joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470296
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x4702d6
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x4702d6
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x4702d6
mov ebx, eax
xor edi, edi
jmp 0x47033e
push 0x47b888
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x470395
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x470395
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x470395
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x470395
mov esi, eax
xor eax, eax
mov ecx, esp
push eax
push eax
push 0xc0000000
push ecx
call ebx
test eax, eax
jne 0x470395
mov ebx, dword [esp]
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x4703bd
mov dword [eax], edi
mov dword [eax + 4], esi
mov ebp, eax
mov dword [eax + 8], ebx
xor eax, eax
lock cmpxchg dword [0x48fccc], ebp
je 0x47038b
cmp dword [ebp], 0
mov esi, eax
je 0x47037a
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebp
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebp, esi
mov eax, ebp
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esp
mov edx, 0x47b990
xor eax, eax
mov dword [ecx], str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], eax
mov dword [ecx + 8], 0x486600
mov dword [ecx + 0xc], eax
call fcn.0046e8d0
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
Function at 0x471a40
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x471ab1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x471ae8
cmp dword [esp + 4], 0
je 0x471acf
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x471afb
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x48fd60]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x48fd60], esi
jne 0x471a90
mov byte [0x48fd5c], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x471adf
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x471b3c
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x471ad3
mov edi, dword [esp]
jmp 0x471adf
mov edi, dword [esi]
jmp 0x471ade
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00471b70
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x47efb0
mov dword [esp + 8], 0x47ef74
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x486600
mov dword [esp + 0x14], 0
call fcn.0046e8d0
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x47ef74
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x486600
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00471ba0
int3
Function at 0x1000b550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7198e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.1002dc74
mov eax, dword [0x72ed88]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0x71ceb4
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
je 0x1000b5c4
push ebx
call dword [0x71c2b8]
inc eax
push eax
call fcn.1002ec5f
add esp, 4
mov dword [esi + 4], eax
push ebx
push eax
call dword [0x71c2bc]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x10012aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x719e07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x71f174
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.1002ccee
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.1002ccee
mov edi, dword [0x71c450]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x71cebc
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x71c3d4]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x71c0f4]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.100135c0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x5185e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 0xc]
sub esp, 0x20
push ebx
push edi
test al, 1
jne 0x55f566
xor ebx, ebx
mov dword [esi + 0x4c], ebx
cmp dword [esi + 0x78], ebx
je 0x55f573
or eax, 1
mov dword [esi + 0xc], eax
cmp dword [0x6341d148], ebx
je 0x51ebdd
lea eax, [esp + 0xc]
push eax
push 0x63399acc
call dword [0x6341d14c]
test eax, eax
js 0x55f581
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esi + 0x7c], ebx
jle 0x5186a3
lea esp, [esp]
mov ecx, dword [esi + 0x80]
mov edi, dword [ecx + eax*4]
lea ecx, [ecx + eax*4]
mov dword [esp + 8], ecx
cmp edi, ebx
je 0x518699
mov edx, dword [esp + 0xc]
cmp edx, dword [edi + 0x18]
jne 0x55f58a
mov eax, dword [ebp + 8]
dec eax
