joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff94c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ffad2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5a4930], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0044f778
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0044f758
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x434]
call fcn.0043a490
mov edx, eax
mov eax, dword [0x5a7ee0]
call fcn.004a4a84
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ffaa1
mov eax, dword [ebp - 0xc]
call fcn.004a48bc
dec eax
test eax, eax
jl 0x4ffa45
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0044f67c
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a48ec
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0044f2fc
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a4908
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a4978
mov edx, eax
xor dl, 1
mov eax, dword [ebp - 8]
call fcn.0044f29c
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4ff9d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0044f6b8
test eax, eax
jle 0x4ffaa1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.0044f6e8
mov cl, 1
mov edx, 3
call fcn.0044f40c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.0044f6e8
mov cl, 1
mov edx, 2
call fcn.0044f40c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0044f954
mov byte [0x5a4930], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffad9
lea eax, [ebp - 0x1c]
call fcn.00403a10
ret
Function at 0x502a54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x502c03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x244]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [0x5a5e68]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [0x5a5e68]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x50], 0x40
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x14], edx
mov eax, dword [0x5a4a24]
sub eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 0xc]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, dword [ebp + 0xc]
imul dword [edx + 0x50]
mov edx, dword [ebp + 0xc]
add eax, dword [edx + 0x50]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x38], 0x15
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
dec eax
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x34], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x40], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x44], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x48], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
dec eax
mov edx, dword [ebp + 0xc]
imul dword [edx + 0x50]
add eax, dword [ebp + 8]
dec eax
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x50]
cdq
idiv ecx
mov edx, dword [ebp + 0xc]
imul dword [edx + 0x50]
mov edx, dword [ebp + 0xc]
add eax, dword [edx + 0x50]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x58], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x54], edx
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x5c], 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
call fcn.00532bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502c0a
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dl, 1
call fcn.004239ac
mov eax, dword [0x5a4a30]
mov dword [0x5a4a48], eax
mov eax, dword [0x5a4a30]
add eax, dword [0x5a4a28]
mov dword [0x5a4a50], eax
mov eax, dword [0x5a4a48]
cmp eax, dword [0x5a4a50]
jne 0x502be0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x260]
mov edx, 2
call fcn.0042347c
jmp 0x502bfa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x260]
call fcn.0042347c
mov eax, dword [ebp - 4]
call fcn.005028d4
ret
Function at 0x50ff08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e40
xor eax, eax
push ebp
push 0x510097
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x510051
mov eax, dword [ebp - 8]
call fcn.004026a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x51004a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x50fff7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00402b14
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x50ffbd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea ecx, [eax + 0x240]
mov eax, dword [ebp - 0x14]
movzx edx, word [eax]
mov eax, dword [ebp - 0x10]
call fcn.00534ebc
jmp 0x50ffed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov eax, dword [eax + 0x154]
mov edx, 0x5100b0
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x510031
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510081
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004026c0
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov eax, dword [eax + 0x154]
mov edx, 0x5100f8
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51009e
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x522730
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x5a8054]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x28]
sub eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
sub eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
cmp byte [ebp - 5], 0
je 0x522844
mov eax, dword [ebp - 0x14]
sar eax, 1
jns 0x52279c
adc eax, 0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
sar eax, 1
jns 0x5227ac
adc eax, 0
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5a80d8], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5a80dc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5a80f0], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5a80f4], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5a8108], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5a810c], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5a8120], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5a8124], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x5a8138], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5a813c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x5a8150], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5a8154], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5a8168], eax
mov eax, dword [ebp - 0x20]
mov dword [0x5a816c], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5a8180], eax
mov eax, dword [ebp - 0x20]
mov dword [0x5a8184], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80e4]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80e0]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80dc]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80d8]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80d0]
push eax
call sub.user32.dll_MoveWindow
cmp byte [ebp - 5], 0
je 0x5228b3
push 5
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80d0]
push eax
call sub.user32.dll_ShowWindow
jmp 0x5228c8
push 0
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5a80d0]
push eax
call sub.user32.dll_ShowWindow
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
jl 0x522849
mov esp, ebp
pop ebp
ret
Function at 0x5236a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e40
mov eax, dword [ebp - 8]
call fcn.00403e40
xor eax, eax
push ebp
push 0x5237a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x55
call fcn.004026a8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x54
call fcn.00402b14
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], eax
mov al, byte [ebp + 8]
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x34], al
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5a806c]
call fcn.0040e090
mov edx, dword [ebp - 8]
mov eax, dword [0x5a8070]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 4]
mov eax, dword [0x5a8074]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 4]
mov eax, dword [0x5a8078]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5237ae
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a34
ret
Function at 0x52addc
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
or edi, 0xffffffff
cmp edx, 0x40
jl 0x52ae35
mov ecx, eax
cmp word [ecx], 0x5a4d
jne 0x52ae35
mov ecx, eax
mov esi, dword [ecx + 0x3c]
mov ebx, esi
add ebx, 0x78
cmp edx, ebx
jl 0x52ae35
add eax, esi
mov ecx, dword [eax]
mov edx, ecx
and edx, 0xffff
cmp edx, 0x454e
jne 0x52ae19
mov edi, 0xca
jmp 0x52ae35
cmp edx, 0x454c
jne 0x52ae28
mov edi, 0xc9
jmp 0x52ae35
cmp ecx, 0x4550
jne 0x52ae35
mov edi, 0xc8
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x5413e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5414c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [0x5a5e68]
mov eax, dword [eax + 0x34]
mov dword [ebx + 0x24], eax
mov eax, dword [0x5a5e68]
mov eax, dword [eax + 0x38]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x50], 0x40
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], edi
mov ecx, dword [ebx + 0x50]
mov eax, esi
cdq
idiv ecx
imul ecx
add eax, ecx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], edi
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
dec eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x4c], eax
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x50]
cdq
idiv ecx
imul ecx
add eax, ecx
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x54], eax
mov byte [ebx + 0x5c], 1
mov edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00532bfc
xor eax, eax
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x38]
dec eax
imul dword [ebx + 0x50]
dec eax
mov dword [ebx + 0x4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5414cb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.004239ac
ret

Function at 0x543ea4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor ebx, ebx
push ebp
push 0x544015
push dword fs:[ebx]
mov dword fs:[ebx], esp
push ecx
push 0
push 0
push edx
push 0
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja case.0x543ed5.0
mov al, byte [eax + 0x543edc]
jmp dword [eax*4 + 0x543efd]
lea eax, [ebp - 4]
mov edx, 0x544028
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x544054
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x544080
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x5440cc
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x544110
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x54414c
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x5441b8
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x5441dc
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x544230
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x54426c
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x5442bc
call fcn.00403aa8
jmp 0x543fec
lea eax, [ebp - 4]
mov edx, 0x5442fc
call fcn.00403aa8
push 0
mov cx, word [0x54431c]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00440904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54401c
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x5475fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
pushal
mov ecx, edx
dec ecx
test ecx, ecx
jl 0x54765c
inc ecx
mov dword [ebp - 4], 0x136c9856
mov dword [ebp - 8], 0x9abfb3b6
mov dword [ebp - 0xc], 0x7f6a0dbb
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
rol eax, 7
rol edx, 0x1b
xor eax, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 0xc]
xor eax, ebx
push ecx
mov ecx, eax
rol ebx, cl
pop ecx
ror eax, 0xf
xor edx, eax
xor edx, ebx
push ecx
mov ecx, edx
ror ebx, cl
pop ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov ebx, dword [ebp - 4]
xor bl, byte [esi]
mov byte [esi], bl
inc esi
dec ecx
jne 0x547622
popal
mov esp, ebp
pop ebp
ret

Function at 0x57a4b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x57a4f4
pushal
mov esi, dword [ebp - 4]
mov edi, 0x5a539c
mov ecx, dword [ebp - 8]
mov edx, 0xffffffff
cld
xor eax, eax
lodsb al, byte [esi]
xor eax, edx
and eax, 0xff
mov eax, dword [edi + eax]
shr edx, 8
and edx, 0xffffff
xor edx, eax
loop 0x57a4d4
mov dword [ebp - 0xc], edx
popal
jmp 0x57a4f9
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x57a500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x3fff
mov eax, 0x5a83d0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402b14
xor eax, eax
push ebp
push 0x57a58e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x57a584
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push esi
mov esi, 0x5a83d0
mov edx, dword [0x5a5860]
xor edx, 0xf455ff
xor esi, edx
mov eax, dword [ebp - 4]
or eax, 2
mov edx, eax
xor edx, 1
mul dx
shr eax, 8
and eax, 0xff
mov ecx, dword [ebp - 4]
shr ecx, 2
mov byte [esi + ecx], al
add dword [ebp - 4], 4
pop esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x57a544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57a598
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57c3a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x5a58d0], 0x6e
push 0x40
push 0x1000
mov eax, dword [0x5a58d0]
add eax, 0x10
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5a58c8], eax
mov edx, dword [0x5a58d0]
add edx, 0x10
mov eax, dword [0x5a58c8]
xor ecx, ecx
call fcn.00402b14
mov dword [ebp - 4], 0x57a098
mov ecx, dword [0x5a58d0]
dec ecx
mov edx, dword [0x5a58c8]
mov eax, dword [ebp - 4]
call fcn.004027e0
mov dword [0x5a58d4], 0x22c
push 0x40
push 0x1000
mov eax, dword [0x5a58d4]
add eax, 0x10
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5a58cc], eax
mov edx, dword [0x5a58d4]
add edx, 0x10
mov eax, dword [0x5a58cc]
xor ecx, ecx
call fcn.00402b14
mov dword [ebp - 4], 0x57a108
mov ecx, dword [0x5a58d4]
dec ecx
mov edx, dword [0x5a58cc]
mov eax, dword [ebp - 4]
call fcn.004027e0
pop ecx
pop ebp
ret
Function at 0x57c464
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x57c47f
add esp, 0xfffffff0
call fcn.004030f4
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57c6d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415c04
mov eax, dword [ebp - 4]
mov byte [eax + 0x25c], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x23c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x240], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x244], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x248], edx
xor eax, eax
mov dword [0x5a5838], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x27c], 0
xor eax, eax
mov dword [0x5ac758], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x238], edx
mov eax, dword [0x5a5f5c]
mov eax, dword [eax]
call fcn.00581908
mov dword [0x5a5860], 0xf455ff
mov dword [0x5a5864], 0x4d3412
mov dword [0x5a5868], 0xa502f3bc
mov dword [0x5a586c], 0x4d3412
mov dword [0x5a5870], 0xa502f3bc
lea eax, [ebp - 0x1c]
call fcn.00403a10
mov dword [ebp - 0x14], 0x340
push 0x40
push 0x1000
mov eax, dword [ebp - 0x14]
add eax, 0x10
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x238], eax
mov edx, dword [ebp - 0x14]
add edx, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
xor ecx, ecx
call fcn.00402b14
mov edx, 0x57c597
lea eax, [ebp - 0x1c]
call fcn.00403a64
jmp 0x57c628
mov dword [ebp - 0x10], 0x56fab8
mov eax, dword [ebp - 0x1c]
push eax
mov cx, word [ebp - 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x238]
mov eax, dword [ebp - 0x10]
call fcn.0057a5a8
mov dword [0x5ac6f0], 0x3c
push 0x40
push 0x1000
mov eax, dword [0x5ac6f0]
add eax, 0x10
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5a5834], eax
mov edx, dword [0x5ac6f0]
add edx, 0x10
mov eax, dword [0x5a5834]
xor ecx, ecx
call fcn.00402b14
mov dword [ebp - 0x10], 0x57a05c
mov ecx, dword [0x5ac6f0]
dec ecx
mov edx, dword [0x5a5834]
mov eax, dword [ebp - 0x10]
call fcn.004027e0
cmp dword [0x5a58c8], 0
jne 0x57c6b6
cmp dword [0x5a58cc], 0
jne 0x57c6b6
call fcn.0057c3a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57c6db
lea eax, [ebp - 0x28]
call fcn.00403a10
lea eax, [ebp - 0x1c]
call fcn.00403a10
ret