joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555a18
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov esi, edx
mov edi, ecx
dec edi
test edi, edi
jl 0x555aaa
inc edi
movzx eax, word [ebp - 0xc]
and ax, 0xffff
or ax, 2
movzx ebx, byte [esi]
movzx edx, ax
xor ax, 1
movzx eax, ax
imul edx, eax
shr edx, 8
xor dl, bl
mov byte [ebp - 5], dl
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004e8dac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0xff
add dword [ebp - 0x10], eax
imul ebx, dword [ebp - 0x10], 0x8088405
inc ebx
mov dword [ebp - 0x10], ebx
mov edx, ebx
shr edx, 0x18
mov eax, dword [ebp - 0xc]
call fcn.004e8dac
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 5]
mov byte [esi], al
inc esi
dec edi
jne 0x555a49
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555c34
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
jne 0x555c61
mov ecx, 0x3ab
mov edx, 0x555d0c
mov eax, 0x555d54
call fcn.00407a60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
mov esi, ebx
dec edi
test edi, edi
jl 0x555cdc
inc edi
movzx eax, word [ebp - 8]
and ax, 0xffff
or ax, 2
movzx ebx, ax
xor ax, 1
movzx eax, ax
imul ebx, eax
shr ebx, 8
xor bl, byte [esi]
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.004e8dac
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0xff
add dword [ebp - 0xc], eax
imul eax, dword [ebp - 0xc], 0x8088405
inc eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
shr edx, 0x18
mov eax, dword [ebp - 8]
call fcn.004e8dac
mov dword [ebp - 8], eax
mov byte [esi], bl
inc esi
dec edi
jne 0x555c84
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x555dec
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.00555578
mov dword [ebp - 8], 0xc
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x15]
movzx eax, word [ebx + 0xc]
and ax, 0xffff
or ax, 2
movzx edx, ax
xor ax, 1
movzx eax, ax
imul edx, eax
shr edx, 8
xor dl, byte [esi]
mov byte [ebp - 9], dl
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.004e8dac
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.004e8dac
mov dword [ebx + 0xc], eax
movzx eax, byte [ebp - 9]
mov byte [edi], al
inc edi
inc esi
dec dword [ebp - 8]
jne 0x555e10
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 0xa]
sete al
mov byte [ebx + 0x10], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x55d7d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0052dcc0
mov ebx, eax
mov eax, ebx
call fcn.0050772c
mov byte [ebp - 0x11], al
mov eax, ebx
call fcn.005076e8
mov byte [ebp - 0x12], al
mov eax, ebx
call fcn.005076a4
mov byte [ebp - 0x13], al
cmp byte [ebp - 0x11], 0
jne 0x55d820
cmp byte [ebp - 0x12], 0
jne 0x55d820
cmp byte [ebp - 0x13], 0
jne 0x55d820
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x55d938
mov eax, ebx
call fcn.005075fc
mov byte [ebp - 0x14], al
mov eax, ebx
call fcn.005075a4
mov ebx, eax
mov dl, 1
mov eax, dword [0x458618]
call fcn.004060b0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x55d931
push dword fs:[edx]
mov dword fs:[edx], esp
mov al, 1
call fcn.0051228c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x55d8ee
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
call fcn.00515a94
mov esi, eax
dec esi
test esi, esi
jl 0x55d8d3
inc esi
xor edi, edi
push ebp
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
push ebx
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00515a9c
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0055d738
pop ecx
test al, al
je 0x55d8cf
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00515a9c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x55d8cf
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00515a9c
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00462ad4
inc edi
dec esi
jne 0x55d87a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d8f5
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.004060e0
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55d944
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test eax, eax
je 0x55d9a3
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x55d99c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x55d981
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00462cd0
push eax
call sub.kernel32.dll_ResumeThread
inc esi
dec ebx
jne 0x55d96d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d9a3
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], edx
call fcn.004060e0
ret
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x567f80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x567f9e
mov byte [ebp - 5], 1
jmp 0x568076
mov byte [ebp - 5], 0
mov esi, dword [ebp - 4]
cmp esi, 0x10000
jb 0x568076
cmp esi, ebx
jb 0x568076
mov eax, esi
sub eax, ebx
cmp eax, 0x7ffffffe
jge 0x568076
mov edx, esi
sub edx, ebx
inc edx
mov eax, ebx
call fcn.00412398
test al, al
je 0x568076
xor eax, eax
push ebp
push 0x56806c
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x568056
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, ebx
call fcn.0041b2ec
cmp byte [ebp - 0x4f], 0
je 0x568003
cmp ebx, dword [ebp - 0x54]
jne 0x56800d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568076
mov ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x48]
cmp esi, 0xcc
je 0x56804c
cmp esi, 0xc2
je 0x56804c
cmp esi, 0xc3
je 0x56804c
cmp byte [ebp - 0x35], 0
je 0x568056
mov edi, dword [ebp - 0x48]
cmp edi, 0xe9
je 0x56804c
cmp edi, 0xe8
je 0x56804c
cmp edi, 0xff
jne 0x568056
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568076
mov eax, dword [ebp - 4]
dec eax
cmp eax, ebx
ja 0x567fec
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568076
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x572a90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x572b38
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00412734
mov ebx, eax
test bl, bl
jne 0x572b1d
mov bl, 1
push 2
lea eax, [ebp - 4]
push eax
push 0x572b48
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
ja 0x572b1d
push 2
lea eax, [ebp - 4]
push eax
push 0x572b78
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
ja 0x572b1d
call fcn.00404d88
mov esi, eax
test esi, esi
jle 0x572b1b
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404de8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00441234
mov eax, dword [ebp - 8]
mov edx, 0x572ba8
call fcn.00408d58
je 0x572b1d
inc dword [ebp - 4]
dec esi
jne 0x572af0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572b3f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407c88
ret

Function at 0x572d0c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
call fcn.004131c4
test al, al
jne 0x572da4
cmp dword [0x69c700], 0
je 0x572da4
mov eax, dword [0x5957f0]
cmp byte [eax], 0
je 0x572d39
mov eax, 0x572db4
call fcn.0042a418
mov eax, dword [0x69c700]
call fcn.0046f114
mov eax, dword [0x598c38]
call fcn.0042a2dc
test al, al
jne 0x572d7b
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x595c70]
cmp eax, dword [edx]
jne 0x572d6f
mov eax, dword [0x69c700]
mov eax, dword [eax + 4]
call fcn.00572cb0
jmp 0x572d92
mov eax, dword [0x69c700]
call fcn.0046f138
jmp 0x572d92
push 0x64
call sub.kernel32.dll_Sleep_2
push 1
mov eax, dword [0x69c700]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x69c700]
xor edx, edx
mov dword [0x69c700], edx
call fcn.004060e0
pop ebp
ret
Function at 0x574b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x574cc6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004049f8
mov ebx, eax
call fcn.00404a18
mov esi, eax
mov eax, dword [0x595b08]
xor edx, edx
mov dword [eax], edx
cmp esi, 0x1000
jb 0x574b3c
cmp esi, 0x80808080
jne 0x574b40
mov al, 1