je 0x51ebd3
call fcn.0050f743
test byte [esi + 0xc], 2
jne 0x5186aa
cmp dword [edi + 0xc], ebx
je 0x51f57e
add edi, 0x14
mov dword [esp + 8], edi
mov edx, dword [esp + 8]
mov edi, dword [edx]
cmp edi, ebx
jne 0x518659
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esi + 0x7c]
jl 0x518645
mov edi, esi
call fcn.005185b2
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x5186ba
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0xc]
and eax, 0xfffffffe
mov ecx, eax
and eax, 0xfffffffd
shl ecx, 0x1e
mov dword [esi + 0xc], eax
sar ecx, 0x1f
xor eax, eax
cmp ecx, ebx
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0051eb19
jmp 0x518675
mov edi, dword [esi + 0x14]
cmp edi, ebx
jne 0x55f5f2
jmp 0x5186ba
mov eax, dword [edi + 0x14]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
cmp edi, dword [esi + 0x14]
jne 0x51f58f
mov dword [esi + 0x14], ebx
mov eax, dword [0x6341d148]
mov ecx, dword [edi + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ecx
push eax
call edx
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
dec dword [esi + 0x78]
jmp 0x51868b
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x6341d148], ebx
je 0x51860d
jmp 0x55f566
mov dword [esp + 0xc], ebx
jmp 0x518637
mov eax, dword [0x6341d148]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
mov edx, dword [edi + 0x1c]
push 0x6338afa8
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
js 0x518675
mov eax, dword [esp + 0x10]
push ebx
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
mov edx, dword [ebp + 8]
push 1
push 0x409
push 0x633863d4
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x518675
mov eax, dword [ebp + 8]
dec eax
je 0x55f602
call fcn.0050f743
jmp 0x5186ba
call fcn.0051eb19
jmp 0x5186ba
Function at 0x539d2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 0x90]
movzx eax, word [eax - 2]
add edi, eax
jmp 0x539de8
movzx eax, word [ebx + 1]
add edx, eax
jmp 0x539de8
mov edx, 1
xor edi, edi
jmp 0x539de8
xor edi, edi
xor edx, edx
jmp 0x539de8
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x6341d150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x68]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [eax + 0x48]
sub ecx, dword [eax + 0x64]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x80], edi
mov ebx, dword [ebp - 0x9c]
mov ecx, edi
shl ecx, 4
add ecx, dword [ebp - 0x98]
xor edx, edx
mov dword [ebp - 0x94], edx
sar ecx, 4
mov al, byte [ebx]
cmp al, 0xa0
jae 0x539e3e
movzx esi, al
movzx eax, byte [esi*4 + 0x633be8a8]
add eax, ebx
mov dword [ebp - 0x90], eax
cmp eax, dword [ebp + 8]
jae 0x539e21
movsx edi, byte [esi*4 + 0x633be8aa]
movsx edx, byte [esi*4 + 0x633be8a9]
mov eax, esi
add edx, edi
sub eax, 0x2b
je 0x5369cd
sub eax, 4
je 0x5369c1
dec eax
je 0x5369b6
cmp byte [esi*4 + 0x633be8ab], 0
jne 0x5369a5
sub ecx, edi
jns 0x539e0b
lea eax, [edx + ecx]
mov dword [ebp - 0x88], ecx
xor ecx, ecx
test eax, eax
sets cl
dec ecx
and ecx, ebx
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp - 0x88]
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x80]
add ecx, edx
mov edx, dword [ebp - 0x94]
jmp 0x539d8b
test edx, edx
je 0x539e3e
movzx eax, byte [edx]
add eax, 0xfffffff9
cmp eax, 0x3b
ja 0x539e3e
movzx ecx, byte [eax + 0x633baca0]
jmp dword [ecx*4 + 0x633bac50]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005173fa
mov esp, ebp
pop ebp
ret 0x10
Function at 0x53d40f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ebx, 0x10
jne 0x53d469
jmp 0x5652b3
add eax, 0xffa9
jmp 0x53d47c
mov ebx, 0x10
jmp 0x5652dd
movzx eax, word [esi + 2]
mov ecx, 0x78
cmp cx, ax
je 0x521ade
mov edx, 0x58
cmp dx, ax
je 0x521ade
lea ebx, [ecx - 0x70]
jmp 0x53d469
mov dword [edi + 4], 0x7fffffff
mov dword [edi], 0xffffffff
jmp 0x53d4da
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x6341d150]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
lea ecx, [esp + 0x18]
push esi
mov esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x1e
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
test ebx, ebx
jne 0x521761
mov edx, 0x30
cmp dx, word [esi]
je 0x539966
lea ebx, [edx - 0x26]
mov dword [esp + 0xc], esi
movzx eax, word [esi]
lea ecx, [eax - 0x30]
cmp cx, 9
ja 0x53d4a4
movzx eax, cx
movzx eax, ax
cmp eax, ebx
jge 0x53d4be
push ebx
lea ecx, [esp + 0x14]
call fcn.0053d6c1
test eax, eax
je 0x565310
add esi, 2
cmp dword [esp + 0x14], 0x20
jle 0x53d46d
jmp 0x5652ef
lea ecx, [eax - 0x41]
cmp cx, 0x19
jbe 0x5652e5
lea edx, [eax - 0x61]
cmp dx, 0x19
jbe 0x521ad4
mov edx, dword [esp + 8]
mov dword [edx], esi
cmp dword [esp + 0xc], esi
je 0x53a6c8
lea edx, [esp + 0x10]
push edx
call fcn.0053d681
fstp qword [edi]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
jne 0x565373
mov ecx, dword [esp + 0x9c]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.005173fa
mov esp, ebp
pop ebp
ret 4
mov eax, 0x30
cmp ax, word [esi]
jne 0x53d469
movzx eax, word [esi + 2]
mov ecx, 0x78
cmp cx, ax
je 0x5652dd
mov edx, 0x58
cmp dx, ax
jne 0x53d469
add esi, 4
jmp 0x53d469
add eax, 0xffc9
jmp 0x53d47c
mov dword [edi + 4], 0x7ff00000
mov dword [edi], 0
lea esp, [esp]
movzx eax, word [esi]
lea ecx, [eax - 0x30]
cmp cx, 9
ja 0x56533e
movzx eax, cx
jmp 0x56535c
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x565326
push eax
call dword [0x63381128]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005173fa
mov esp, ebp
pop ebp
ret 4
lea edx, [eax - 0x41]
cmp dx, 0x19
ja 0x56534e
add eax, 0xffc9
jmp 0x56535c
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x565368
add eax, 0xffa9
movzx edx, ax
cmp edx, ebx
jge 0x565368
add esi, 2
jmp 0x5652ff
mov eax, dword [esp + 8]
mov dword [eax], esi
jmp 0x53d4da
push eax
call dword [0x63381128]
add esp, 4
jmp 0x53d4ea
Function at 0x597d0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov dword [ebp + 8], 1
test ebx, ebx
jns 0x597d35
mov eax, edi
sub eax, ecx
dec eax
test eax, eax
jle 0x597d3d
add eax, 2
jmp 0x597d3a
jle 0x597d3d
lea eax, [ebx + 2]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
add dword [ebp + 8], 2
dec eax
mov dword [ebp + 0xc], eax
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x64
jl 0x597d58
add dword [ebp + 8], 3
jmp 0x597d66
cmp eax, 0xa
jl 0x597d63
add dword [ebp + 8], 2
jmp 0x597d66
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], eax
jl 0x597e9c
movzx edx, byte [ecx]
add dx, 0x30
mov word [esi], dx
add esi, 2
inc ecx
test ebx, ebx
jns 0x597dad
cmp ecx, edi
jae 0x597df8
mov eax, 0x2e
mov word [esi], ax
add esi, 2
lea ebx, [ebx]
movzx edx, byte [ecx]
add dx, 0x30
mov word [esi], dx
inc ecx
add esi, 2
cmp ecx, edi
jae 0x597df8
jmp 0x597d99
jle 0x597df8
mov eax, 0x2e
mov word [esi], ax
add esi, 2
cmp ecx, edi
jae 0x597dd5
test ebx, ebx
jle 0x597df8
movzx edx, byte [ecx]
add dx, 0x30
mov word [esi], dx
inc ecx
add esi, 2
dec ebx
cmp ecx, edi
jb 0x597dbe
test ebx, ebx
jle 0x597df8
mov eax, 0x30
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, ebx
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea esi, [esi + ebx*2]
mov ecx, dword [ebp + 0xc]
mov eax, 0x65
mov word [esi], ax
test ecx, ecx
jns 0x597e17
mov edx, 0x2d
mov word [esi + 2], dx
add esi, 4
neg ecx
jmp 0x597e23
mov eax, 0x2b
mov word [esi + 2], ax
add esi, 4
cmp ecx, 0x64
jl 0x597e61
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + 0x30]
imul eax, eax, 0xffffff9c
add ecx, eax
mov word [esi], dx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + 0x30]
mov word [esi + 2], dx
add esi, 4
jmp 0x597e80
cmp ecx, 0xa
jl 0x597e8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + 0x30]
mov word [esi], dx
add esi, 2
mov edx, eax
neg edx
add edx, edx
add edx, edx
sub edx, eax
lea ecx, [ecx + edx*2]
add ecx, 0x30
xor eax, eax
mov word [esi], cx
mov word [esi + 2], ax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5b96d7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push ebx
push esi
xor esi, esi
xor eax, eax
push edi
mov edi, dword [ecx + 4]
test edx, edx
je 0x5b96fd
movzx ebx, word [edi + eax*2]
rol esi, 7
inc eax
xor esi, ebx
cmp eax, edx
jb 0x5b96ef
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5b97a2
xor edx, edx
mov eax, esi
div dword [ebx]
mov ebx, dword [edi + edx*4]
test ebx, ebx
js 0x5b97a2
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov dword [ebp + 8], edx
mov edi, ebx
shl edi, 4
add edi, dword [ebp + 8]
cmp dword [edi], esi
jne 0x5b979b
mov edx, dword [edi + 8]
cmp edx, ecx
je 0x5b9749
mov eax, ecx
mov ecx, edx
call fcn.005b9757
test al, al
je 0x6829f9
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov ebx, dword [edi + 4]
