp eax, 3
jne 0x54faac
cmp dword [ebp - 4], ebx
je 0x54faa3
mov esi, dword [ebp - 0xc]
cmp esi, ebx
je 0x54faa3
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x54faa3
mov cl, byte [ebp + 0x14]
mov dword [ebp + 8], ebx
mov ebx, edx
shl ebx, cl
mov ecx, ebx
test ecx, ecx
jle 0x54fa25
mov edx, dword [ebp - 4]
lea eax, [esi + ecx*2]
sub edx, esi
sub edi, esi
dec ecx
dec eax
dec eax
cmp word [edx + eax], 0x100
jae 0x54fa1e
cmp word [eax], 0x100
jae 0x54fa1e
cmp word [edi + eax], 0x100
jae 0x54fa1e
test ecx, ecx
jg 0x54f9fe
jmp 0x54fa25
mov dword [ebp + 8], 1
test ebx, ebx
jle 0x54fb33
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
sub edi, esi
mov dword [ebp + 0x14], ebx
lea ecx, [eax + 1]
mov eax, dword [ebp - 8]
sub eax, esi
mov dword [ebp + 0xc], eax
cmp dword [ebp + 8], 0
je 0x54fa84
movzx eax, word [esi + edi]
imul eax, eax, 0xff
cdq
mov ebx, 0xffff
idiv ebx
mov byte [ecx + 1], al
movzx eax, word [esi]
imul eax, eax, 0xff
cdq
idiv ebx
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
movzx eax, word [esi + eax]
imul eax, eax, 0xff
cdq
idiv ebx
mov byte [ecx - 1], al
mov eax, dword [ebp + 0xc]
jmp 0x54fa94
mov dl, byte [esi + edi]
mov byte [ecx + 1], dl
mov dl, byte [esi]
mov byte [ecx], dl
mov dl, byte [esi + eax]
mov byte [ecx - 1], dl
inc esi
add ecx, 4
inc esi
dec dword [ebp + 0x14]
jne 0x54fa43
jmp 0x54fb33
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x14
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp word [ebp + 0x14], dx
mov eax, dword [ebp + 0xc]
jne 0x54faf5
cmp cx, dx
jne 0x54fadc
and byte [eax], 0
and byte [eax + 1], 0
and byte [eax + 2], 0
or byte [eax + 4], 0xff
or byte [eax + 5], 0xff
or byte [eax + 6], 0xff
jmp 0x54fb33
or byte [eax], 0xff
or byte [eax + 1], 0xff
or byte [eax + 2], 0xff
and byte [eax + 4], 0
and byte [eax + 5], 0
and byte [eax + 6], 0
jmp 0x54fb33
cmp cx, dx
jne 0x54fb15
xor ecx, ecx
add eax, 2
mov byte [eax - 2], cl
mov byte [eax - 1], cl
mov byte [eax], cl
inc ecx
add eax, 4
cmp ecx, 0x100
jl 0x54faff
jmp 0x54fb33
xor edx, edx
add eax, 2
or cl, 0xff
sub cl, dl
inc edx
mov byte [eax - 2], cl
mov byte [eax - 1], cl
mov byte [eax], cl
add eax, 4
cmp edx, 0x100
jl 0x54fb1a
mov al, 1
jmp 0x54faae
Function at 0x55538e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
cmp dword [ebp + 8], edx
jne 0x55539f
xor eax, eax
jmp 0x55548c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
imul esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
add esi, dword [ebp + 8]
push edi
mov edi, ebx
push 8
sub eax, ebx
and edi, 7
pop ecx
inc eax
sub ecx, edi
cmp ecx, eax
mov dword [ebp + 8], ecx
jb 0x5553c9
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 8
jne 0x5553d2
mov dword [ebp + 8], edx
mov ecx, dword [ebp + 0x18]
and ecx, 7
inc ecx
cmp ecx, eax
mov dword [ebp + 0xc], ecx
jb 0x5553e3
mov dword [ebp + 0xc], eax
mov ecx, ebx
xor ecx, dword [ebp + 0x18]
test ecx, 0xfffffff8
jne 0x5553f3
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp + 8]
add ecx, ebx
cmp ebx, ecx
mov dword [ebp + 0x10], ecx
jae 0x555427
mov edi, ebx
mov ecx, ebx
not edi
shr ecx, 3
and edi, 7
add ecx, esi
cmp dword [ebp + 0x1c], 0
mov dl, byte [edi + 0x66bdb0]
je 0x55541d
or byte [ecx], dl
jmp 0x555421
not dl
and byte [ecx], dl
inc ebx
cmp ebx, dword [ebp + 0x10]
jb 0x5553ff
xor edi, edi
cmp eax, 8
jbe 0x555459
sub eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
shr eax, 3
mov edi, eax
je 0x555459
mov eax, dword [ebp + 0x1c]
push edi
neg eax
sbb eax, eax
and eax, 0xff
push eax
mov eax, ebx
shr eax, 3
add eax, esi
push eax
call 0x607d80
add esp, 0xc
lea edx, [ebx + edi*8]
jmp 0x555481
mov ecx, edx
mov eax, edx
not ecx
shr eax, 3
and ecx, 7
add eax, esi
cmp dword [ebp + 0x1c], 0
mov cl, byte [ecx + 0x66bdb0]
je 0x55547c
or byte [eax], cl
jmp 0x555480
not cl
and byte [eax], cl
inc edx
cmp edx, dword [ebp + 0x18]
jb 0x55545e
xor eax, eax
pop edi
pop esi
inc eax
pop ebx
pop ebp
ret 0x18
Function at 0x562c42
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x120
cmp dword [esp + 0x10], esi
mov eax, dword [edi]
jae 0x562c66
push eax
call fcn.00573c56
push 2
call fcn.00573be6
pop ecx
mov dword [edi], eax
pop ecx
push esi
push 0
push eax
call 0x607d80
add esp, 0xc
pop edi
pop esi
ret

Function at 0x571714
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x571741
push esi
call fcn.0056f6ad
cmp byte [esi + 0x40], 0
pop ecx
je 0x57173a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5717b0
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x5717a5
mov eax, dword [esi + 8]
test eax, eax
je 0x571762
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x5717a1
cmp eax, 2
je 0x5717a5
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x571757
cmp eax, 3
je 0x571786
cmp eax, 1
jne 0x571757
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x571757
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x571757
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x5717ce
cmp eax, 0xcc
je 0x5717ce
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
call dword [eax]
pop ecx
push esi
call fcn.005717d7
pop ecx
pop esi
ret

Function at 0x577e44
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
jne 0x577e4e
xor eax, eax
ret
jmp fcn.00577e53
Function at 0x5823d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x2c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x582461
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call 0x607a40
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x582424
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x582446
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x5824bc
mov ecx, dword [esi + 0x74]
push ebx
add ecx, dword [esi + 0x6c]
add ecx, dword [esi + 0x38]
push ecx
push eax
call fcn.005824c1
add dword [esi + 0x74], eax
mov ebx, dword [esi + 0x74]
add esp, 0xc
cmp ebx, 3
jb 0x5824a8
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x5824bc
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x5823e5
pop edi
pop esi
pop ebx
pop ebp
ret