joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555c80
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov ecx, dword [0x683b18]
push esi
movzx esi, byte [ecx + 3]
shl esi, 8
push edi
movzx edi, byte [ecx + 2]
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
mov dword [edx], esi
movzx esi, byte [ecx + 7]
movzx edi, byte [ecx + 6]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 5]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 4]
shl esi, 8
or esi, edi
mov dword [edx + 4], esi
movzx esi, byte [ecx + 0xb]
movzx edi, byte [ecx + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 9]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 8]
shl esi, 8
or esi, edi
mov dword [edx + 8], esi
movzx esi, byte [ecx + 0xf]
movzx edi, byte [ecx + 0xe]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 0xd]
movzx ecx, byte [ecx + 0xc]
shl esi, 8
or esi, edi
shl esi, 8
or esi, ecx
mov dword [edx + 0xc], esi
movzx ecx, byte [eax + 3]
movzx esi, byte [eax + 2]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 1]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x10], ecx
movzx ecx, byte [eax + 7]
movzx esi, byte [eax + 6]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 5]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 4]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x14], ecx
movzx ecx, byte [eax + 0xb]
movzx esi, byte [eax + 0xa]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 9]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 8]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x18], ecx
movzx ecx, byte [eax + 0xf]
movzx esi, byte [eax + 0xe]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xd]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xc]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x1c], ecx
movzx ecx, byte [eax + 0x13]
movzx esi, byte [eax + 0x12]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x11]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x10]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x20], ecx
movzx ecx, byte [eax + 0x17]
movzx esi, byte [eax + 0x16]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x15]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x14]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x24], ecx
movzx ecx, byte [eax + 0x1b]
movzx esi, byte [eax + 0x1a]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x19]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x18]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x28], ecx
movzx ecx, byte [eax + 0x1f]
movzx esi, byte [eax + 0x1e]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x1d]
movzx eax, byte [eax + 0x1c]
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, eax
pop edi
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x40], 0x40
pop esi
ret
Function at 0x55bcc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x55bd12
cmp dword [esi + 4], 0
jne 0x55bcdb
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x55bceb
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x55bd12
sub eax, ecx
cmp eax, dword [esi + 0x10]
jbe 0x55bd12
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.004babe0
mov al, 1
mov byte [esi + 0x14], al
pop esi
pop ebp
ret 0xc
xor al, al
pop esi
pop ebp
ret 0xc
Function at 0x5622b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1f78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x68683c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 0x24]
mov edi, dword [ebp + 0x14]
push eax
push str.readExpectedMessage
push edi
lea ecx, [ebp - 0x1c]
call fcn.0045a1f0
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 0x24], bl
je 0x562311
cmp dword [esi + 0x28], ebx
jne 0x562311
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.No_m_pHandler.
mov ecx, edi
call eax
mov dword [esi + 0x3c], ebx
cmp dword [esi + 4], ebx
jne 0x562321
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, 5
jne 0x562352
cmp dword [0x689a68], 0xa
jge 0x562349
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
mov ecx, edi
call eax
inc dword [0x689a68]
mov dword [esi + 0x10], 0x7530
jmp 0x562356
test eax, eax
je 0x562387
cmp dword [esi + 4], 0
jne 0x562364
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x562374
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x562387
sub eax, ecx
cmp eax, dword [esi + 0x10]
ja 0x5623d5
mov ecx, dword [ebp - 0x10]
push edi
push ebx
push esi
call fcn.00561cf0
test al, al
je 0x562407
mov ecx, ebx
call fcn.004bab80
test al, al
jne 0x562407
cmp byte [ebp + 0xc], al
je 0x5623b0
cmp dword [esi + 0x3c], 0x5d
je 0x562324
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0045a240
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, ebx
call fcn.004babe0
mov byte [ebx + 0x14], 1
cmp byte [edi + 0x125], 0
je 0x562407
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Too_much_time_elapsed_waiting_for_response.
mov ecx, edi
call eax
mov ecx, dword [esi + 0x10]
push ecx
push str.totalTimeoutMs
mov ecx, edi
call fcn.00459e10
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0045a240
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x562870
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bef60
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x68683c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0x14]
push str.readUntilRcvWindowAdjust
push esi
lea ecx, [ebp - 0x1c]
call fcn.0045a1b0
xor ebx, ebx
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb0], ebx
jne 0x5629b7
mov edi, dword [ebp + 0x10]
jmp 0x5628d0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], 1
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0xea60
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x44], ebx
call fcn.0041b9a0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], ebx
call fcn.004babe0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push esi
push edi
push eax
call fcn.00561cf0
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x56295c
push esi
call fcn.0046ef60
test al, al
jne 0x5629dc
mov ecx, edi
call fcn.004bab50
test al, al
jne 0x562a27
cmp byte [ebp - 0x51], bl
jne 0x562a36
cmp byte [ebp - 0x53], bl
jne 0x562a3d
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp + 0x14]
cmp eax, 0xea60
ja 0x562a44
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
call fcn.0041c170
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xb0], ebx
je 0x5628d0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0045a240
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.aborted_by_user_application.
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
call fcn.0041c170
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0045a240
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.004bac40
jmp 0x5629ea
push str.Received_DISCONNECT
jmp 0x5629e1
push str.Received_CHANNEL_CLOSE
jmp 0x5629e1
mov ecx, dword [ebp - 0x10]
push esi
push edi
call fcn.0055bf70
push str.No_WINDOW_ADJUST_seems_to_be_coming...
jmp 0x5629e1
Function at 0x56ad30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x56ad4e
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x56ae4c
lea ebx, [ebx]
mov eax, ebx
cmp ebx, 0x15b0
jb 0x56ad6f
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jb 0x56ae11
mov edx, eax
shr edx, 4
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub eax, 0x10
dec edx
jne 0x56ad82
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x56ae20
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x56ae15
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x56ad60
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x56f5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov cl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x56f5ea
mov edx, dword [eax + 0x260]
push edi
movzx edi, cl
mov esi, edx
shr esi, 0x18
xor esi, edi
shl edx, 8
xor edx, dword [esi*4 + 0x684818]
mov esi, dword [ebp - 4]
add esi, ebx
mov dword [eax + 0x260], edx
mov dword [ebp - 4], esi
cmp esi, dword [eax + 0x38]
jl 0x56f5c5
pop edi
mov edx, dword [eax + 0x34]
mov byte [eax + edx + 0x58], bl
mov esi, dword [eax + 0x38]
mov edx, esi
sub edx, ebx
je 0x56f678
sub edx, ebx
je 0x56f65a
sub edx, ebx
je 0x56f64e
mov byte [esi + eax + 0x54], bl
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov cl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
sub cl, 4
mov byte [esi + edx], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56fa90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bf8c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x68683c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
je 0x56fb6b
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x56fad6
cmp ebx, 1
jne 0x56fb6b
cmp dword [ebp + 0xc], 4
ja 0x56fb6b
push 0xfa74
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
jne 0x56fb13
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [esi + 0x20], eax
mov dword [eax + 4], 0xa
mov dword [eax + 0x20], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0xc64], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov byte [eax + 0x28], bl
mov dword [eax + 0xc54], edi
mov dword [eax + 0xc50], edi
mov dword [eax + 0xc4c], edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57e300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c042b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x68683c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x57e390
mov ecx, esi
call fcn.0044d590
mov dword [esi], vtable.TreeNode.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov word [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 0xce
mov byte [esi + 0x10], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x591900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x43c]
mov edx, dword [eax + 0x440]
sub esp, 8
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x591964
push edi
mov edi, edi
inc cl
movzx edi, cl
mov ecx, dword [eax + edi*4 + 0x3c]
add dl, cl
mov dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov ecx, dword [eax + ecx*4 + 0x3c]
mov dword [eax + edi*4 + 0x3c], ecx
add cl, dl
movzx ecx, cl
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov dword [eax + edi*4 + 0x3c], edx
mov dl, byte [eax + ecx*4 + 0x3c]
mov ecx, dword [ebp + 0xc]
xor byte [esi + ecx], dl
mov ecx, dword [ebp - 8]
inc esi
mov edx, edi
cmp esi, dword [ebp + 0x10]
jl 0x591920
pop edi
mov dword [eax + 0x440], edx
mov dword [eax + 0x43c], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x591d00
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x591d12
xor al, al
pop edi
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebx + 0x14]
call fcn.004078c0
cmp eax, 0x20
jne 0x591d31
lea ecx, [ebx + 0x34]
call fcn.004078c0
cmp eax, 0xc
jae 0x591d3a
pop esi
pop ebx
xor al, al
pop edi
pop ebp
ret 8
lea ecx, [ebx + 0x14]
call fcn.0041b6d0
lea ecx, [ebx + 0x34]
mov esi, eax
call fcn.0041b6d0
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx ecx, byte [esi + 3]
shl ecx, 8
movzx edx, byte [esi + 2]
or ecx, edx
shl ecx, 8
movzx edx, byte [esi + 1]
or ecx, edx
movzx edx, byte [esi]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x10], ecx
movzx ecx, byte [esi + 7]
movzx edx, byte [esi + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x14], ecx
movzx ecx, byte [esi + 0xb]
movzx edx, byte [esi + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 9]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 8]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x18], ecx
movzx ecx, byte [esi + 0xf]
movzx edx, byte [esi + 0xe]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0xd]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0xc]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x1c], ecx
movzx ecx, byte [esi + 0x13]
