joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x544520
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0053c149
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x508d73
xor al, al
jmp 0x508e9f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x508d95
xor al, al
jmp 0x508e9f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x508da8
xor al, al
jmp 0x508e9f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x508dbc
xor al, al
jmp 0x508e9f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.0053049b
test eax, eax
jne 0x508df0
xor al, al
jmp 0x508e9f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x68d414
mov dword [esp + 0x20], ebp
call fcn.0053c149
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.0053901c
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.00539073
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x508e84
mov ax, word [ebx]
test ax, ax
je 0x508e76
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00508ec0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x508e5a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.00539073
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x5093a0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.0053a6cc
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x5093e6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0051ff78
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x6b0aa0
push ecx
call fcn.00522041
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x5124a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x5124ec
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x5124ec
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x5124d6
push eax
call ebp
test ax, ax
jl 0x5124e4
inc esi
add edi, 4
cmp esi, 6
jb 0x5124c8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.005121a0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x516120
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x516180
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x516180
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x516180
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x516180
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x516190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x5345dc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x534614
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00532657
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0053262f
jmp 0x534620
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x535dd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x535e18
call fcn.0053c149
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x535e18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x535e0f
xor eax, eax
jmp 0x535e20
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00535e26
pop edi
pop esi
pop ebx
ret 4

Function at 0x53c679
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x53c6a7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53c6c5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0053c5df
jmp 0x53c6c5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x53c6c5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0053c5df
test edi, edi
mov eax, edi
jne 0x53c6af
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x548640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x713020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x5486d8
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x5486b8
xor eax, eax
push ebp
push 0x5486b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x5486f4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5486b8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
ret
mov ax, word [0x713020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x713020], ax
mov esp, ebp
pop ebp
ret
Function at 0x549404
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x724044], 0
je 0x549465
cmp word [0x724218], 0xd7b2
jne 0x54942d
cmp dword [0x724220], 0
jbe 0x54942d
mov eax, 0x724214
call dword [0x724230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x713090
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x54948c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x713030], 0
jne 0x549481
push 0
push 0x713088
push 0x713090
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret
Function at 0x54b304
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x54b36a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.005497f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00548234
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x54b354
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54b371
lea eax, [ebp - 0x10]
call fcn.00549588
ret

Function at 0x54f790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x54f7c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00549678
jmp 0x54f7d2
mov eax, ebx
mov edx, esi
call fcn.005495dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x54f7dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x54f7fd
mov al, byte [esp]
jmp 0x54f7ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x550c58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x550cbc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.005497f8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_GetACP
mov edx, eax
pop eax
call fcn.0054cc20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550cc3
lea eax, [ebp - 0xc]
call fcn.00549588
ret
Function at 0x551d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x71333c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x551e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x551dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x551e5f
dec edx
je 0x551ea0
jmp 0x551efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x551efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x551f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x551f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x55208f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x551fb0
je 0x551ffc
sub ecx, 0x2b
je 0x551ff2
sub ecx, 4
je 0x551ff7
dec ecx
sub ecx, 0xa
jb 0x551fe1
jmp 0x551fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x551fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x551fd0
jmp 0x551fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x551fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x551fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x551fff
mov byte [eax], 0x3e
jmp 0x551fff
mov byte [eax], 0x3f
jmp 0x551fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x551f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x55204f
cmp byte [esp + 3], 0xff
jne 0x55204f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x552087
cmp dl, 0xff
je 0x552087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x551f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x55211c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x7247a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x552138
shr eax, 1
xor eax, 0xedb88320
jmp 0x55213a
shr eax, 1
dec edx
jne 0x55212b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x552124
pop ebx
ret
Function at 0x552150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x552159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00549a38
xor eax, eax
push ebp
push 0x552239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0055211c
mov eax, dword [0x723e0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00547e7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00548218
call fcn.00547ba8
test eax, eax
jne 0x552216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.00547fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x552210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x7247a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x5521ec
cmp dword [ebp - 8], 0
jne 0x5521c3
lea eax, [ebp - 0x154]
call fcn.00547fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552240
lea eax, [ebp - 4]
call fcn.00549588
ret

