joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55f620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
lea ecx, [ebp + 8]
push esi
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebx + 4]
call fcn.00538fd0
mov esi, dword [ebp - 4]
cmp byte [esi + 0xd], 0
jne 0x55f748
push edi
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 0x10]
jl 0x55f747
cmp esi, dword [ebx + 4]
je 0x55f747
movsd xmm0, qword [ebp + 0x10]
mov ecx, dword [esi + 0x1c]
movsd qword [esi + 0x28], xmm0
test ecx, ecx
je 0x55f6ea
movd xmm0, dword [ebx + 0x18]
movsd xmm1, qword [esi + 0x20]
mulsd xmm1, qword [ebx + 0x10]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
push eax
mov eax, dword [0x668b28]
push ecx
mov eax, dword [eax + 0x78]
call eax
mov al, byte [ebp + 0x18]
xor al, 1
inc al
movzx eax, al
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x6c]
call eax
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x7c]
call eax
test al, al
jne 0x55f6cb
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x64]
call eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x55f747
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x70]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x668b28]
push edi
mov eax, dword [eax + 0x50]
call eax
test al, al
jne 0x55f71e
mov eax, dword [0x668b28]
push dword [esi + 0x18]
push edi
mov eax, dword [eax + 0x3c]
call eax
xor eax, eax
cmp byte [esi + 0x39], al
setne al
inc eax
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x10]
mov eax, dword [eax + 0x4c]
call eax
movd xmm0, dword [ebx + 0x1c]
movsd xmm1, qword [esi + 0x20]
mulsd xmm1, qword [ebx + 0x10]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x10]
mov eax, dword [eax + 0x44]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x55fbb0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x668b2c], 0
jne 0x55fc2a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x104]
push str.gPakInterfaceP__d
push eax
call fcn.00404f70
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x668b2c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x668b30], eax
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
mov eax, dword [0x668b30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x5625b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebx + 4]
call fcn.00538fd0
mov esi, dword [ebp - 4]
cmp byte [esi + 0xd], 0
jne 0x5626b6
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x10]
jl 0x5626b6
cmp esi, dword [ebx + 4]
je 0x5626b6
movsd xmm1, qword [esi + 0x30]
xorps xmm0, xmm0
mov ecx, dword [esi + 0x1c]
movsd qword [esi + 0x20], xmm1
movsd qword [esi + 0x28], xmm0
test ecx, ecx
je 0x562666
movd xmm0, dword [ebx + 0x18]
mulsd xmm1, qword [ebx + 0x10]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
push eax
mov eax, dword [0x668b28]
push ecx
mov eax, dword [eax + 0x78]
call eax
mov al, byte [ebp + 0x10]
xor al, 1
inc al
movzx eax, al
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x6c]
call eax
mov eax, dword [0x668b28]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x64]
call eax
mov eax, dword [0x668b28]
push dword [ebp + 0xc]
push dword [esi + 0x1c]
mov eax, dword [eax + 0x70]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x668b28]
push dword [esi + 0x18]
push dword [esi + 0x10]
mov eax, dword [eax + 0x3c]
call eax
xor eax, eax
cmp byte [esi + 0x39], al
setne al
inc eax
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x10]
mov eax, dword [eax + 0x4c]
call eax
movd xmm0, dword [ebx + 0x1c]
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [esi + 0x20]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
push eax
mov eax, dword [0x668b28]
push dword [esi + 0x10]
mov eax, dword [eax + 0x44]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x563860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.0055fbb0
test eax, eax
je 0x563886
mov eax, dword [0x668b30]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebp
ret
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a96a6
add esp, 0x10
pop ebp
ret

Function at 0x563ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7c95
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x154], 2
mov dword [ebp - 0x30], esi
jne 0x56405b
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
jmp 0x564136
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp byte [edi + 0x12c], 0
mov dword [ebp - 4], 0
je 0x5640ee
lea esi, [edi + 0x158]
push esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x128]
mov byte [ebp - 4], 1
call fcn.005aa18d
add esp, 4
lea ecx, [ebp - 0x28]
mov edi, eax
push 0
push edi
call fcn.004fd400
mov eax, dword [ebp - 0x2c]
push 0
push 0
push dword [eax + 0x128]
call fcn.005a9a75
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push dword [ecx + 0x128]
push edi
push 1
push eax
call fcn.005a96a6
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x30]
jmp 0x564111
lea eax, [edi + 0x130]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x564111