movzx edx, byte [esi + 0x12]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x11]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x10]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x20], ecx
movzx ecx, byte [esi + 0x17]
movzx edx, byte [esi + 0x16]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x14]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x24], ecx
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x1a]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x19]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x18]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x28], ecx
movzx ecx, byte [esi + 0x1f]
movzx edx, byte [esi + 0x1e]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x1d]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x1c]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], 0
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x34], ecx
movzx ecx, byte [eax + 7]
movzx edx, byte [eax + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x38], ecx
movzx ecx, byte [eax + 0xb]
movzx edx, byte [eax + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 9]
movzx eax, byte [eax + 8]
shl ecx, 8
or ecx, edx
shl ecx, 8
pop esi
or ecx, eax
pop ebx
mov dword [edi + 0x3c], ecx
mov al, 1
pop edi
pop ebp
ret 8
Function at 0x592dc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x454], ecx
movzx ecx, byte [eax + 7]
shl ecx, 8
movzx esi, byte [eax + 6]
or ecx, esi
movzx esi, byte [eax + 5]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 4]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x458], ecx
movzx ecx, byte [eax + 0xb]
movzx esi, byte [eax + 0xa]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 9]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 8]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x45c], ecx
movzx ecx, byte [eax + 0xf]
movzx esi, byte [eax + 0xe]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xd]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xc]
shl ecx, 8
or ecx, esi
cmp dword [ebp + 0x10], 0x100
mov dword [edx + 0x460], ecx
jne 0x592e71
add eax, 0x10
mov ecx, str.expand_32_byte_k
jmp 0x592e76
mov ecx, str.expand_16_byte_k
movzx esi, byte [eax + 3]
movzx edi, byte [eax + 2]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 1]
shl esi, 8
or esi, edi
movzx edi, byte [eax]
shl esi, 8
or esi, edi
mov dword [edx + 0x464], esi
movzx esi, byte [eax + 7]
movzx edi, byte [eax + 6]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 5]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 4]
shl esi, 8
or esi, edi
mov dword [edx + 0x468], esi
movzx esi, byte [eax + 0xb]
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 9]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 8]
shl esi, 8
or esi, edi
mov dword [edx + 0x46c], esi
movzx esi, byte [eax + 0xf]
movzx edi, byte [eax + 0xe]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xd]
movzx eax, byte [eax + 0xc]
shl esi, 8
or esi, edi
shl esi, 8
or esi, eax
mov dword [edx + 0x470], esi
movsx eax, byte [ecx + 3]
movsx esi, byte [ecx + 2]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 1]
shl eax, 8
or eax, esi
movsx esi, byte [ecx]
shl eax, 8
or eax, esi
mov dword [edx + 0x444], eax
movsx eax, byte [ecx + 7]
movsx esi, byte [ecx + 6]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 5]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 4]
shl eax, 8
or eax, esi
mov dword [edx + 0x448], eax
movsx eax, byte [ecx + 0xb]
movsx esi, byte [ecx + 0xa]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 9]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 8]
shl eax, 8
or eax, esi
mov dword [edx + 0x44c], eax
movsx eax, byte [ecx + 0xf]
movsx esi, byte [ecx + 0xe]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 0xd]
movsx ecx, byte [ecx + 0xc]
shl eax, 8
or eax, esi
shl eax, 8
or eax, ecx
pop edi
mov dword [edx + 0x450], eax
pop esi
pop ebp
ret 0x10
Function at 0x5937b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp esi, 0x80
jbe 0x5937ca
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x5937d7
mov dword [ebp + 0x10], 0x400
mov eax, dword [ebp + 8]
push edi
push esi
push eax
lea edi, [ebx + 0x88]
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
cmp esi, 0x80
jae 0x593821
mov al, byte [esi + ebx + 0x87]
mov ecx, edi
lea ecx, [ecx]
movzx edx, byte [ecx]
movzx eax, al
add edx, eax
and edx, 0xff
mov al, byte [edx + 0x650530]
mov byte [edi + esi], al
inc esi
inc ecx
cmp esi, 0x80
jb 0x593800
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 7]
neg ecx
shr edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + ebx + 0x88]
mov edi, 0xff
sar edi, cl
movzx ecx, byte [esi]
and edi, ecx
mov cl, byte [edi + 0x650530]
mov byte [esi], cl
test eax, eax
je 0x59386b
movzx edi, byte [esi + edx - 1]
dec esi
movzx ecx, cl
xor edi, ecx
dec eax
mov cl, byte [edi + 0x650530]
mov byte [esi], cl
jne 0x593855
mov ecx, 0x3f
lea eax, [ebx + 0x106]
pop edi
jmp 0x593880
movzx edx, byte [eax + 1]
mov esi, 0x100
imul dx, si
movzx esi, byte [eax]
add dx, si
mov word [eax], dx
mov edx, ecx
dec ecx
sub eax, 2
test edx, edx
jne 0x593880
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x593fa0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x685368
ret

Function at 0x593fb0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x6853b0
ret