Function at 0x55d718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x55d738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x55d726
pop edi
pop esi
pop ebx
ret
Function at 0x565fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x724cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x719670]
mov eax, dword [esi*4 + 0x7196b0]
xor eax, dword [esp]
call fcn.00565f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.00565fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x719680]
mov eax, dword [esi*4 + 0x7196c0]
xor eax, dword [esp]
call fcn.00565f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.00565fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x719690]
mov eax, dword [esi*4 + 0x7196d0]
xor eax, dword [esp]
call fcn.00565f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.00565fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x7196a0]
mov eax, dword [esi*4 + 0x7196e0]
xor eax, dword [esp]
call fcn.00565f70
mov edi, eax
mov eax, edi
call fcn.00565fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x565fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x566138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x56616d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x566193
inc ebx
cmp ebx, 0xf
jne 0x56617d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x56614f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56fee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0x71e0f4
mov ebx, 0x728ce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.0056ee30
mov dword [esp + 8], eax
mov eax, edi
call fcn.0056ee40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.0056ee30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.0056ee40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x56fef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000676a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0x16cb3
add edi, 0x10a1a
pop edi
cmp dword [ebp - 0xcc8], 0
jne 0x10006792
mov dword [ebp - 0x2f4], 0
jmp 0x100069dd
mov ecx, dword [ebp - 0xcc8]
mov dword [ebp - 0x518], ecx
push edi
jmp 0x100067a7
sub edi, 0x8d68
and edi, 0x14e67
pop edi
push ecx
push eax
add esp, 4
call 0x100067c6
add byte [ecx + 0x37], al
inc esp
dec edi
dec ebp
dec edi
inc edx
add esp, 4
or ecx, 0x259b
pop ecx
lea edx, [ebp - 0x1740]
mov dword [ebp - 0xcc4], edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc0], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
push ecx
add esp, 4
sub esi, 0x13ea6
or esi, 0x17dda
sub esi, 0x60b2
call 0x10006820
add byte [0x3f454036], bh
cmp eax, 0x83454c49
les eax, [esi + ebx*2]
push edi
and edi, 0x3ca1
pop edi
mov ecx, dword [ebp - 0xcc0]
mov dx, word [ecx]
mov word [ebp - 0x1042], dx
mov eax, dword [ebp - 0xcc0]
add eax, 2
mov dword [ebp - 0xcc0], eax
mov cx, word [ebp - 0x1042]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc4]
mov ax, word [edx]
mov word [ebp - 0x1044], ax
mov ecx, dword [ebp - 0xcc4]
add ecx, 2
mov dword [ebp - 0xcc4], ecx
mov dx, word [ebp - 0x1044]
mov word [ebp - 0x38], dx
push edi
xor edi, 0x43f8
xor edi, 0x33d4
xor edi, 0x1192c
xor edi, 0x36a6
pop edi
push edx
push ecx
add esp, 4
add edx, 0x190b
and edx, 0xc631
and edx, 0x14390
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x100068d2
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x1000692c
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x100067fa
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x100067fa
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x10006916
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x10006920
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x10006975
push ebx
sub ebx, 0xd6d1
pop ebx
push edx
sub edx, 0x148cd
pop edx
push esi
add esi, 0xbc7a
pop esi
push edx
push edi
add esp, 4
jmp 0x1000695a
add edx, 0xae19
sub edx, 0x378d
pop edx
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x2f4], ecx
jmp 0x100069dd
push edx
push esi
add esp, 4
add edx, 0x15a3f
pop edx
push eax
sub eax, 0x382c
pop eax
push edx
jmp 0x10006992
pop edx
push eax
sub eax, 0xbf2f
sub eax, 0xfde1
or eax, 0x58e7
pop eax
mov edx, dword [ebp - 0x518]
mov eax, dword [edx]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [ebp - 0xcc8]
je 0x100069d3
mov edx, dword [ebp - 0x518]
cmp dword [edx + 0x30], 0
jne 0x1000679e
mov dword [ebp - 0x2f4], 0