jmp 0x574b56
mov eax, ebx
cmp eax, 0x1000
jb 0x574b54
cmp eax, 0x80808080
je 0x574b54
xor eax, eax
jmp 0x574b56
mov al, 1
test al, al
je 0x574b5e
mov al, 1
jmp 0x574b67
mov eax, ebx
call fcn.00412518
xor al, 1
test al, al
je 0x574b82
call fcn.00404a38
test eax, eax
je 0x574cb0
call fcn.00404a6c
jmp 0x574cb0
mov eax, dword [0x5957f0]
cmp byte [eax], 0
je 0x574ba4
mov eax, 0x574ce0
call fcn.0042a418
mov eax, ebx
call fcn.0042a600
mov eax, esi
call fcn.0042a600
mov eax, dword [0x595584]
xor edx, edx
mov dword [eax], edx
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00578d70
test al, al
jne 0x574bf5
mov eax, ebx
mov edx, dword [0x43c378]
call fcn.004062f8
test al, al
je 0x574bf5
cmp dword [ebx + 4], 0
je 0x574bf5
push 0
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00405fd8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov ecx, 0x2010
call fcn.0042a040
mov eax, dword [0x595584]
cmp dword [eax], 0
je 0x574c10
mov eax, dword [0x595584]
cmp dword [eax], 0x103
jne 0x574c9d
mov eax, ebx
mov edx, dword [0x43d100]
call fcn.004062f8
test al, al
je 0x574c36
cmp dword [ebx + 0x18], 0
je 0x574c36
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [0x595584]
mov dword [edx], eax
jmp 0x574c7b
mov eax, ebx
mov edx, dword [0x43dfb8]
call fcn.004062f8
test al, al
je 0x574c70
mov eax, dword [ebx + 0x18]
test eax, eax
jns 0x574c53
call fcn.00405fc0
test eax, eax
je 0x574c66
and eax, 0xffff
or eax, 0x70000
or eax, 0x80000000
mov edx, dword [0x595584]
mov dword [edx], eax
jmp 0x574c7b
mov eax, dword [0x595584]
mov dword [eax], 0xeedfade
mov eax, dword [0x595584]
cmp dword [eax], 0
je 0x574c92
mov eax, dword [0x595584]
cmp dword [eax], 0x103
jne 0x574c9d
mov eax, dword [0x595584]
mov dword [eax], 0x1f
mov eax, dword [0x595584]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574ccd
lea eax, [ebp - 4]
call fcn.00407c28
ret
Function at 0x575bd0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x575cad
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0041d1bc
call fcn.00430398
mov eax, 0x575cbc
call fcn.004225d8
mov eax, 0x575cbc
call fcn.00430b04
test bl, bl
je 0x575c7c
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.004089bc
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004052b4
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, edi
call fcn.0040895c
push eax
push 0
push 0x200
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00412ce8
mov eax, dword [ebp - 0x5c]
call fcn.0040895c
push eax
call sub.kernel32.dll_CreateProcessW
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575cb4
lea eax, [ebp - 0x5c]
call fcn.00407c28
lea eax, [ebp - 4]
call fcn.00407c28
ret

Function at 0x579ba4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00515a94
mov edi, eax
dec edi
test edi, edi
jl 0x579c1a
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00515a9c
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, esi
call fcn.00515a9c
mov eax, dword [eax + 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 4]
je 0x579c16
push ebp
mov edx, ebx
mov eax, esi
call fcn.00515a9c
call fcn.00579b20
pop ecx
test al, al
je 0x579c16
mov edx, ebx
mov eax, esi
call fcn.00515a9c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x579c16
mov edx, ebx
mov eax, esi
call fcn.00515a9c
mov byte [eax + 0x58], 1
inc ebx
dec edi
jne 0x579bbd
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x579c28
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, edi
call fcn.00515a94
mov esi, eax
dec esi
test esi, esi
jl 0x579c76
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, edi
call fcn.00515a9c
call fcn.00579c20
test al, al
je 0x579c72
mov edx, ebx
mov eax, edi
call fcn.00515a9c
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, edi
call fcn.00515a9c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_ResumeThread
inc ebx
dec esi
jne 0x579c41
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x57cd5c
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x5957f0]
cmp byte [eax], 0
je 0x57cd76
mov eax, 0x57ce84
call fcn.0042a418
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x595c70]
cmp eax, dword [edx]
jne 0x57cd8f
mov ebx, dword [0x595584]
mov ebx, dword [ebx]
jmp 0x57cd91
xor ebx, ebx
test ebx, ebx
je 0x57cd9d
cmp ebx, 0x103
jne 0x57cdcd
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
je 0x57cdb3
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov ebx, dword [eax]
jmp 0x57cdcd
mov eax, 0x1f
test eax, eax
je 0x57cdcb
and eax, 0xffff
or eax, 0x70000
or eax, 0x80000000
mov ebx, eax
test ebx, ebx
je 0x57cdd9
cmp ebx, 0x103
jne 0x57cdf3
mov eax, 0x1f
test eax, eax
je 0x57cdf1
and eax, 0xffff
or eax, 0x70000
or eax, 0x80000000
mov ebx, eax
mov eax, dword [0x5957f0]
cmp byte [eax], 0
je 0x57ce04
mov eax, ebx
call fcn.0042a538
xor eax, eax
push ebp
push 0x57ce5f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x595c70]
cmp eax, dword [edx]
jne 0x57ce36
xor eax, eax
call fcn.004b1b2c
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x57ce55
xor eax, eax
call fcn.005120bc
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
call fcn.005127a0
push ebx
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57ce71
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x583c04
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x583cac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 5
imul eax, eax
test eax, eax
jne 0x583c84
mov eax, dword [0x59555c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00441d74
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x59556c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00441d74
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00408b68
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.004086e4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x583cc4
call fcn.00408480
mov eax, dword [ebp - 4]
call fcn.00408614
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583cb3
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407c88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret
Function at 0x583d0c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x583dde
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5957f0]
cmp byte [eax], 0
je 0x583d37
mov eax, 0x583df8
call fcn.0042a418
call fcn.0057f9ec
call fcn.0050787c
test al, al
je 0x583dc3
call fcn.00412e9c
lea edx, [ebp - 4]
call fcn.00412ce8
mov eax, dword [ebp - 4]
call fcn.004c7cf0
test al, al
je 0x583d84
call fcn.00412e9c
cmp eax, dword [0x598c38]
je 0x583dc3
lea edx, [ebp - 8]
mov eax, dword [0x598c38]
call fcn.00412ce8
mov eax, dword [ebp - 8]
call fcn.004c7cf0
test al, al
jne 0x583dc3
push 0
call fcn.0057f9ec
lea ecx, [ebp - 0xc]
mov dl, 2
call fcn.005086ec
mov eax, dword [ebp - 0xc]
push eax
call fcn.0057f9ec
lea ecx, [ebp - 0x10]
mov dl, 0x99
call fcn.005086ec
mov eax, dword [ebp - 0x10]
mov ecx, 0x10
pop edx
call fcn.0042a040
push 0xb
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583de5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407c88
ret
Function at 0x4012bc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp esi, 1
jl 0x4012cd
cmp esi, 9
jle 0x4012d8
push str.Invalid_compression_level
call fcn.004052b4
pop ecx
mov edi, 0x10000
xor ebx, ebx
push edi
push ebx
push 0x44db20
mov dword [0x431158], esi
call fcn.00426f90
mov eax, esi
add esp, 0xc
shl eax, 3
cmp esi, 1
movzx ecx, word [eax + 0x42e07a]
mov dword [0x431144], ecx
movzx ecx, word [eax + 0x42e078]
mov dword [0x43115c], ecx
movzx ecx, word [eax + 0x42e07c]
movzx eax, word [eax + 0x42e07e]
mov dword [0x431150], ecx
mov dword [0x431154], eax
jne 0x40133a
mov eax, dword [esp + 0x14]
or byte [eax], 4
jmp 0x401346
cmp esi, 9
jne 0x401346
mov eax, dword [esp + 0x14]
or byte [eax], 2
push edi
push 0x45db20
mov dword [0x431140], ebx
mov dword [0x431164], ebx
call dword [0x431138]
pop ecx
cmp eax, ebx
pop ecx
mov dword [0x431168], eax
je 0x4013ba
cmp eax, 0xffffffff
je 0x4013ba
mov esi, 0x106
mov dword [0x43114c], ebx
cmp eax, esi
jae 0x401392
cmp dword [0x43114c], ebx
jne 0x401392
call fcn.0040150b
cmp dword [0x431168], esi
jb 0x40137d
xor eax, eax
xor ecx, ecx
movzx edx, byte [ecx + 0x45db20]
and eax, 0x3ff
and edx, 0x7fff
shl eax, 5
xor eax, edx
inc ecx
cmp ecx, 2
jb 0x401396
mov dword [0x431148], eax
jmp 0x4013ca
mov dword [0x43114c], 1
mov dword [0x431168], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4015e9
Capabilities:
Encode data using xor

Disassembly:
push ecx
and dword [esp], 0
cmp dword [0x431158], 3
push edi
push 2
pop edi
jg 0x401606
call fcn.0040186b
jmp 0x401868
cmp dword [0x431168], 0
je 0x401840
mov ecx, dword [0x431140]
push ebx
push ebp
push esi
mov esi, 0x7fff
mov ebp, 0x3ff
movzx eax, byte [ecx + 0x45db22]
mov edx, dword [0x431148]
and eax, esi
and edx, ebp
mov ebx, ecx
shl edx, 5
xor eax, edx
and ebx, esi
movzx edx, word [eax*2 + 0x44db20]
mov dword [0x431148], eax
lea eax, [eax*2 + 0x44db20]
mov word [ebx*2 + 0x43db20], dx
mov ebx, dword [0x431160]
mov word [eax], cx
mov eax, edi
push 2
mov dword [0x43113c], eax
test edx, edx
pop edi
je 0x4016b7
cmp eax, dword [0x431144]
jae 0x4016b7
mov eax, ecx
sub eax, edx
cmp eax, 0x7efa
ja 0x4016b7
push edx
call fcn.004013ce
mov edi, eax
mov eax, dword [0x431168]
cmp edi, eax
pop ecx
jbe 0x40169a
mov edi, eax
mov ecx, dword [0x431140]
cmp edi, 3
jne 0x4016b7
mov eax, ecx
sub eax, dword [0x431160]
cmp eax, 0x1000
jbe 0x4016b7
push 2
pop edi
mov eax, dword [0x43113c]
cmp eax, 3
jb 0x401781
cmp edi, eax
ja 0x401781
sub ecx, ebx
add eax, 0xfffffffd
dec ecx
push eax
push ecx
call fcn.00403af8
pop ecx
pop ecx
push 1
pop ecx
sub ecx, dword [0x43113c]
add dword [0x431168], ecx
sub dword [0x43113c], 2
mov ecx, dword [0x431140]
movzx edx, byte [ecx + 0x45db23]
mov edi, dword [0x431148]
inc ecx
and edi, ebp
and edx, esi
shl edi, 5
xor edx, edi
mov edi, ecx
mov dword [0x431148], edx
and edi, esi
mov bx, word [edx*2 + 0x44db20]
dec dword [0x43113c]
lea edx, [edx*2 + 0x44db20]
mov word [edi*2 + 0x43db20], bx
mov word [edx], cx
jne 0x4016f8
and dword [esp + 0x10], 0
push 2
inc ecx
pop edi
test eax, eax
mov dword [0x431140], ecx
je 0x4017ef
mov eax, dword [0x431164]
test eax, eax
jl 0x401763
lea edx, [eax + 0x45db20]
jmp 0x401765
xor edx, edx
sub ecx, eax
push 0
push ecx
push edx
call fcn.004032ff
mov ecx, dword [0x431140]
add esp, 0xc
mov dword [0x431164], ecx
jmp 0x4017ef
cmp dword [esp + 0x10], 0
je 0x4017da
movzx eax, byte [ecx + 0x45db1f]
push eax
push 0
call fcn.00403af8
pop ecx
test eax, eax
pop ecx
je 0x4017d2
mov eax, dword [0x431164]
test eax, eax
jl 0x4017ae
lea ecx, [eax + 0x45db20]
jmp 0x4017b0
xor ecx, ecx
mov edx, dword [0x431140]
push 0
sub edx, eax
push edx
push ecx
call fcn.004032ff
mov ecx, dword [0x431140]
add esp, 0xc
mov dword [0x431164], ecx
jmp 0x4017e2
mov ecx, dword [0x431140]
jmp 0x4017e2
mov dword [esp + 0x10], 1
inc ecx
dec dword [0x431168]
mov dword [0x431140], ecx
mov ebx, 0x106
cmp dword [0x431168], ebx
jae 0x401818
cmp dword [0x43114c], 0
jne 0x401818
call fcn.0040150b
cmp dword [0x431168], ebx
mov ecx, dword [0x431140]
jb 0x4017fc
cmp dword [0x431168], 0
jne 0x401626
cmp dword [esp + 0x10], 0
pop esi
pop ebp
pop ebx
je 0x401846
movzx eax, byte [ecx + 0x45db1f]
push eax
push 0
call fcn.00403af8
pop ecx
pop ecx
mov ecx, dword [0x431140]
mov edx, dword [0x431164]
test edx, edx
jl 0x401858
lea eax, [edx + 0x45db20]
jmp 0x40185a
xor eax, eax
sub ecx, edx
push 1
push ecx
push eax
call fcn.004032ff
add esp, 0xc
pop edi
pop ecx
ret