test ebx, ebx
jns 0x5b9725
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8

Function at 0x5bcc6b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ecx + 4]
push esi
push edi
mov edi, dword [ecx]
mov ecx, edi
xor eax, eax
mov edx, ebx
test ecx, ecx
je 0x5bcc91
movzx esi, word [edx]
rol eax, 7
xor eax, esi
add edx, 2
dec ecx
jne 0x5bcc83
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 0xc]
mov eax, dword [ecx + 4]
mov edx, dword [eax + edx*4]
mov dword [ebp + 8], edx
test edx, edx
je 0x5bccba
mov eax, dword [edx]
cmp edi, dword [eax]
je 0x5cecfd
mov edx, dword [edx + 8]
mov dword [ebp + 8], edx
test edx, edx
jne 0x5bcca6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [eax + 4]
mov esi, edi
mov eax, ebx
test esi, esi
je 0x5ced20
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5e3aeb
add eax, 2
add ecx, 2
dec esi
jne 0x5ced08
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
je 0x5ced1d
mov edx, dword [ebp + 8]
jmp 0x5bccb0
Function at 0x5bcd3d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 0x24]
push edi
test ecx, ecx
je 0x5bcd61
mov edx, dword [ecx + 4]
test edx, edx
jne 0x6483dd
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 4]
sub edx, ecx
cmp edx, 0x10
jb 0x5e37cd
lea edx, [ecx + 0x10]
mov dword [eax + 0x1c], edx
mov eax, ecx
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov edi, dword [esi]
mov edx, dword [esi + 4]
mov ecx, edi
xor eax, eax
mov dword [ebp + 0xc], edx
test ecx, ecx
je 0x5bcda5
movzx esi, word [edx]
rol eax, 7
xor eax, esi
add edx, 2
dec ecx
jne 0x5bcd97
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 0xc]
mov eax, edx
mov edx, dword [ecx + 4]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
test edx, edx
jne 0x5c3ce0
mov dword [ebx + 8], edx
mov edx, dword [ecx + 4]
pop edi
mov dword [edx + eax*4], ebx
inc dword [ecx + 8]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
nop
mov eax, dword [edx]
cmp edi, dword [eax]
je 0x5e77c2
mov edx, dword [edx + 8]
test edx, edx
jne 0x5c3ce1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x5bcdc3
push 0x10
call fcn.005b5b24
jmp 0x5bcd7a
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov esi, edi
test esi, esi
jne 0x5e77d9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov bx, word [eax]
cmp bx, word [ecx]
je 0x5e77fa
mov ax, bx
cmp ax, word [ecx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
je 0x5e77ce
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
jmp 0x5c3ceb
add eax, 2
add ecx, 2
dec esi
jne 0x5e77d9
jmp 0x5e77ce
mov eax, dword [edx]
mov ebx, edx
mov dword [ecx + 4], eax
mov dword [ebp - 4], ebx
jmp 0x5bcd7f
Function at 0x5bfaa4
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1019cb39
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x101a2a60]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
lea eax, [edi + 0x28]
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov eax, dword [edi]
mov eax, dword [eax + 0x1f8]
add eax, 8
mov dword [esp + 0x14], 0x10138e8d
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov eax, dword [ebp + 0x18]
mov byte [esp + 0x48], 1
mov dword [edi + 0x110], ecx
mov dword [edi + 0xf4], edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
lea esi, [esp + 0x18]
call fcn.005bc8d6
mov dl, byte [ebp + 0x20]
mov esi, dword [ebp + 8]
push ebx
push 0x10010d14
push 0x1000e5e8
push ebx
push edi
push esi
mov byte [edi + 0x106], bl
mov byte [edi + 0x119], dl
call fcn.005bf87d
call fcn.005bbcc0
mov ecx, dword [edi + 0x10]
mov al, byte [ebp + 0x1c]
push edi
push ecx
mov byte [edi + 0x118], al
mov byte [edi + 0x107], bl
call fcn.005be3e1
mov edx, dword [edi + 0x20]
mov eax, dword [edx + 0xc]
push edi
push eax
call fcn.005be3e1
mov eax, 0x66666667
imul dword [edi + 0xf0]
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
lea eax, [edi + 0x28]
push eax
mov eax, dword [edi + 4]
call fcn.005bcddf
mov ecx, edi
call fcn.005bca66
push esi
mov ecx, edi
call fcn.005bf071
mov eax, dword [edi + 0xec]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
test dword [edi + 8], 0x800
je 0x6b1d95
cmp byte [edi + 0x108], bl
jne 0x642ce4
cmp byte [esi + 0x58], bl
jne 0x642ce4
xor cl, cl
shl cl, 4
xor cl, byte [eax + 0x7d]
and cl, 0x10
xor byte [eax + 0x7d], cl
jmp 0x6b1d95
mov cl, 1
jmp 0x5bfbee