joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555430
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x792a00
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x48], ebx
je 0x55549c
call fcn.0054f6f0
cmp eax, 1
jne 0x5554b0
mov ecx, esi
call fcn.0054f740
cmp eax, ebx
je 0x5554b0
mov eax, dword [esi + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
mov ecx, esi
call fcn.0054f6e0
mov ecx, dword [esi + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x48], ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0054f6f0
cmp eax, ebx
je 0x5554f1
mov ecx, esi
call fcn.0054f6f0
cmp eax, 1
je 0x5554f1
mov edx, dword [esi + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
mov ecx, esi
mov dword [esi + 0x48], ebx
call fcn.0054f6e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
mov ecx, esi
mov edi, eax
mov dword [esi + 0x48], ebx
call fcn.0054f6e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5558e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x792a80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0054f6f0
cmp eax, 2
jne 0x55595c
lea ecx, [eax + 2]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x55592d
mov ecx, 0x10004
lea edx, [ebp - 0x14]
push edx
push ecx
push esi
push 0x555850
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
test eax, eax
je 0x55598b
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0054f6b0
push 0
mov ecx, esi
call fcn.0054f6e0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x7c0f64]
mov eax, dword [esi + 0x48]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5559b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x792abb
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
push eax
call fcn.00550040
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.CWin32Thread.1.0
mov dword [esi + 8], vtable.CWin32Thread.0
mov dword [esi + 0x48], ebx
lea edi, [esi + 8]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx + 4], bl
call fcn.00403fb2
mov eax, dword [ebp + 0x10]
push 0xc
push str.CWin32Thread
lea ecx, [ebp - 0x30]
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00405920
lea ecx, [ebp - 0x30]
push ecx
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0054a430
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 2
jb 0x555a68
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00564155
add esp, 4
mov ecx, esi
call fcn.0054f700
cmp eax, ebx
je 0x555af1
mov eax, dword [esi + 0x68]
mov ecx, 4
cmp eax, ebx
je 0x555a84
mov ecx, 0x10004
lea edx, [ebp + 8]
push edx
push ecx
push esi
push 0x555850
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
cmp eax, ebx
je 0x555ac7
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.0054f6b0
push ebx
mov ecx, esi
call fcn.0054f6e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x18
push str.Failed_to_create_thread_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
call fcn.00405920
push 0x84257c
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00564659
push 0xf
push str.No_thread_proc_
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
call fcn.00405920
push 0x84257c
lea edx, [ebp - 0x68]
push edx
call fcn.00564659
xor ebx, ebx
push ebx
push ebx
call fcn.00564659
int3
Function at 0x555b30
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x792ae0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0054f6f0
cmp eax, 2
jne 0x555bae
lea ecx, [eax + 2]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x555b7d
mov ecx, 0x10004
lea edx, [ebp - 0x14]
push edx
push ecx
push esi
push 0x555850
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
test eax, eax
je 0x555bf6
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0054f6b0
push 0
mov ecx, esi
call fcn.0054f6e0
jmp 0x555bb9
mov ecx, esi
call fcn.0054f6f0
test eax, eax
jne 0x555bf6
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.0054f6d0
mov esi, dword [esi + 0x48]
test esi, esi
je 0x555bf6
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x555bf6
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55f730
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x793720
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
mov ebx, dword [esp + 0x70]
mov edi, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
push eax
call fcn.0055dea0
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x55f91c
cmp byte [ecx], 0
mov byte [esp + 0x16], 0xa
je 0x55f79c
mov byte [ecx], 0
jmp 0x55f7ae
push esi
push 1
lea ecx, [esp + 0x1e]
push 1
push ecx
call fcn.00564d88
add esp, 0x10
mov eax, dword [edi + 0x14]
test eax, eax
je 0x55f81e
cmp dword [edi + 0x18], 0x10
jb 0x55f7c0
mov ecx, dword [edi + 4]
jmp 0x55f7c3
lea ecx, [edi + 4]
push esi
push eax
push 1
push ecx
call fcn.00564d88
push esi
push 1
lea edx, [esp + 0x2e]
push 1
push edx
call fcn.00564d88
xor ebp, ebp
add esp, 0x20
mov byte [esp + 0x17], 0x3d
cmp dword [edi + 0x14], ebp
jbe 0x55f808
jmp 0x55f7f0
push esi
push 1
lea eax, [esp + 0x1f]
push 1
push eax
call fcn.00564d88
inc ebp
add esp, 0x10
cmp ebp, dword [edi + 0x14]
jb 0x55f7f0
push esi
push 1
lea ecx, [esp + 0x1e]
push 1
push ecx
call fcn.00564d88
mov ebp, dword [esp + 0x28]
add esp, 0x10
push ebp
push str._____BEGIN__s_____
push esi
call fcn.00567989
push esi
push 1
lea edx, [esp + 0x2a]
push 1
push edx
call fcn.00564d88
mov eax, dword [esp + 0x90]
push eax
lea ecx, [esp + 0x58]
push ebx
push ecx
call fcn.0055f6b0
add esp, 0x28
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x60], 0
test eax, eax
je 0x55f8ea
mov edi, 0x4c
cmp eax, edi
jae 0x55f86e
mov edi, eax
mov eax, dword [esp + 0x3c]
mov ebx, 0x10
cmp dword [esp + 0x50], ebx
jae 0x55f881
lea eax, [esp + 0x3c]
push esi
push edi
push 1
push eax
call fcn.00564d88
push esi
push 1
lea edx, [esp + 0x2e]
push 1
push edx
call fcn.00564d88
mov eax, dword [esp + 0x6c]
add esp, 0x20
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x44]
call fcn.00407e50
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 1
call fcn.00403fb2
mov byte [esp + 0x60], 0
cmp dword [esp + 0x34], ebx
jb 0x55f8de
mov edx, dword [esp + 0x20]
push edx
call fcn.00564155
add esp, 4
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x55f863
push ebp
push str._____END__s_____
push esi
call fcn.00567989
push esi
push 1
lea eax, [esp + 0x2a]
push 1
push eax
call fcn.00564d88
add esp, 0x1c
cmp dword [esp + 0x50], 0x10
jb 0x55f91c
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00564b24
add esp, 0x50
ret
Function at 0x561b50
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x793bac
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x15c], eax
push ebx
push ebp
push esi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov esi, dword [esp + 0x180]
xor ebx, ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
call fcn.004046bf
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x561c49
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.0055f640
push eax
lea edx, [esp + 0x24]
push str.CCertManager::GetAllUsers___Failed_to_get_key_with_error:
push edx
mov byte [esp + 0x18c], 1
call fcn.00404cfa
push 1
push eax
mov byte [esp + 0x194], 2
call fcn.00402734
add esp, 0x1c
cmp dword [esp + 0x30], 0x10
jb 0x561c14
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0x64], 0x10
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x178], bl
jb 0x561c3f
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00564155
add esp, 4
lea edx, [esp + 0x34]
push edx
jmp 0x561d67
push 0x103
lea eax, [esp + 0x6d]
push ebx
push eax
xor esi, esi
mov byte [esp + 0x74], bl
call fcn.00566330
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push ebx
push edx
call ebp
test eax, eax
jne 0x561d53
inc esi
cmp byte [esp + 0x184], bl
jne 0x561cd2
lea eax, [esp + 0x68]
push str.S_1_5_18
push eax
call fcn.005687ea
add esp, 8
test eax, eax
je 0x561d39
lea ecx, [esp + 0x68]
push str.S_1_5_19
push ecx
call fcn.005687ea
add esp, 8
test eax, eax
je 0x561d39
lea edx, [esp + 0x68]
push str.S_1_5_20
push edx
call fcn.005687ea
add esp, 8
test eax, eax
je 0x561d39
lea eax, [esp + 0x68]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x561cf0
sub eax, edx
push eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x20]
call fcn.00405920
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x17c], 3
call fcn.00403b57
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0x178], bl
jb 0x561d39
mov edx, dword [esp + 0x1c]
push edx
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x6c]
push eax
push esi
push ecx
call ebp
test eax, eax
je 0x561c82
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.00403f4e
lea ecx, [esp + 0x34]
call fcn.00407112
mov eax, esi
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.00564b24
add esp, 0x16c
ret 8
Function at 0x562760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x793d28
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x70]
xor ebx, ebx
cmp ecx, ebx
je 0x5628ac
mov edi, dword [esp + 0x74]
cmp edi, ebx
je 0x5628ac
mov eax, dword [esp + 0x78]
mov ebp, eax
mov dword [esp + 0x18], ebx
cmp eax, 1
jb 0x562894
mov esi, dword [0x856838]
cmp ebp, esi
jae 0x5627c0
mov esi, ebp
xor bl, bl
xor al, al
mov edx, esi
sub edx, 1
mov byte [esp + 0x70], 0
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], al
je 0x56280c
sub edx, 1
je 0x5627f3
sub edx, 1
jne 0x562829
mov al, byte [edi + 2]
mov dl, al
and dl, 0x3f
shr al, 6
mov byte [esp + 0x16], dl
mov bl, al
mov al, byte [edi + 1]
mov dl, al
and dl, 0xf
add dl, dl
add dl, dl
or bl, dl
shr al, 4
mov byte [esp + 0x15], bl
mov byte [esp + 0x70], al
mov al, byte [edi]
mov bl, byte [esp + 0x15]
mov dl, al
and dl, 3
shl dl, 4
or byte [esp + 0x70], dl
shr al, 2
mov byte [esp + 0x17], al
mov al, byte [esp + 0x16]
add edi, esi
sub ebp, esi
sub esi, 1
je 0x562839
sub esi, 1
je 0x56283b
jmp 0x56283d
mov bl, 0x40
mov al, 0x40
mov esi, dword [0x856840]
movzx edx, byte [esp + 0x17]
movzx edx, byte [edx + esi]
mov byte [ecx], dl
mov esi, dword [0x856840]
movzx edx, byte [esp + 0x70]
movzx edx, byte [edx + esi]
mov byte [ecx + 1], dl
mov esi, dword [0x856840]
inc ecx
movzx edx, bl
movzx edx, byte [edx + esi]
inc ecx
mov byte [ecx], dl
mov edx, dword [0x856840]
movzx eax, al
mov al, byte [eax + edx]
inc ecx
mov byte [ecx], al
mov edx, dword [0x85683c]
add dword [esp + 0x18], edx
inc ecx
cmp ebp, 1
jae 0x5627b4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov edx, dword [str.Invalid_parameter]
mov eax, edx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5628c7
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00405920
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x6c], ebx
call fcn.00562240
push 0x84422c
lea ecx, [esp + 0x3c]
push ecx
call fcn.00564659
int3

Function at 0x564b24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x856918]
jne 0x564b2e
repz ret
jmp fcn.0056c30c
Function at 0x56e636
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056bc3b
and dword [ebp - 4], 0
cmp dword [0x86a23c], 0
mov ebx, eax
jne 0x56e6e7
push 0x7c42e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x56e798
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x56e798
push eax
call fcn.0056bbc9
mov dword [esp], 0x7c42c4
push edi
mov dword [0x86a23c], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x86a240], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x86a244], eax
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a24c], eax
test eax, eax
je 0x56e6e7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a248], eax
mov eax, dword [0x86a248]
cmp eax, ebx
je 0x56e73f
cmp dword [0x86a24c], ebx
je 0x56e73f
push eax
call fcn.0056bc44
push dword [0x86a24c]
mov esi, eax
call fcn.0056bc44
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x56e73f
test edi, edi
je 0x56e73f
call esi
test eax, eax
je 0x56e736
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x56e736
test byte [ebp - 0xc], 1
jne 0x56e73f
or dword [ebp + 0x10], 0x200000
jmp 0x56e778
mov eax, dword [0x86a240]
cmp eax, ebx
je 0x56e778
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e778
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x56e778
mov eax, dword [0x86a244]
cmp eax, ebx
je 0x56e778
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e778
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x86a23c]
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e798
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x56e79a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x577b57
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, esi
jne 0x577b64
inc esi
shr ebx, 3
neg ecx
shl ebx, 8
shr edi, 0xd
sub edx, eax
and eax, dword [0x866a1a]
xor ecx, 0xc19964cf
call fcn.006b4818
sub ebx, edi
xor ecx, ecx
sub eax, ebx
add ecx, esp
rol esi, 0x1c
ror ecx, 0x1a
shr ecx, 0x13
shl eax, 9
test edx, ebp
je 0x577b9b
inc esi
xor eax, 0x4ea6d2e5
call fcn.0045e0e0
neg edi
or esi, esp
call fcn.00648ae3
not esi
xchg edi, esi
cmp dword [0x856793], esi
jae 0x577bc1
add esi, 0x950fdd25
mov ecx, 0x3d48370b
Function at 0x577bc3
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
aaa
dec eax
cmp eax, 0x31ea1d8b
test dword [eax], eax
mov ebx, dword [0x8531ea]
mov edi, 0x30533c66
sub eax, 0x3cd4be3b
rol eax, 0x12
neg ebx
test dword [0x8511fc], esi
js 0x577bea
mov dword [0x86e9ee], eax
inc ebx
mov dword [0x86eb85], esi
not ebx
inc eax
xor edx, 0xb78d79c1
mov ebx, dword [0x85b649]
call fcn.0054e584
shr esi, 0x1d
inc edx
xor edx, ebx
or edx, 0xc316c0bb
shr ebx, 0x15
dec ecx
jne 0x577bc6
not ecx

Function at 0x577c1a
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
shr esi, 2
add edi, 0x8c2ac3df
and ebx, 0x27cef8af
xor edx, 0x869e5957
add ecx, edx
shr ecx, 0x14
mov ecx, 0x4acd9f23
Function at 0x577c39
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
dec eax
rol ebx, 0x16
xchg esi, edx
add esi, dword [0x857812]
mov dword [0x86ebbe], ebx
mov ebx, dword [0x8568bb]
rol ebx, 0xa
shl edx, 0x15
add dword [0x86eb37], edx
or esi, edx
call fcn.007913cb
xor edx, edi
not ebx
dec ecx
jne fcn.00577c39
or dword [0x86e9c3], ecx
call fcn.00526389
inc ecx
xchg ebx, esi
cmp esi, 0x78111ca7
jno 0x577c84
not ebx
dec eax
and ecx, ecx
dec ebx
rol edi, 3
mov ecx, edi
mov eax, 0xc1ccdbc8
and dword [0x86eac7], ebx
sub esi, dword [0x86ef5b]
add dword [0x86e9c8], 0xc10b2729
mov dword [0x86eb29], 0xfeb9825f
sub ebx, dword [0x86ef48]
call fcn.0077720a
ror ecx, 0xc
xor edi, edx
ror ebx, 0x12
call fcn.0062f5b2
add dword [0x86eaba], esi
or dword [0x86ec4e], edi
add dword [0x86e9c8], esi
call fcn.00515219
rol ebx, 0x12
xor edi, edx
rol ecx, 0xc
xor dword [0x86ebfc], 0x7304aae9
or dword [0x86eadc], 0x61a62728
or eax, 0xce1ee86b
or dword [0x86ebb9], eax
or edi, dword [0x86ee15]
xor dword [0x86ea23], 0xc655b108
sub edx, esi
rol esi, 0xd
neg edx
sub esi, dword [0x86ee40]
inc edi
or dword [0x86ebbd], edi
ror edi, 0xe
call fcn.005d1cc1
sub edi, dword [0x86ef12]
xchg edx, esi
inc eax
neg ecx
add ecx, 0x9d8cccf3
rol ebx, 0x10
xor eax, 0x61796c97
not edi
call fcn.0077720a
not edi
xor eax, 0x61796c97
ror ebx, 0x10
sub ecx, 0x9d8cccf3
neg ecx
dec eax
xchg edx, esi
call fcn.005fc5e4
rol edi, 0xe
xor dword [0x86eabb], ecx
dec edi
neg edx
ror esi, 0xd
add edx, esi
and dword [0x86ec57], edi
xor eax, 0xcfdefbeb
sub edx, ecx
mov dword [0x86ebbc], edi
sub edi, ecx
or eax, dword [0x86ed76]
call fcn.005c3810
and dword [0x86ea5d], edx
xor ecx, 0x6e98a1ee
xor ebx, edi
xor dword [0x86ebaf], esi
call fcn.0053e372
inc ecx
xor eax, ecx
dec esi
call fcn.005b0d09
call fcn.005f94cd
inc esi
xor eax, ecx
dec ecx
xor ebx, edi
xor ecx, 0x6e98a1ee
call fcn.004d4c1f
add edi, ecx
xor dword [0x86ec70], edx
add edx, ecx
push eax
sub esi, dword [0x86edae]
add ebx, 0x4f998c26
call fcn.006b5ba1
rol edi, 2
inc edi
neg eax
call fcn.005302df
not ebx
rol ebx, 9
call fcn.0053c887
call fcn.004fede9
call fcn.0068bfad
ror ebx, 9
not ebx
call fcn.004a5c58
neg eax
dec edi
ror edi, 2
sub ebx, 0x4f998c26
mov ebx, 0xf16da
dec eax
xor edi, esi
xor dword [0x86ebe1], 0xf7b23216
call fcn.0043c70d
or eax, dword [0x86ed3f]
sub ebx, dword [0x86edbf]
xor esi, eax
sub ecx, ebp
xor ebx, 0xc6bd5ea8
not edx
xor ebx, 0xdec91a03
and dword [0x86ea4e], esi
xor edx, ebx
inc edx
not edi
rol esi, 0x14
xor eax, edx
and dword [0x86eb2b], ebx
xor eax, edx
ror esi, 0x14
not edi
dec edx
xor edx, ebx
xor ebx, 0xdec91a03
not edx
xor ebx, 0xc6bd5ea8
add ecx, ebp
xor esi, eax
call fcn.00698fbc
sub dword [0x86e9aa], 0xfaf8fe6d
xor edi, esi
inc eax
push ebx
neg eax
call fcn.0077720a
xor edi, 0xbcd2689e
rol ecx, 3
add edx, ebp
not eax
ror edx, 0x16
xchg ecx, esi
add edi, dword [0x86eeed]
add esi, dword [0x86ecf9]
dec edi
and dword [0x86ea40], edx
Function at 0x577e5f
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
dec eax
rol ebx, 0x16
xchg esi, edx
add esi, dword [0x857812]
mov dword [0x86ebbe], ebx
mov ebx, dword [0x8568bb]
rol ebx, 0xa
shl edx, 0x15
add dword [0x86eb37], edx
or esi, edx
call fcn.007913cb
xor edx, edi
not ebx
dec ecx
jne fcn.00577c39
or dword [0x86e9c3], ecx
call fcn.00526389
inc ecx
xchg ebx, esi
cmp esi, 0x78111ca7
jno 0x577c84
not ebx
dec eax
and ecx, ecx
dec ebx
rol edi, 3
mov ecx, edi
mov eax, 0xc1ccdbc8
and dword [0x86eac7], ebx
sub esi, dword [0x86ef5b]
add dword [0x86e9c8], 0xc10b2729
mov dword [0x86eb29], 0xfeb9825f
sub ebx, dword [0x86ef48]
call fcn.0077720a
ror ecx, 0xc
xor edi, edx
ror ebx, 0x12
call fcn.0062f5b2
add dword [0x86eaba], esi
or dword [0x86ec4e], edi
add dword [0x86e9c8], esi
call fcn.00515219
rol ebx, 0x12
xor edi, edx
rol ecx, 0xc
xor dword [0x86ebfc], 0x7304aae9
or dword [0x86eadc], 0x61a62728
or eax, 0xce1ee86b
or dword [0x86ebb9], eax
or edi, dword [0x86ee15]
xor dword [0x86ea23], 0xc655b108
sub edx, esi
rol esi, 0xd
neg edx
sub esi, dword [0x86ee40]
inc edi
or dword [0x86ebbd], edi
ror edi, 0xe
call fcn.005d1cc1
sub edi, dword [0x86ef12]
xchg edx, esi
inc eax
neg ecx
add ecx, 0x9d8cccf3
rol ebx, 0x10
xor eax, 0x61796c97
not edi
call fcn.0077720a
not edi
xor eax, 0x61796c97
ror ebx, 0x10
sub ecx, 0x9d8cccf3
neg ecx
dec eax
xchg edx, esi
call fcn.005fc5e4
rol edi, 0xe
xor dword [0x86eabb], ecx
dec edi
neg edx
ror esi, 0xd
add edx, esi
and dword [0x86ec57], edi
xor eax, 0xcfdefbeb
sub edx, ecx
mov dword [0x86ebbc], edi
sub edi, ecx
or eax, dword [0x86ed76]
call fcn.005c3810
and dword [0x86ea5d], edx
xor ecx, 0x6e98a1ee
xor ebx, edi
xor dword [0x86ebaf], esi
call fcn.0053e372
inc ecx
xor eax, ecx
dec esi
call fcn.005b0d09
call fcn.005f94cd
inc esi
xor eax, ecx
dec ecx
xor ebx, edi
xor ecx, 0x6e98a1ee
call fcn.004d4c1f
add edi, ecx
xor dword [0x86ec70], edx
add edx, ecx
push eax
sub esi, dword [0x86edae]
add ebx, 0x4f998c26
call fcn.006b5ba1
rol edi, 2
inc edi
neg eax
call fcn.005302df
not ebx
rol ebx, 9
call fcn.0053c887
call fcn.004fede9
call fcn.0068bfad
ror ebx, 9
not ebx
call fcn.004a5c58
neg eax
dec edi
ror edi, 2
sub ebx, 0x4f998c26
mov ebx, 0xf16da
dec eax
xor edi, esi
xor dword [0x86ebe1], 0xf7b23216
call fcn.0043c70d
or eax, dword [0x86ed3f]
sub ebx, dword [0x86edbf]
xor esi, eax
sub ecx, ebp
xor ebx, 0xc6bd5ea8
not edx
xor ebx, 0xdec91a03
and dword [0x86ea4e], esi
xor edx, ebx
inc edx
not edi
rol esi, 0x14
xor eax, edx
and dword [0x86eb2b], ebx
xor eax, edx
ror esi, 0x14
not edi
dec edx
xor edx, ebx
xor ebx, 0xdec91a03
not edx
xor ebx, 0xc6bd5ea8
add ecx, ebp
xor esi, eax
call fcn.00698fbc
sub dword [0x86e9aa], 0xfaf8fe6d
xor edi, esi
inc eax
push ebx
neg eax
call fcn.0077720a
xor edi, 0xbcd2689e
rol ecx, 3
add edx, ebp
not eax
ror edx, 0x16
xchg ecx, esi
add edi, dword [0x86eeed]
add esi, dword [0x86ecf9]
dec edi
and dword [0x86ea40], edx