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x564105
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040c5a0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret 4

Function at 0x564c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x154], 2
jne 0x564ce0
lea eax, [ebp - 4]
mov word [esi + 0x150], 0x101
push eax
push 0
push esi
push 0x565180
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x564cd9
mov word [esi + 0x150], ax
mov dword [esi + 0x154], 0xb
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x565fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea edx, [edi + 0x30]
mov ebx, dword [edi + 0x34]
mov ecx, dword [edi + 0x64]
sub ebx, ecx
mov eax, dword [edi + 0x6c]
sub ebx, eax
jne 0x566001
test ecx, ecx
jne 0x566010
lea edx, [edi + 0x30]
test eax, eax
jne 0x566010
mov ebx, esi
jmp 0x5660a8
cmp ebx, 0xffffffff
jne 0x566010
mov ebx, 0xfffffffe
jmp 0x5660a8
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x5660a8
mov ecx, dword [edx]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.0059d280
mov eax, dword [edi + 0x44]
add esp, 0xc
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x3c]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
nop word [eax + eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x566050
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x38]
mov edi, esi
lea edx, [eax + esi*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x566080
mov edi, dword [ebp + 8]
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x566105
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
push ebx
push eax
push ecx
call fcn.005663b0
mov ebx, dword [edi + 0x6c]
add esp, 0xc
add ebx, eax
mov dword [edi + 0x6c], ebx
cmp ebx, 3
jb 0x5660ee
mov eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x566105
mov eax, dword [edi]
lea edx, [edi + 0x30]
cmp dword [eax + 4], 0
jne 0x565fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x566980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7d15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6229a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], 0
push 0x54
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
call fcn.0059b742
mov edi, eax
add esp, 4
mov dword [esi + 4], edi
mov edx, dword [ebp + 0x10]
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov ecx, edx
mov dword [edi + 0x24], 0
cmp dword [edx + 0x14], 0x10
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edx
jb 0x566a07
mov ecx, dword [edx]
mov dword [ebp - 0x10], ecx
mov eax, dword [edx + 0x10]
mov dword [ebp + 8], eax
cmp eax, 0x7fffffff
ja 0x566b3d
mov dword [edi + 0x24], 0xf
cmp eax, 0x10
jae 0x566a30
mov dword [edi + 0x20], eax
movups xmm0, xmmword [ecx]
movups xmmword [edi + 0x10], xmm0
jmp 0x566aaf
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x566a57
mov ecx, closesocket
mov esi, closesocket
push ecx
call fcn.00402b50
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 8]
jmp 0x566a92
mov ecx, 0x16
cmp esi, ecx
cmovb esi, ecx
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x566a7c
push ecx
call fcn.00402b50
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 8]
jmp 0x566a92
test ecx, ecx
je 0x566a90
push ecx
call fcn.0059b742
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 8]
jmp 0x566a92
xor ecx, ecx
mov dword [edi + 0x20], eax
inc eax
push eax
push dword [ebp - 0x10]
mov dword [edi + 0x10], ecx
push ecx
mov dword [edi + 0x24], esi
call fcn.0059d280
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov esi, dword [ebp - 0x14]
mov eax, dword [edx + 0x18]
xorps xmm0, xmm0
mov dword [edi + 0x28], eax
movups xmmword [edi + 0x2c], xmm0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
movups xmm0, xmmword [edx + 0x1c]
movups xmmword [edi + 0x2c], xmm0
movq xmm0, qword [edx + 0x2c]
movq qword [edi + 0x3c], xmm0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x30], 0xf
mov byte [edx + 0x1c], 0
mov eax, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], ecx
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x4c], eax
mov eax, dword [edx + 0x40]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
mov eax, dword [esi + 4]
mov byte [eax + 0xc], 0
mov eax, dword [esi + 4]
mov byte [eax + 0xd], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.00404b20
int3
Function at 0x5679f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebx]
test esi, esi
je 0x567a45
mov eax, dword [esi + 0x28]
sub eax, dword [ebx + 4]
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
mov ecx, dword [ecx + 0x18]
cmp edi, eax
cmovge edi, eax
add ecx, dword [esi + 0x24]
add ecx, dword [ebx + 4]
xor esi, esi
test edi, edi
jle 0x567a35
mov al, byte [ecx]
lea edx, [edx + 1]
inc esi
mov byte [edx - 1], al
lea ecx, [ecx + 1]
cmp esi, edi
jl 0x567a25
add dword [ebx + 4], edi
mov eax, edi
pop edi
cdq
idiv dword [ebp + 0xc]
pop esi
pop ebx
pop ebp
ret 0x10
push dword [ebx + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a96a6
add esp, 0x10
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x567da0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x668b40], 0
jne 0x567e1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x104]
push str.gPakInterfaceP__d
push eax
call fcn.00404f70
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x668b40], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x668b44], eax
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
mov eax, dword [0x668b44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x56d490
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [eax + 8]
mov byte [ebp - 0x15], cl
cmp cl, 3
je 0x56d679
push ebx
mov ebx, dword [eax]
xor edx, edx
push edi
movzx edi, byte [eax + 9]
test cl, 2
mov eax, dword [ebp + 0x10]
mov ecx, edi
je 0x56d4f3
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edi
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edi
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [edx + 3]
jmp 0x56d501
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x56d51b
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edi, eax
mov dword [ebp + ecx*4 - 0x14], edi
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x56d563.3
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x56d536
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x56d53b
mov edx, 1
inc eax
cmp eax, ecx
jl 0x56d525
test dx, dx
je case.0x56d563.3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x56d563.3
movzx eax, byte [eax + 0x56d69c]
jmp dword [eax*4 + 0x56d688]
mov ecx, dword [edx + 4]
test ecx, ecx
je case.0x56d563.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x56d575
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edx + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x56d563.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x56d5b8
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x56d563.3
nop word [eax + eax]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x56d5f0
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x56d563.3
mov edi, 0x100
nop dword [eax]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x56d630
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x570500
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x570537
push esi
call fcn.0057e4a0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x57052e
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x570542
cmp eax, 0xcb
jne 0x5705be
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x5705a8
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x57055f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x5705a2
cmp eax, 2
je 0x5705a8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x570550
cmp eax, 3
je 0x570587
cmp eax, 1
jne 0x570550
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x570550
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x570550
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.005705f0
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x5705e0
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.005705f0
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x5705f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
lea edi, [esi + 0x180]
mov dword [ebp + 8], edi
lea ebx, [esi + 0x78]
je 0x570627
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
jmp 0x57062a
mov dword [ebp + 8], edi
mov eax, dword [edi]
cmp byte [eax + 8], 0
je 0x5706a2
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x570682
nop dword [eax]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x57065e
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x184]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x5706b9
cmp eax, dword [esi + 0x60]
jb 0x570640
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [edi]
cmp byte [eax + 8], 0
jne 0x570632
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x5753b0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x5753cc
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x5754d1
nop dword [eax + eax]
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x575494
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x575406
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x5754a5
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x575498
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x5753e0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x57ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
test edi, edi
je 0x57ed11
push ebx
push esi
mov ecx, dword [edi]
mov edx, dword [edi + 4]
add edx, dword [ecx]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0xc]
mov ebx, edx
cmp edx, dword [edi + 8]
cmovge ebx, dword [edi + 8]
xor esi, esi
test ebx, ebx
jle 0x57ed00
mov edi, dword [ebp - 4]
nop
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x6212b8]
cmp esi, ebx
jl 0x57ece0
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov edi, dword [edi + 0xc]
sub edx, esi
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], edi
test edi, edi
jne 0x57ecc0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret