joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002b20
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov eax, dword [0x100316a4]
push ebx
mov ebx, ecx
push esi
test eax, eax
je 0x10002b3b
cmp eax, 0xffffffff
je 0x10002b3b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x194]
lea esi, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x194]
mov ecx, 0xfde9
or ebp, dword [esp + 0x1f8]
test ebp, 0x100
mov dword [esp + 0x194], ebp
push edi
cmovne eax, ecx
mov edi, ebx
mov dword [esp + 0x19c], eax
mov ecx, 0x7a
mov eax, dword [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x1e8], eax
mov dword [ebx + 0x1ec], ecx
mov eax, dword [0x100316a4]
test eax, eax
je 0x10002ba4
cmp eax, 0xffffffff
je 0x10002ba4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
test ebp, 0x1000
pop ebp
je 0x10002be3
push 0
push 0
push ebx
push 0x100028b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [ebx + 0x1f4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x1f8], eax
mov al, 1
pop esi
pop ebx
ret 0x1ec
mov eax, dword [ebx + 0x184]
test al, 0x40
je 0x10002c22
lea ecx, [ebx + 0x1c]
test al, al
jns 0x10002d09
lea eax, [ebx + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002cf4
add dword [ebx + 0x1e8], eax
adc dword [ebx + 0x1ec], 0
push 0x10031620
push 0x40
push 0xa
push dword [ebx + 0x1e8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x1f4]
push eax
lea esi, [ebx + 0x1fd]
push esi
push dword [ebx + 0x1e8]
call fcn.100052b0
test eax, eax
je 0x10002c8c
cmp eax, 3
jne 0x10002d3b
push 9
push dword [ebx + 0x1ec]
push dword [ebx + 0x1e8]
call fcn.10001e40
add esp, 0xc
lea eax, [esp + 0x1f4]
push eax
push esi
push dword [ebx + 0x1e8]
call fcn.100052b0
test eax, eax
jne 0x10002c55
mov eax, dword [0x10030028]
mov ecx, dword [esp + 0x1f4]
mov dword [eax + 0x10030008], ebx
mov eax, dword [0x1003002c]
mov dword [eax + 0x10030008], 0x10002f20
mov eax, dword [0x10030030]
mov dword [eax + 0x10030008], ecx
movups xmm0, xmmword [0x10030008]
push dword [ebx + 0x1e8]
movups xmmword [esi], xmm0
movq xmm0, qword [0x10030018]
movq qword [esi + 0x10], xmm0
mov eax, dword [0x10030020]
mov dword [esi + 0x18], eax
mov al, byte [0x10030024]
mov byte [esi + 0x1c], al
call fcn.100054e0
test eax, eax
pop esi
sete al
pop ebx
ret 0x1ec
push dword [0x1003086c]
call fcn.10001760
add esp, 4
xor al, al
pop esi
pop ebx
ret 0x1ec
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10002d26
cdq
add dword [ebx + 0x1e8], eax
adc dword [ebx + 0x1ec], edx
jmp 0x10002c22
push dword [0x10030870]
call fcn.10001760
add esp, 4
xor al, al
pop esi
pop ebx
ret 0x1ec
push eax
call fcn.100056d0
push eax
call fcn.10001760
add esp, 4
xor al, al
pop esi
pop ebx
ret 0x1ec
Function at 0x10004060
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x264]
sub esp, 0x264
push 0xffffffffffffffff
push 0x10017bd5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10030b94]
xor eax, ebp
mov dword [ebp + 0x260], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x98
lea esi, [ebp + 0x26c]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
push 0x260
call fcn.1000729f
add esp, 4
test eax, eax
je 0x100040c7
mov ecx, 0x98
lea esi, [ebp]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x100040c9
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10003370
push 0
push 0
call fcn.1000be36
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1000413d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x10004130
push ecx
push eax
call fcn.10006884
add esp, 8
test eax, eax
jne 0x10004137
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x260]
xor ecx, ebp
call fcn.100075f7
lea esp, [ebp + 0x264]
pop ebp
ret
push 1
call fcn.10006ef6
push eax
call fcn.10006ec9
push 6
mov dword [ebp - 0x14], 0
call fcn.10006ef6
int3
Function at 0x10004f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esi
imul esi, dword [esp + 0xc], 0x2c
push edi
add esi, dword [0x10ba6480]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004f72
pop edi
pop esi
mov eax, 0xa
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x10004f98
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10004fb9
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10004fb9
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10004fb3
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10004fb9
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [esi + 0x14]
and bl, 1
mov al, bl
and cl, 0xfd
add al, al
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebp
ret
Function at 0x10005080
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x10030b94]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1000517f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10005178
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x10], 0x10
jb 0x1000515d
call ebx
cmp dword [esp + 0x1c], eax
jne 0x1000515d
call ebp
cmp dword [esp + 0x18], eax
je 0x1000515d
mov edx, dword [esi]
test edx, edx
jne 0x10005125
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x10ba57b8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10005178
jmp 0x10005150
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10005150
shl eax, 3
push eax
push edx
push 0
push dword [0x10ba57b8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10005178
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100050e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100051c7
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x100051c7
mov ebp, dword [esp + 0x3c]
nop
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100051c1
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebp
push dword [esp + 0x3c]
push edi
call fcn.10005810
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x10005190
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100075f7
add esp, 0x20
ret

Function at 0x10005a40
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
je 0x10005a98
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10005a87
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10005a7f
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10005a60
pop ebp
pop ebx
push dword [edi]
push 0
push dword [0x10ba57b8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
ret
Function at 0x10005aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10ba6470]
test eax, eax
je 0x10005abc
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10005b12
mov eax, dword [eax]
test eax, eax
jne 0x10005ab0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10005b0f
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x10005ae5
mov ecx, dword [0x10ba6470]
mov dword [eax], ecx
mov dword [0x10ba6470], eax
pop edi
pop esi
test eax, eax
jne 0x10005b12
xor eax, eax
ret
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
Function at 0x10005f30
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x10005f45
cmp cl, 0x90
je 0x10005f45
cmp cl, 0xcc
jne 0x10005f63
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x10005f5c
cmp byte [eax + edx], cl
jne 0x10005f63
inc eax
cmp eax, esi
jb 0x10005f52
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4327c0
Capabilities:
Encode data using xor

Disassembly:
and edi, dword [esi - 0x4d]
not dword [esi]
insb byte es:[edi], dx
sbb byte [edi - 0x4a], al
jns 0x432825
invalid
test al, 0x68
test al, 0x68
jecxz 0x432819
jno 0x4327b6
daa
xchg ebx, eax
adc dword [esi + eax*2 - 0x74], ecx
xor ah, byte [esp + ebp*2 + 0x36]
dec edi
std
invalid
xor eax, 0x1a2ec192
push eax
xchg ebx, eax
mov dl, 0x57
xor al, 0xb6
xchg edx, eax
add dl, byte [ecx + 0x7a4770e9]
in eax, 0x1c
xchg byte [edi - 0x53], al
sbb al, 0x86
inc edi
lodsd eax, dword [esi]
jae 0x4327d7
adc ebx, edx
sbb al, 3
push ss
mov edx, dword [edi - 0x58]
mov ecx, 0x736ae7aa
mov esp, 0x1e2a2307
jns 0x432814
push cs
in eax, 0x5d
lds edx, [edi + 0x38f2b7d1]
dec ecx
inc esi
mov dword [0x614c2216], eax
popal
invalid
add bh, 0xe3
mov esi, 0x7a620b36
sub dword [ebx + 0x651cc9f5], eax
sbb al, 0x65
cmp byte [edi], al
test eax, 0xa69ae015
inc ecx
cmc
sbb byte [edi], cl
loop 0x4327ea
les esi, [esi]
xchg edx, eax
mov dword [ebx + 0x56], esp
xchg ecx, eax
xchg esi, eax
pushal
cmp eax, dword [esi + 0x35]
fdivr dword [ebx + 0x785ffb8f]
xlatb
in eax, dx
stosd dword es:[edi], eax
inc ebx
jns 0x432880
clc
ret 0x8de8
test eax, 0xad18b4c3
push edi
jp 0x4328c4
jmp 0x4328d8
shr byte [ebx + eax*4], cl
or ebp, dword [ebp + 0x44]
add ah, 0x67
jmp 0x730dd05
adc edx, 0xffffffd2
test eax, 0xe18e8b5a
ljmp 0x1a21
Function at 0x43f087
Capabilities:
Encode data using xor

Disassembly:
lcall 0xbc7b, 0x80e81286
add al, 0xa0
xchg ecx, eax
cmc
xchg ebx, eax
push edi
mov dword [0xa312f16c], eax
or dword [edx - 0xeb75a19], ebx
enter 0x1d62, 0x7c
cld
in eax, dx
adc dword [eax - 0x49], 0x12
mov dh, 0xae
clc
clc
aad 0xb6
salc
mov dword [0x83ad2ca], eax
or dword [ebx - 0x40], esi
loop 0x43ef47
xchg edx, eax
dec ecx
mov cl, 0x66
shr byte [edx], cl
cdq
mov dh, 0x56
xchg esi, eax
lodsd eax, dword [esi]
mov bl, 0xd2
invalid
xor eax, 0x73308736
or esp, 0xfffffff0
jb 0x43f02b
dec edx
cmp bh, byte [edx + 0x27]
test byte [eax], ah
add al, 0xef
jle 0x43eff9
ja 0x43ef6c
xchg dword [esi - 0x530ed2f0], edx
sub dh, byte [ecx - 0x1bffe9f9]
lodsd eax, dword [esi]
push esp
cli
out 0x8b, al
imul byte [ebx]
in al, dx
pushal
push 0x1f
pop ds
loope 0x43f027
mov dword [0x220267c7], eax
insb byte es:[edi], dx
mov edx, 0x23a404f2
or byte [ebx - 0x46], dl
imul edi, dword [edi], 0x85f2379a
cmpsd dword [esi], dword es:[edi]
push esi
fsub st(5)
cmc
xor dh, byte [ebx]
cmp eax, 0xbc536ec0
push ebx
xchg esp, eax
sub dword [ecx - 0x195defac], 0xffffffa5
cmp byte [edi], dl
push edi
outsd dx, dword [esi]
out 0x23, eax
invalid
invalid
invalid
iretd
sar ecx, 0x73
push esi
jl 0x43efc8
cmp ebp, edx
sbb eax, edx
xor dl, byte [ebx - 0xe2df5cb]
xlatb
out 0xca, al
dec ebx
loop 0x43eff4
mov ebx, 0x8d56bd87
add ch, byte [0xd16efcfd]
call 0x8d19ad96
add cl, byte [eax + 0x75a1893]
xchg ebx, eax
cdq
loope 0x43f035
add ebp, dword [eax]
movsd dword es:[edi], dword [esi]
adc ecx, dword [esi + edx*2]
wait
jno 0x43f0b8
pop es
sbb ebp, esp
rcr ebp, cl
pop ebp
mul byte [ebx - 0x7c]
push edx
push edi
mov bh, 0xd1
mov bh, 0xd1
mov bh, 0xd1
imul ecx, dword [edi - 0x50], 0x7d
cli
enter 0xfffffffffffff1d1, 0x26
jecxz 0x43f042
cmc
push edi
imul esp, dword [ebx], 0xa
push edi
and esi, 0xffffffb8
adc dh, byte [edx + 3]
adc eax, 0x33093645
mov ch, 0x15
mov ch, 0x16
cmpsb byte [esi], byte es:[edi]
pop ss
mul dword [eax - 0x18dad720]
mov ch, 0xe0
adc eax, 0x50c715a0
mov al, byte [0x3350c715]
xor al, 0x83
xor esi, dword [ebx + eax*4]
dec eax
and esp, 0xffffffaf
jp 0x43f0b4
fist dword [eax + 0xe]
pop edi
sbb al, bl
in al, 0x1e
inc ebx
invalid

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd8c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
Function at 0x454465
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x1c
mov byte [0x4e85e14], al
dec ecx
imul ecx, eax, 0x7b
stosd dword es:[edi], eax
sbb dword [ecx + 0xa], ebp
or byte [ebx + ebx*4 - 0x4044a822], cl
clc
cdq
cmc
nop
imul ecx, dword [esi + 0x3d], 0x5b443679
fmul qword [esi]
dec ecx
mov ch, 0xa8
lodsd eax, dword [esi]
xchg dword [edx - 0x19], ebp
push ecx
clc
mov ebx, 0x22fcadb3
pop edx
dec eax
mov eax, 0xe97696f2
stosd dword es:[edi], eax
test al, 0x30
imul esi, dword [ecx + 0x193e0647], 0xffffffc4
and al, 0xf6
xor cl, byte [ecx]
pop ss
mov edi, 0x797ff66a
jecxz 0x45447d
aas
or eax, 0xfa4bb5e9
xchg ecx, eax
add ebp, dword [esi + 0x2b]
xor eax, 0x89e4dd92
xor ebp, dword [edi + 0x2c668091]
wait
mov al, 0x32
invalid

Function at 0x486422
Capabilities:
Encode data using xor

Disassembly:
ret 0xd7bc
out 0x30, eax
jnp 0x48642b
push esp
aam 0x55
in eax, dx
rcl ch, 1
out 0x78, al
cdq
aad 0xe6
js 0x4863c8
push edi
inc esi
out 0x79, al
dec esi
invalid

Function at 0x519d2c
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x56aa4511
imul byte [ebx + 0x14]
adc edx, 0x3a112be7
add byte [eax - 0x4c], bl
push ds
imul ebp, dword [ecx + eax*8], 0x98a3c262
shl dword [edx - 0x3e], 0xa3
cwde
shl dword [edx - 0x3e], 0xa3
cwde
invalid
cmp ch, byte [edx + 0x2a110137]
sbb al, 0x78
cli
xor byte [ebx - 0x34ae35c0], 0xe9
or dh, byte [ebp + 0x5e79f7b]
mov esp, edi
js 0x519d18
dec ebx
rcr dword [ebx - 0x42], 1
dec edx
push ds
mov ah, 0x26
cmc
push eax
and dword [ecx], esi
sti
push ecx
sti
xor byte [eax - 0x8ef5eb0], dh
adc al, 0x5b
sbb dword [esi - 0x36fdf5e2], ebp
scasb al, byte es:[edi]
push ds
or al, byte [edx]
leave
lds edi, [edx + 0x3edfc795]
jg 0x519d50
jnp 0x519d64
cmpsd dword [esi], dword es:[edi]
cmp cl, bl
add byte [eax - 0x25d33a1f], ch
pushal
pop ebx
jecxz 0x519d2d
xor eax, 0xb795bc6c
adc byte [eax], ch
das
test cl, 0x27
sal byte [ecx - 0x43], cl
sar byte [eax - 0xfa01bda], 0xf9
and esi, dword [ebx]
fist dword [eax]
movsb byte es:[edi], byte [esi]
nop
into
loopne 0x519d58
mov eax, 0x65003e24
aam 0x49
and al, 0x3e
add byte [ebp - 0x2c], ah
dec ecx
sbb byte [esi], 0xd5
jnp 0x519d9f
cmp edx, ebp
push eax
ret
Function at 0x57adf5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.005c9bd5
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x57ae7d
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.005c6d9c
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.0057ad25
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x57af78
shr edx, 2
je 0x57af43
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x57aed5
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x57aec9
test edx, edx
je 0x57afa4
jmp 0x57af85
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x57af85
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x57aff6
mov eax, 1
jmp 0x57b04b
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.00576775
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.005c7248
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.005c6d9c
add esp, 0x864
ret

Function at 0x57e565
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4712b2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a2f50]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x47f884
mov dword [esp + 0x20], 0x13
mov eax, ecx
invalid
Function at 0x59efb5
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
jecxz 0x59eeaf
xor byte [edx - 0x7f2e466f], ah
and eax, ebx
shl dword [ebx + 0x15d27951], 1
invalid
and dword [ebp - 0x7ed91e41], esp
jle 0x59eeed
or byte [0xce84c23c], dh
pushfd
in eax, dx
aam 0x78
nop
invalid
fbstp tbyte [edx - 0x77cdb8ab]
push 0x19c85779
sbb eax, 0x142d0689
nop dword [eax]
adc dword [eax], esi
push 0xb58e321
mov al, 0x5a
dec esp
xchg edi, eax
out dx, al
test eax, 0xa1a4ec73
inc eax
dec edx
and ah, dh
cli
jo 0x59eea7
and byte [edi + 0x59], ch
sbb al, 0x20
loopne 0x59ef4c
or dword [esi - 0x30], esi
mov dword [0xe3791f82], eax
cmc
xchg ebx, eax
fcom dword [ebx + 0x353161e1]
stosb byte es:[edi], al
xchg edi, eax
aam 0x11
ror byte [ebx - 0x70], cl
repne cmpsd dword [esi], dword es:[edi]
into
aam 0xb9
add edx, dword [ebp + 0x2e]
add byte [ebx - 0x38], cl
pushfd
ret
mov eax, dword [0x47e22adc]
mov eax, 0xb6ad63d0
mov dh, 0x26
inc ebp
push cs
cmp eax, 0xab2f3c30
cmp eax, 0xd018c106
and bh, ch
rcr dword [ebp - 0x6f996e41], 1
movsd dword es:[edi], dword [esi]
sub al, 0xaa
sahf
nop
inc edx
pushal
sub byte [ebx], cl
adc eax, 0xc1c03f59
jl 0x59ef33
jecxz 0x59efa0
inc ecx
aas
adc al, dl
jmp dword [ecx + 0x6c]
cmp al, 0x70
inc ecx
inc ecx
mov byte [esi], ch
xchg ecx, eax
add al, 0x3f
imul esi, dword [0x30a661d0], 0x6941ad3c
mov dl, 0x7d
cmpsb byte [esi], byte es:[edi]
xor byte [ebp*4 + 0x7db26941], bh
loopne 0x59ef8a
push ebx
mov al, byte [0x7e402f9d]
mov al, 0x8f
dec esi
pop esi
fsubrp st(7)
pushal
dec esp
sub eax, dword [edi + 2]
add ebp, dword [ebp - 0x2398b9eb]
lodsd eax, dword [esi]
adc eax, 0x6dc6746
jbe 0x59ef98
invalid
Function at 0x5c6145
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.00614f25
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x5c61cd
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.006120ec
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.005c6075
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x5c62c8
shr edx, 2
je 0x5c6293
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x5c6225
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x5c6219
test edx, edx
je 0x5c62f4
jmp 0x5c62d5
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x5c62d5
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x5c6346
mov eax, 1
jmp 0x5c639b
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.005c1ac5
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.00612598
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.006120ec
add esp, 0x864
ret