joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5439ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ecx + 9]
xor edx, edx
shr eax, 2
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0xc]
push esi
movzx esi, byte [ecx + 0xa]
mov dword [ebp - 0x14], eax
add eax, 0xffffc000
push edi
mov edi, dword [ecx + 8]
shl eax, 5
shr edi, 3
shr esi, 3
and edi, 0x1f
cmp dword [ecx + 0x14], 1
mov dword [ebp - 0x18], eax
push 0x1f
pop eax
cmovne eax, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ecx + 0x14], 1
mov dword [ebp - 0x20], edi
setne al
xor ebx, ebx
dec eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], edx
jle 0x543b62
mov eax, dword [ebp + 8]
movzx eax, word [eax + ebx*2]
movzx edx, ax
mov dword [ebp - 0x1c], eax
mov eax, edx
shr eax, 0xb
sub eax, esi
mov esi, eax
neg esi
test eax, eax
cmovns esi, eax
mov eax, edx
shr eax, 5
and eax, 0x3f
sub eax, dword [ebp - 8]
mov ecx, eax
neg ecx
test eax, eax
cmovns ecx, eax
and edx, 0x1f
sub edx, edi
sar ecx, 1
mov eax, edx
neg eax
test edx, edx
cmovns eax, edx
cmp ecx, eax
cmovge eax, ecx
cmp esi, eax
cmovge eax, esi
xor eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov esi, eax
sar esi, 4
add esi, eax
imul esi, dword [ebp - 0x14]
sub esi, dword [ebp - 0x18]
add esi, 0x2000
sar esi, 0xe
test esi, esi
jle 0x543b4f
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x543ae3
movzx eax, byte [edx]
mov ecx, eax
shr ecx, 7
add ecx, eax
imul esi, ecx
shr esi, 8
inc edx
mov dword [ebp + 0x14], edx
test esi, esi
je 0x543b4f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
movzx eax, ax
mov edi, eax
shl esi, 3
mov ebx, dword [ecx + ebx*4]
and edi, 0x1f
mov ecx, eax
mov edx, ebx
shr eax, 0xb
shr edx, 0x13
and edx, 0x1f
shr ecx, 5
sub edx, eax
and ecx, 0x3f
imul edx, esi
sar edx, 8
add edx, eax
mov eax, ebx
shr eax, 0xa
and eax, 0x3f
shr ebx, 3
sub eax, ecx
shl edx, 0xb
and ebx, 0x1f
imul eax, esi
sub ebx, edi
imul ebx, esi
sar eax, 8
add eax, ecx
shl eax, 5
sar ebx, 8
or edx, eax
mov eax, dword [ebp + 8]
add ebx, edi
mov edi, dword [ebp - 0x20]
or edx, ebx
mov ebx, dword [ebp - 4]
mov word [eax + ebx*2], dx
jmp 0x543b52
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp + 0x10]
jl 0x543a54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x543b6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ecx + 0xa]
xor edx, edx
mov dword [ebp - 0xc], eax
movzx eax, byte [ecx + 9]
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0xc]
push ebx
push edi
mov dword [ebp - 0x1c], eax
lea edi, [eax - 0x4000]
mov eax, 0xff
shl edi, 8
cmp dword [ecx + 0x14], 1
mov dword [ebp - 0x24], edi
cmovne eax, edx
xor ebx, ebx
cmp dword [ecx + 0x14], 1
mov dword [ebp - 0x18], eax
setne bl
dec ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp + 0x10], edx
jle 0x543d01
push esi
mov esi, dword [ebp + 8]
sub dword [ebp + 0xc], esi
mov edx, dword [esi]
mov eax, edx
shr eax, 0x10
movzx eax, al
sub eax, dword [ebp - 0xc]
mov esi, eax
mov dword [ebp - 8], edx
neg esi
test eax, eax
cmovns esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
sub eax, dword [ebp - 0x10]
mov ecx, eax
neg ecx
test eax, eax
cmovns ecx, eax
movzx eax, dl
sub eax, dword [ebp - 0x14]
mov edx, eax
neg edx
test eax, eax
cmovns edx, eax
cmp ecx, edx
cmovge edx, ecx
cmp esi, edx
cmovge edx, esi
xor edx, ebx
sub edx, ebx
add edx, dword [ebp - 0x18]
mov ebx, edx
shr ebx, 7
add ebx, edx
imul ebx, dword [ebp - 0x1c]
sub ebx, edi
add ebx, 0x2000
sar ebx, 0xe
mov dword [ebp - 4], ebx
test ebx, ebx
jle 0x543cea
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x543c5c
movzx eax, byte [edx]
mov ecx, eax
shr ecx, 7
add eax, ecx
imul eax, ebx
shr eax, 8
inc edx
mov dword [ebp - 4], eax
mov dword [ebp + 0x14], edx
test eax, eax
je 0x543cea
mov ecx, dword [ebp - 8]
mov ebx, ecx
mov esi, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx ecx, al
mov eax, dword [ebp - 8]
movzx edi, al
mov eax, dword [ebp + 8]
shr ebx, 0x18
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + eax]
shr eax, 8
movzx esi, al
mov eax, dword [ebp + 8]
sub esi, ecx
imul esi, dword [ebp - 4]
sar esi, 8
add esi, ecx
mov ecx, dword [ebx + eax]
mov eax, ecx
shl esi, 8
shr eax, 0x10
movzx eax, al
sub eax, edx
imul eax, dword [ebp - 4]
sar eax, 8
add eax, edx
shl eax, 0x10
or esi, eax
mov eax, ecx
shr eax, 0x18
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 4]
sar eax, 8
add eax, dword [ebp - 0x20]
shl eax, 0x18
or esi, eax
movzx eax, cl
sub eax, edi
imul eax, dword [ebp - 4]
sar eax, 8
add eax, edi
mov edi, dword [ebp - 0x24]
or esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x28]
add esi, 4
sub dword [ebp + 0x10], 1
mov dword [ebp + 8], esi
jne 0x543bc8
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x54770e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x14
mov dword [ebp - 8], edi
lea esi, [edi + 0x5c]
sub ebx, esi
pop edi
movss xmm0, dword [ebx + esi]
mulss xmm0, dword [0x5f9034]
cvttss2si eax, xmm0
mov dword [esi], eax
lea esi, [esi + 4]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
cmovge eax, ecx
mov ecx, eax
sub edi, 1
jne 0x547728
test ecx, ecx
je 0x54775e
bsr eax, ecx
mov dword [ebp + 8], eax
xor eax, 0x1f
jmp 0x547761
push 0x20
pop eax
mov edi, dword [ebp - 8]
mov edx, 0x10000
push 0x10
pop ebx
push 9
pop ecx
mov dword [edi + 0xac], ebx
cmp eax, ecx
jge 0x5477a3
sub ecx, eax
mov eax, ebx
sub eax, ecx
mov dword [edi + 0xac], eax
xor eax, eax
movd xmm1, ecx
movups xmm0, xmmword [edi + eax*4 + 0x5c]
psrad xmm0, xmm1
movups xmmword [edi + eax*4 + 0x5c], xmm0
add eax, 4
cmp eax, 0x14
jl 0x54778b
sar edx, cl
mov ecx, dword [edi + 0xa4]
mov eax, dword [edi + 0x90]
sub ecx, edx
or ecx, dword [edi + 0xa0]
or ecx, dword [edi + 0x9c]
or ecx, dword [edi + 0x98]
or eax, dword [edi + 0x7c]
or ecx, dword [edi + 0xa8]
or eax, dword [edi + 0x68]
or eax, ecx
mov ebx, dword [edi + 0xac]
je 0x5477fe
cmp ebx, 0x10
mov eax, 0x5470eb
mov edx, 0x547071
cmove eax, edx
mov dword [edi + 0x58], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [edi + 0xb0], eax
jmp 0x54787e
mov dword [edi + 0xb0], 3
mov ecx, dword [edi + 0x8c]
mov eax, dword [edi + 0x74]
sub ecx, edx
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x5c]
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x88]
or eax, dword [edi + 0x84]
or eax, dword [edi + 0x78]
or eax, dword [edi + 0x70]
or eax, dword [edi + 0x64]
or eax, dword [edi + 0x60]
je 0x547844
mov eax, 0x546f9e
mov ecx, 0x546f42
jmp 0x54786f
test ecx, ecx
je 0x547854
mov eax, 0x5471bb
mov ecx, 0x54717c
jmp 0x54786f
mov eax, dword [edi + 0x94]
or eax, dword [edi + 0x80]
or eax, dword [edi + 0x6c]
je 0x54787a
mov eax, 0x546f0c
mov ecx, 0x546ede
cmp ebx, 0x10
cmove eax, ecx
mov dword [edi + 0x58], eax
jmp 0x54787e
and dword [edi + 0x58], 0
cmp dword [edi + 0x58], 0
je 0x5478a1
xor eax, eax
lea ecx, [ebx - 1]
inc eax
shl eax, cl
add dword [edi + 0x6c], eax
add dword [edi + 0x80], eax
add dword [edi + 0x94], eax
add dword [edi + 0xa8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x54c05c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push esi
push edi
test ebx, ebx
je 0x54c0fa
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x54c1b0
movzx edi, byte [esi + ebx]
test edi, edi
je 0x54c0ef
mov eax, dword [ebp + 8]
movzx eax, word [eax + esi*2]
push eax
call fcn.0054bfc4
push dword [ebp - 4]
mov dword [ebp + 0x14], eax
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + esi*4]
call fcn.0054bf50
add esp, 0x10
mov edx, eax
cmp edi, 0xff
jae 0x54c0c9
mov ecx, edi
shr ecx, 7
add ecx, edi
push ecx
push dword [ebp + 0x14]
push edx
call fcn.0054bf50
add esp, 0xc
mov edx, eax
mov ecx, edx
mov eax, edx
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edx, 3
or ecx, eax
and edx, 0x1f
mov eax, dword [ebp + 8]
or ecx, edx
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x54c07f
jmp 0x54c1b0
xor edi, edi
mov dword [ebp + 0x14], edi
cmp dword [ebp + 0x10], edi
jle 0x54c1b0
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.0054bfc4
mov esi, eax
mov eax, dword [ebp + 0xc]
pop ecx
mov edx, dword [eax + edi*4]
mov edi, esi
shr edi, 8
mov ecx, edx
shr ecx, 8
mov eax, 0xffff00ff
and ecx, eax
and edi, eax
imul ecx, dword [ebp - 4]
mov eax, edx
imul edi, ebx
and eax, 0xff00ff
imul eax, dword [ebp - 4]
shr edx, 8
add edi, ecx
mov ecx, esi
and ecx, 0xff00ff
shr esi, 8
imul ecx, ebx
add ecx, eax
mov eax, 0xff00ff
and esi, eax
shr ecx, 8
and edx, eax
imul esi, ebx
imul edx, dword [ebp - 4]
xor edi, ecx
and edi, eax
add esi, edx
xor edi, esi
mov ecx, edi
mov eax, edi
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edi, 3
or ecx, eax
and edi, 0x1f
mov eax, dword [ebp + 8]
or ecx, edi
mov edi, dword [ebp + 0x14]
mov word [eax + edi*2], cx
inc edi
mov dword [ebp + 0x14], edi
cmp edi, dword [ebp + 0x10]
jl 0x54c112
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x54c1b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ecx + 8]
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test edx, edx
je 0x54c22d
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x54c2c1
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
movzx ebx, byte [edi + edx]
test ebx, ebx
je 0x54c21f
push ecx
push dword [esi]
push dword [eax + esi]
call fcn.0054bf50
add esp, 0xc
cmp ebx, 0xff
jae 0x54c214
mov ecx, ebx
shr ecx, 7
add ecx, ebx
push ecx
push dword [esi]
push eax
call fcn.0054bf50
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 8]
inc edi
add esi, 4
cmp edi, dword [ebp + 0x10]
jl 0x54c1e3
jmp 0x54c2c1
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x54c2c1
mov edx, dword [ebp + 0xc]
mov eax, 0x100
sub eax, ecx
mov ecx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], edx
mov edx, dword [ecx + edx]
mov edi, dword [ecx]
mov esi, edi
shr esi, 8
mov ecx, 0xffff00ff
and esi, ecx
imul esi, eax
mov eax, edx
shr eax, 8
and eax, ecx
mov ecx, edi
imul eax, dword [ebp - 4]
and ecx, 0xff00ff
imul ecx, dword [ebp + 0x10]
shr edi, 8
add esi, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
xor esi, ecx
mov ecx, 0xff00ff
and edi, ecx
and edx, ecx
imul edx, dword [ebp - 4]
and esi, ecx
mov ecx, dword [ebp + 0x14]
imul edi, eax
add edi, edx
mov edx, dword [ebp + 8]
xor esi, edi
mov dword [ecx], esi
add ecx, 4
mov dword [ebp + 0x14], ecx
sub ebx, 1
jne 0x54c250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5693dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0xc]
inc ecx
mov eax, ecx
xor eax, esi
cmp eax, 3
cmove eax, ecx
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 3
jl 0x5693f1
mov eax, dword [ebp - 0xc]
movsd xmm1, qword [ebx + 8]
push ecx
push ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
mov eax, dword [ebp - 8]
subsd xmm1, xmm4
movsd qword [ebp - 0x24], xmm3
movsd qword [ebp - 0x14], xmm4
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
mulsd xmm1, xmm0
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [ebx]
subsd xmm0, xmm3
movsd qword [ebp - 0x2c], xmm2
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x34], xmm1
movsd qword [esp], xmm1
call fcn.00510e92
pop ecx
pop ecx
test al, al
jne 0x5694cf
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
cmp eax, 3
jge 0x5694e5
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
subsd xmm1, qword [ebp - 0x14]
subsd xmm0, qword [ebp - 0x24]
mulsd xmm1, qword [ebp - 0x1c]
mulsd xmm0, qword [ebp - 0x2c]
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, qword [ebp - 0x34]
comisd xmm0, xmmword [0x5de318]
jbe 0x5694c9
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.0051a8c0
pop ecx
pop ecx
test al, al
je 0x5694cf
mov eax, dword [ebp - 4]
inc eax
add edi, 0x10
jmp 0x569479
inc esi
add ebx, 0x10
cmp esi, 3
jl 0x5693eb
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
jmp 0x5694de
Function at 0x56b3b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x56b3d1
xor ecx, ecx
cmp ecx, 3
jge 0x56b513
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x5de318]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x56b44f
ucomisd xmm2, qword [0x5de318]
lahf
test ah, 0x44
jnp 0x56b3e8
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.00510e92
pop ecx
pop ecx
test al, al
jne 0x56b502
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x5de318]
jbe 0x56b4ee
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.0051a8c0
pop ecx
pop ecx
test al, al
je 0x56b502
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x56b49a
mov ecx, dword [ebp - 0x18]
jmp 0x56b3e8
inc esi
add edi, 0x10
cmp esi, 4
jl 0x56b3cb
xor al, al
jmp 0x56b515
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426a9d
mov esp, ebp
pop ebp
ret

Function at 0x56ec29
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x56ec63
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x56ec42
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x56ec8e
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x56ec81
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x586497
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00591ea1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5864c4
xor eax, eax
jmp 0x5865c0
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x493cc6
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.00587542
push esi
push eax
call fcn.00493ce0
add esp, 0x14
test eax, eax
je 0x5864ff
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0059204c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00587524
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00588c43
add esp, 0x28
test eax, eax
jne 0x586536
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x586577
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0059201d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x586572
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x5865a7
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.00591f72
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.00591f2a
add esp, 0x14
jmp 0x5864bd
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.00591df0
push dword [ebp - 4]
call fcn.0058666a
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5889e9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x588a1f
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x588a12
push eax
call fcn.00591f16
push 2
call fcn.00591e8d
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.00492030
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x589e14
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00591ea1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x589e41
xor eax, eax
jmp 0x589fe5
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x493cc6
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.00587542
push esi
push eax
call fcn.00493ce0
add esp, 0x14
test eax, eax
je 0x589e8e
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0059204c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00587524
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00588c43
add esp, 0x28
test eax, eax
jne 0x589ec5
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x589f01
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0059201d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x589f01
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x588d15
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.00588d64
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x589f81
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.00599492
add esp, 0xc
cmp eax, 0xfffffffa
je 0x589f6a
cmp eax, 0xfffffffc
je 0x589f63
cmp eax, 0xfffffffe
je 0x589f5c
test eax, eax
je 0x589f7c
push str.Unknown_zlib_error
jmp 0x589f6f
push str.zlib_stream_error
jmp 0x589f6f
push str.zlib_memory_error
jmp 0x589f6f
push str.zlib_version_error
push dword [ebp - 4]
call fcn.0058755e
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x589fb1
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.00591f72
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.00591f2a
add esp, 0x14
jmp 0x589e3a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.0058ede8
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x597a97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x597b33
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00491ab0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x597ae8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x597b0f
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x597c58
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x597b60
xor eax, eax
jmp 0x597bac
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x597b7d
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.0059b14d
jmp 0x597b8d
cmp eax, 2
jne 0x597b96
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.00599663
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.00491ab0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x597bd4
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x597be9
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x597aa5
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x597c58
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x597c28
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.00492030
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x597c58
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x597c58
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.00492030
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret