joyce8/EMBER2024-capa huggingface dataset:
Function at 0x573373
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0x16], 0
mov dword [esp + 8], esi
jne 0x57339f
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x24]
push edx
call fcn.00572410
add esp, 8
pop esi
add esp, 0x14
ret 8
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
push ebx
mov ebx, dword [edx + 8]
push ebp
mov ebp, dword [esi + 4]
push edi
mov edi, dword [edx]
mov edx, dword [edx + 0xc]
sub edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x18]
imul edx, eax
add edx, dword [ebp + 0x10]
sub eax, dword [ecx + 8]
mov ebp, dword [ebp + 0x18]
lea esi, [edx + edi*4]
movzx edx, word [ecx + 0x14]
imul eax, edx
sub eax, dword [ecx + 4]
sub ebx, edi
add eax, dword [ecx]
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 8]
add eax, edi
lea edi, [ebx*4]
sub ebp, edi
mov edi, ecx
shr edi, 8
sub edx, ebx
and edi, 0xff00ff
and ecx, 0xff00ff
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edx
mov ecx, 1
jmp 0x573424
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x2c], ebx
jmp 0x573430
movzx edx, byte [eax]
add eax, ecx
mov dword [esp + 0x28], eax
mov ecx, edx
shr ecx, 7
add ecx, edx
mov eax, 0xff
sub eax, edx
mov edx, eax
shr edx, 7
add edx, eax
mov eax, dword [esi]
mov ebx, eax
mov ebp, eax
and ebx, 0xff00ff
imul ebx, edx
shr eax, 8
shr ebp, 8
and eax, 0xff00ff
imul eax, edx
and ebp, 0xffff00ff
imul ebp, edx
mov edx, dword [esp + 0x14]
shr ebx, 8
imul edx, ecx
xor ebx, ebp
and ebx, 0xff00ff
xor ebx, eax
mov eax, edi
imul eax, ecx
shr edx, 8
xor edx, eax
mov eax, edi
imul eax, ecx
and edx, 0xff00ff
xor edx, eax
mov eax, dword [esp + 0x28]
add ebx, edx
mov dword [esi], ebx
mov ecx, 1
add esi, 4
sub dword [esp + 0x2c], ecx
jne 0x573430
add esi, dword [esp + 0x1c]
add eax, dword [esp + 0x20]
sub dword [esp + 0x10], ecx
jne 0x573420
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret 8
Function at 0x577849
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x18]
imul ecx, eax
add ecx, dword [edx + 0x10]
sub eax, dword [esi + 0x10]
mov edx, dword [edx + 0x18]
push edi
mov edi, dword [esp + 0x20]
lea ecx, [ecx + edi*2]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 8]
imul eax, dword [ecx + 0x18]
sub eax, dword [esi + 0xc]
mov dword [esp + 0x14], edx
add eax, dword [ecx + 0x10]
add eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x14]
call fcn.0055fb20
movzx ecx, byte [esi + 0x18]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 7
add eax, ecx
sar eax, 3
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov edi, edi
mov dl, byte [ebx]
movzx ecx, word [esi]
mov edi, dword [esp + 0x10]
movzx edx, dl
movzx edi, word [edi + edx*2]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
mov ecx, edi
and ecx, 0x7e0
shl ecx, 0x10
and edx, 0xfffff81f
or ecx, edi
and ecx, 0xfffff81f
sub ecx, edx
imul ecx, eax
shr ecx, 5
add ecx, edx
mov edx, ecx
shr edx, 0x10
xor edx, ecx
and edx, 0x7e0
xor edx, ecx
mov word [esi], dx
add ebx, 1
add esi, 2
sub ebp, 1
jne 0x5778b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add dword [esp + 0x24], ecx
add dword [esp + 0x20], edx
sub dword [esp + 0x2c], 1
jne 0x5778a2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10

Function at 0x57df50
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, 0xff
push edi
mov edi, dword [esi]
mov byte [esp + 4], al
mov byte [esp + 5], al
cmp dword [edi + 0x14], 0
je 0x57df76
push ebx
mov eax, 2
lea ebx, [esp + 8]
call fcn.00410220
pop ebx
jmp 0x57df8f
mov edi, dword [edi + 4]
test edi, edi
je 0x57df8f
push edi
push 2
lea eax, [esp + 0xc]
push 1
push eax
call fcn.0060860a
add esp, 0x10
cmp word [esi + 4], 0x4949
pop edi
jne 0x57dfa6
xor ecx, ecx
mov ch, byte [esp + 1]
mov cl, byte [esp]
movzx eax, cx
pop ecx
ret
movzx ax, byte [esp + 1]
xor edx, edx
mov dh, byte [esp]
or dx, ax
movzx eax, dx
pop ecx
ret

Function at 0x57e000
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, 0xff
push edi
mov edi, dword [esi]
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 7], al
cmp dword [edi + 0x14], 0
je 0x57e02e
push ebx
mov eax, 4
lea ebx, [esp + 8]
call fcn.00410220
pop ebx
jmp 0x57e047
mov edi, dword [edi + 4]
test edi, edi
je 0x57e047
push edi
push 4
lea eax, [esp + 0xc]
push 1
push eax
call fcn.0060860a
add esp, 0x10
cmp word [esi + 4], 0x4949
movzx ecx, byte [esp + 6]
movzx edx, byte [esp + 5]
pop edi
jne 0x57e074
movzx eax, byte [esp + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp]
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
pop ecx
ret
xor eax, eax
mov ah, byte [esp]
or eax, edx
movzx edx, byte [esp + 3]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
pop ecx
ret
Function at 0x57e5c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esi]
cmp dword [edi + 0x14], 0
mov ebx, eax
je 0x57e5de
lea eax, [ebp + ebp]
call fcn.00410220
shr eax, 1
jmp 0x57e5f6
mov edi, dword [edi + 4]
test edi, edi
je 0x57e5f4
push edi
push ebp
push 2
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x57e5f6
xor eax, eax
cmp eax, ebp
jge 0x57e622
cmp dword [esi + 0x3cc], 0
jne 0x57e61b
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
jne 0x57e61b
mov eax, dword [eax + 4]
test eax, eax
je 0x57e61b
push eax
call fcn.006095df
add esp, 4
add dword [esi + 0x3cc], 1
push 0x1234
call dword [sym.imp.WS2_32.dll_ntohs]
xor ecx, ecx
cmp ax, 0x1234
sete cl
xor edx, edx
cmp word [esi + 4], 0x4949
sete dl
cmp edx, ecx
jne 0x57e654
lea eax, [ebp + ebp]
push eax
push ebx
push ebx
call fcn.0061c6cf
add esp, 0xc
pop edi
pop ebp
pop ebx
ret 4
Function at 0x57f2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebp
xor ebp, ebp
cmp word [edi + 0x460], bp
mov dword [esp + 8], ebp
jbe 0x57f51f
push ebx
push esi
lea esp, [esp]
movzx eax, word [edi + 0x462]
test eax, eax
mov dword [esp + 0xc], 0
jbe 0x57f507
mov esi, ebp
and esi, 7
add esi, esi
mov dword [esp + 0x1c], esi
jmp 0x57f344
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
movzx eax, word [edi + 0x468]
mov ebx, dword [edi + 0x338]
movzx edx, word [edi + 0x46c]
and ecx, 1
add ecx, esi
add ecx, ecx
mov esi, dword [edi + 0x4d8]
shr ebx, cl
mov dword [esp + 0x24], ecx
mov ecx, eax
shr ebp, cl
and ebx, 3
mov dword [esp + 0x2c], ebx
imul ebp, edx
mov edx, dword [esp + 0xc]
mov ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, eax
mov eax, edx
shr eax, cl
add ebp, eax
lea ecx, [ebx + ebp*4]
xor eax, eax
cmp word [esi + ecx*2], ax
jne 0x57f4e9
mov esi, dword [esp + 0x10]
lea ecx, [esi + 2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [ecx - 4]
cmp eax, ecx
ja 0x57f4e9
lea ecx, [edx + 2]
lea edx, [ecx - 4]
mov dword [esp + 0x20], edx
mov ebp, dword [esp + 0x20]
cmp ebp, ecx
ja 0x57f4a3
mov edi, edi
movzx ecx, word [edi + 0x460]
cmp eax, ecx
jae 0x57f489
movzx ecx, word [edi + 0x462]
cmp ebp, ecx
jae 0x57f489
mov ecx, eax
and ecx, 7
mov edx, ebp
and edx, 1
lea esi, [edx + ecx*2]
mov edx, dword [edi + 0x338]
add esi, esi
mov ebx, edx
mov ecx, esi
shr ebx, cl
mov ecx, dword [esp + 0x24]
shr edx, cl
xor ebx, edx
test bl, 3
jne 0x57f489
movzx ebx, word [edi + 0x468]
mov edx, dword [edi + 0x338]
mov ecx, esi
shr edx, cl
mov ecx, ebx
mov esi, eax
shr esi, cl
movzx ecx, word [edi + 0x46c]
imul esi, ecx
mov ecx, ebp
mov dword [esp + 0x28], ecx
mov ecx, ebx
mov ebx, ebp
shr ebx, cl
mov ecx, dword [edi + 0x4d8]
and edx, 3
add esi, ebx
lea esi, [edx + esi*4]
cmp word [ecx + esi*2], 0
je 0x57f489
movzx ecx, word [edi + 0x468]
movzx esi, word [edi + 0x46c]
add dword [esp + 0x14], 1
mov ebx, eax
shr ebx, cl
imul ebx, esi
mov esi, ebp
shr esi, cl
mov ecx, dword [edi + 0x4d8]
add ebx, esi
lea edx, [edx + ebx*4]
movzx ecx, word [ecx + edx*2]
add dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xc]
add ebp, 1
add ecx, 2
cmp ebp, ecx
jbe 0x57f3d0
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
add eax, 1
lea edx, [esi + 2]
cmp eax, edx
jbe 0x57f3c2
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x57f4e9
mov eax, dword [esp + 0x18]
movzx ecx, word [edi + 0x468]
xor edx, edx
div ebp
movzx edx, word [edi + 0x46c]
shr esi, cl
imul esi, edx
mov edx, dword [esp + 0xc]
shr edx, cl
mov ecx, dword [edi + 0x4d8]
add esi, edx
lea edx, [ebx + esi*4]
mov word [ecx + edx*2], ax
mov ecx, dword [esp + 0xc]
movzx eax, word [edi + 0x462]
mov ebp, dword [esp + 0x10]
add ecx, 1
cmp ecx, eax
mov dword [esp + 0xc], ecx
jb 0x57f340
movzx eax, word [edi + 0x460]
add ebp, 1
cmp ebp, eax
mov dword [esp + 0x10], ebp
jb 0x57f310
pop esi
pop ebx
pop ebp
add esp, 0x24
ret
Function at 0x57f600
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
je 0x57f617
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp ecx, dword [eax + 0x1c]
sete dl
mov eax, edx
jmp 0x57f62c
mov eax, dword [eax + 4]
test eax, eax
je 0x57f629
push eax
call fcn.006095df
add esp, 4
jmp 0x57f62c
or eax, 0xffffffff
test eax, eax
je 0x57f633
xor eax, eax
ret
cmp dword [esi + 0x2068c], 0
push ebx
push edi
mov edi, dword [esi]
jne 0x57f687
cmp dword [edi + 0x14], 0
lea ebx, [esi + 0x2069c]
je 0x57f658
mov eax, 0x10000
call fcn.00410220
jmp 0x57f674
mov edi, dword [edi + 4]
test edi, edi
je 0x57f672
push edi
push 0x10000
push 1
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x57f674
xor eax, eax
pop edi
mov dword [esi + 0x20690], 0
mov dword [esi + 0x2068c], eax
pop ebx
ret
movzx eax, byte [esi + 0x30694]
movzx ecx, byte [esi + 0x30695]
movzx edx, byte [esi + 0x30696]
mov byte [esi + 0x2069c], al
movzx eax, byte [esi + 0x30697]
mov byte [esi + 0x2069d], cl
movzx ecx, byte [esi + 0x30698]
mov byte [esi + 0x2069e], dl
movzx edx, byte [esi + 0x30699]
mov byte [esi + 0x2069f], al
movzx eax, byte [esi + 0x3069a]
mov byte [esi + 0x206a0], cl
movzx ecx, byte [esi + 0x3069b]
mov byte [esi + 0x206a1], dl
mov byte [esi + 0x206a2], al
mov byte [esi + 0x206a3], cl
cmp dword [edi + 0x14], 0
lea ebx, [esi + 0x206a4]
je 0x57f707
mov eax, 0xfff8
call fcn.00410220
jmp 0x57f723
mov edi, dword [edi + 4]
test edi, edi
je 0x57f721
push edi
push 0xfff8
push 1
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x57f723
xor eax, eax
add dword [esi + 0x20694], 0xfff8
add dword [esi + 0x20690], 0xffff0008
lea edx, [eax + 8]
pop edi
mov dword [esi + 0x2068c], edx
pop ebx
ret

Function at 0x57f8a0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4004
call fcn.00618800
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x4000], eax
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
mov ebp, 1
je 0x57f8e8
cmp dword [eax + 0x18], 0xffffffff
je 0x57f8f8
mov edx, dword [eax + 0x1c]
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [eax + 0x18], 0
mov dword [eax + 0x18], ecx
jmp 0x57f8f8
mov edx, dword [eax + 4]
push 0
push 0
push edx
call fcn.006081d8
add esp, 0xc
mov esi, dword [esi]
cmp dword [esi + 0x14], 0
je 0x57f916
push ebx
push edi
mov eax, 0x4000
lea ebx, [esp + 0x10]
mov edi, esi
call fcn.00410220
pop edi
pop ebx
jmp 0x57f932
mov esi, dword [esi + 4]
test esi, esi
je 0x57f932
push esi
push 0x4000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0060860a
add esp, 0x10
mov eax, 0x21c
mov cl, 0xff
lea esp, [esp]
cmp byte [esp + eax + 8], cl
jne 0x57f94f
cmp byte [esp + eax + 9], 0
jne 0x57f972
xor ebp, ebp
add eax, 1
cmp eax, 0x3fff
jb 0x57f940
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.00607d6d
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4008]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00607d6d
add esp, 0x4004
ret
Function at 0x57f8b9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4004
call fcn.00618800
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x4000], eax
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
mov ebp, 1
je 0x57f8e8
cmp dword [eax + 0x18], 0xffffffff
je 0x57f8f8
mov edx, dword [eax + 0x1c]
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [eax + 0x18], 0
mov dword [eax + 0x18], ecx
jmp 0x57f8f8
mov edx, dword [eax + 4]
push 0
push 0
push edx
call fcn.006081d8
add esp, 0xc
mov esi, dword [esi]
cmp dword [esi + 0x14], 0
je 0x57f916
push ebx
push edi
mov eax, 0x4000
lea ebx, [esp + 0x10]
mov edi, esi
call fcn.00410220
pop edi
pop ebx
jmp 0x57f932
mov esi, dword [esi + 4]
test esi, esi
je 0x57f932
push esi
push 0x4000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0060860a
add esp, 0x10
mov eax, 0x21c
mov cl, 0xff
lea esp, [esp]
cmp byte [esp + eax + 8], cl
jne 0x57f94f
cmp byte [esp + eax + 9], 0
jne 0x57f972
xor ebp, ebp
add eax, 1
cmp eax, 0x3fff
jb 0x57f940
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.00607d6d
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4008]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00607d6d
add esp, 0x4004
ret
Function at 0x5829f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
mov ecx, dword [esi + 0x348]
je 0x582a29
cmp dword [eax + 0x18], 0xffffffff
je 0x582a38
mov edx, dword [eax + 0x1c]
cmp edx, ecx
mov dword [eax + 0x18], ecx
ja 0x582a24
mov ecx, edx
mov dword [eax + 0x18], ecx
jmp 0x582a38
mov eax, dword [eax + 4]
push 0
push ecx
push eax
call fcn.006081d8
add esp, 0xc
push edi
mov edi, dword [esi]
cmp dword [edi + 0x14], 0
je 0x582a53
push ebx
mov eax, 0x100
lea ebx, [esp + 8]
call fcn.00410220
pop ebx
jmp 0x582a6f
mov edi, dword [edi + 4]
test edi, edi
je 0x582a6f
push edi
push 0x100
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.0060860a
add esp, 0x10
mov eax, 0xf
pop edi
cmp byte [esp + eax], 0
jne 0x582a9c
add eax, 0x10
cmp eax, 0x100
jl 0x582a75
xor eax, eax
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00607d6d
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
xor ecx, esp
mov eax, 1
call fcn.00607d6d
add esp, 0x104
ret

Function at 0x582bf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
cmp dword [eax + 0x14], ebx
push edi
mov dword [esp + 0x10], esi
je 0x582c29
cmp dword [eax + 0x18], 0xffffffff
je 0x582c44
mov edx, dword [eax + 0x1c]
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [eax + 0x18], ecx
jmp 0x582c44
mov edx, dword [eax + 4]
push ebx
push ebx
push edx
call fcn.006081d8
add esp, 0xc
jmp 0x582c44
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x582c82
mov ecx, dword [esi + 0x1c]
mov edi, 0xc
cmp ecx, edi
jb 0x582c63
mov eax, dword [esi + 0x18]
lea ebp, [eax + 0xc]
cmp ebp, ecx
jbe 0x582c6c
mov eax, dword [esi + 0x18]
sub ecx, eax
mov edi, ecx
je 0x582c9b
add eax, edx
push edi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0060d1b0
add esp, 0xc
add dword [esi + 0x18], edi
jmp 0x582c9b
mov esi, dword [esi + 4]
test esi, esi
je 0x582c9b
push esi
push 0xc
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0060860a
add esp, 0x10
movzx eax, byte [esp + 0x1b]
mov dl, byte [esp + 0x1d]
mov cl, byte [esp + 0x18]
shr dl, 4
shr al, 4
and dl, al
movzx eax, byte [esp + 0x16]
shr cl, 4
and dl, cl
shr al, 4
and dl, al
and dl, byte [esp + 0x1f]
and dl, byte [esp + 0x1c]
and dl, byte [esp + 0x1a]
and dl, byte [esp + 0x15]
and dl, 3
cmp dl, 3
jne 0x582cfe
add ebx, 1
cmp ebx, 0x400
jl 0x582c40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00607d6d
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00607d6d
add esp, 0x14
ret
Function at 0x582d20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp]
cmp dword [eax + 0x14], 0
push esi
push edi
je 0x582d61
cmp dword [eax + 0x18], 0xffffffff
je 0x582d74
mov ecx, dword [eax + 0x1c]
cmp ecx, 0xc00
mov dword [eax + 0x18], 0xc00
jbe 0x582d5c
mov ecx, 0xc00
mov dword [eax + 0x18], ecx
jmp 0x582d74
mov eax, dword [eax + 4]
push 0
push 0xc00
push eax
call fcn.006081d8
add esp, 0xc
mov edi, dword [ebp]
cmp dword [edi + 0x14], 0
je 0x582d8d
mov eax, 0x18
lea ebx, [esp + 0x10]
call fcn.00410220
jmp 0x582da6
mov edi, dword [edi + 4]
test edi, edi
je 0x582da6
push edi
push 0x18
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.0060860a
add esp, 0x10
movzx ebx, byte [esp + 0x18]
movzx edx, byte [esp + 0x24]
and ebx, 3
shl ebx, 4
and edx, 3
or ebx, edx
mov esi, 0x6b54ec
mov edi, 4
cmp ebx, dword [esi - 4]
jne 0x582dfc
mov ecx, ebp
sub ecx, esi
mov eax, esi
lea edx, [ecx + 0x215]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x582dd6
lea eax, [esi + 0xc]
mov edx, ebp
sub edx, eax
add edx, 0x255
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x582df0
add esi, 0x20
sub edi, 1
jne 0x582dc5
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00607d6d
add esp, 0x1c
ret 4

Function at 0x582e20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x1a8], eax
mov eax, dword [esi]
cmp dword [eax + 0x14], 0
je 0x582e59
cmp dword [eax + 0x18], 0xffffffff
je 0x582e6c
mov ecx, dword [eax + 0x1c]
lea edx, [ecx - 0x1a8]
cmp ecx, edx
mov dword [eax + 0x18], edx
jbe 0x582e54
mov ecx, edx
mov dword [eax + 0x18], ecx
jmp 0x582e6c
mov eax, dword [eax + 4]
push 2
push 0xfffffe58
push eax
call fcn.006081d8
add esp, 0xc
push edi
mov edi, dword [esi]
cmp dword [edi + 0x14], 0
je 0x582e87
push ebx
mov eax, 0x1a8
lea ebx, [esp + 8]
call fcn.00410220
pop ebx
jmp 0x582ea3
mov edi, dword [edi + 4]
test edi, edi
je 0x582ea3
push edi
push 0x1a8
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.0060860a
add esp, 0x10
xor ecx, ecx
xor eax, eax
pop edi
cmp byte [esp + ecx], 0
je 0x582eb1
add eax, 1
cmp byte [esp + ecx + 1], 0
je 0x582ebb
add eax, 1
cmp byte [esp + ecx + 2], 0
je 0x582ec5
add eax, 1
cmp byte [esp + ecx + 3], 0
je 0x582ecf
add eax, 1
add ecx, 4
cmp ecx, 0x1a8
jb 0x582ea8
mov ecx, dword [esp + 0x1a8]
xor edx, edx
cmp eax, 0x14
setg dl
xor ecx, esp
mov eax, edx
call fcn.00607d6d
add esp, 0x1ac
ret
Function at 0x586020
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x718e4], 0
push ebp
push edi
lea ebp, [esi + 0x718e8]
jne 0x586092
mov ecx, dword [esi + 0x458]
mov edi, dword [esi]
mov eax, 0x4000
sub eax, ecx
add ecx, ebp
cmp dword [edi + 0x14], 0
push ebx
je 0x586052
mov ebx, ecx
call fcn.00410220
jmp 0x586066
mov edi, dword [edi + 4]
test edi, edi
je 0x586066
push edi
push eax
push 1
push ecx
call fcn.0060860a
add esp, 0x10
mov edi, dword [esi]
cmp dword [edi + 0x14], 0
mov eax, dword [esi + 0x458]
je 0x58607d
mov ebx, ebp
call fcn.00410220
jmp 0x586091
mov edi, dword [edi + 4]
test edi, edi
je 0x586091
push edi
push eax
push 1
push ebp
call fcn.0060860a
add esp, 0x10
pop ebx
mov edi, dword [esp + 0xc]
mov ecx, dword [esi + 0x718e4]
sub ecx, edi
and ecx, 0x1ffff
mov eax, ecx
xor eax, 0x1ff80
sar eax, 3
mov dword [esi + 0x718e4], ecx
xor edx, edx
mov dh, byte [eax + ebp + 1]
and ecx, 7
mov dl, byte [eax + ebp]
or eax, 0xffffffff
sar edx, cl
mov ecx, edi
shl eax, cl
pop edi
pop ebp
not eax
and eax, edx
ret 4

Function at 0x589b10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push edi
mov edi, dword [esi + 0x3189c]
je 0x589c01
imul eax, eax, 0x2e90edd
add eax, 1
mov dword [esi + 0x3169c], eax
imul eax, eax, 0x2e90edd
add eax, 1
mov dword [esi + 0x316a0], eax
imul eax, eax, 0x2e90edd
lea ecx, [esi + 0x316a0]
add eax, 1
mov dword [esi + 0x316a4], eax
imul eax, eax, 0x2e90edd
add eax, 1
mov dword [esi + 0x316a8], eax
mov eax, dword [esi + 0x3169c]
xor eax, dword [esi + 0x316a4]
mov edx, dword [esi + 0x316a8]
shr eax, 0x1f
add edx, edx
or eax, edx
mov dword [esi + 0x316a8], eax
mov eax, ecx
mov dword [esp + 0x18], 0x29
mov ecx, dword [eax + 8]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov edx, dword [eax - 4]
xor edi, ecx
xor edx, ebx
mov ebp, edi
add edx, edx
shr ebp, 0x1f
or edx, ebp
mov dword [eax + 0xc], edx
xor edx, ebx
mov ebx, edx
add edi, edi
shr ebx, 0x1f
or edi, ebx
xor ecx, edi
shr ecx, 0x1f
add edx, edx
or ecx, edx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ecx
add eax, 0xc
sub dword [esp + 0x18], 1
jne 0x589b97
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
xor edi, edi
mov edi, edi
mov eax, dword [esi + edi*4 + 0x3169c]
push eax
call ebx
mov dword [esi + edi*4 + 0x3169c], eax
add edi, 1
cmp edi, 0x7f
jb 0x589be0
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x589c47
lea ecx, [edi + 1]
jmp 0x589c10
lea eax, [ecx - 0x40]
and eax, 0x7f
mov eax, dword [esi + eax*4 + 0x3169c]
mov ebp, ecx
and ebp, 0x7f
xor eax, dword [esi + ebp*4 + 0x3169c]
mov ebp, edi
and ebp, 0x7f
mov dword [esi + ebp*4 + 0x3169c], eax
xor dword [edx], eax
sub ebx, 1
add edi, 1
add ecx, 1
add edx, 4
test ebx, ebx
jne 0x589c10
mov dword [esi + 0x3189c], edi
pop edi
pop ebp
pop ebx
ret 0xc
Function at 0x5948f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x40], eax
cmp dword [esp + 0x48], 0
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov byte [esp + 0x4b], 0
je 0x594996
push ebp
mov ebp, 0x13
lea ecx, [ecx]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
sub ebp, 1
test ecx, ecx
je 0x594973
mov eax, dword [esi + 0x1c]
mov ebx, 1
cmp eax, ebx
jb 0x594942
mov edi, dword [esi + 0x18]
lea edx, [edi + 1]
cmp edx, eax
jbe 0x59494b
mov edi, dword [esi + 0x18]
sub eax, edi
mov ebx, eax
je 0x59496e
lea eax, [edi + ecx]
push ebx
push eax
lea ecx, [esp + 0x1b]
push ecx
call fcn.0060d1b0
add edi, ebx
add esp, 0xc
cmp ebx, 1
mov dword [esi + 0x18], edi
jne 0x59496e
movzx eax, byte [esp + 0x13]
jmp 0x594987
or eax, 0xffffffff
jmp 0x594987
mov esi, dword [esi + 4]
test esi, esi
je 0x594985
push esi
call fcn.0060963d
add esp, 4
jmp 0x594987
xor eax, eax
test ebp, ebp
mov esi, dword [esp + 0x14]
mov byte [esp + ebp + 0x3c], al
jne 0x594920
pop ebp
jmp 0x5949c7
mov edi, dword [esi]
cmp dword [edi + 0x14], 0
je 0x5949ae
mov eax, 0x13
lea ebx, [esp + 0x38]
call fcn.00410220
jmp 0x5949c7
mov edi, dword [edi + 4]
test edi, edi
je 0x5949c7
push edi
push 1
lea edx, [esp + 0x40]
push 0x13
push edx
call fcn.0060860a
add esp, 0x10
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x50]
push str._d:_d:_d__d:_d:_d
push eax
call fcn.006094e9
add esp, 0x20
cmp eax, 6
jne 0x594a67
sub dword [esp + 0x28], 0x76c
sub dword [esp + 0x24], 1
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x38], 0xffffffff
call fcn.0061b471
add esp, 4
test edx, edx
jl 0x594a67
jg 0x594a4e
test eax, eax
jbe 0x594a67
lea edx, [esp + 0x14]
push edx
call fcn.0061b471
add esp, 4
mov dword [esi + 0x328], eax
mov dword [esi + 0x32c], edx
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00607d6d
add esp, 0x44
ret 4