joyce8/EMBER2024-capa huggingface dataset:
Function at 0x540250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x3234c]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea ebx, [ebx]
xor edx, edx
lea ecx, [edx + 1]
mov dword [ebp - 4], 4
lea esp, [esp]
movzx ebx, word [edi + ecx*2 + 0x329f0]
mov eax, esi
and eax, 1
mov edi, eax
neg edi
sar edi, 4
and edi, 0x7f
shr ebx, 4
xor ebx, edi
mov edi, dword [ebp + 8]
add edx, dword [edi + ebx*4 + 0x30c9c]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [ebp - 4], 1
jne 0x540280
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp esi, 0x10
jb 0x540270
mov dword [edi + 0x3238c], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5402e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
mov edi, 4
lea ebx, [esi + 0x30c9c]
jmp 0x540300
movzx edx, byte [esi + edi + 0x3049c]
mov ecx, edx
mov dword [ebp - 4], edx
and edx, 1
shr ecx, 1
or edx, 2
dec ecx
shl edx, cl
mov eax, edi
push ebx
sub eax, edx
sub edx, dword [ebp - 4]
lea edx, [esi + edx*2 + 0x3290a]
push edx
call fcn.0053e570
mov dword [ebp + edi*4 - 0x214], eax
inc edi
add esp, 8
cmp edi, 0x80
jb 0x540300
lea edx, [ebp - 0x214]
sub edx, esi
lea eax, [esi + 0x3270c]
lea ebx, [esi + 0x31b54]
sub edx, 0x31b4c
lea edi, [esi + 0x3174c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 0x32390], ecx
jbe 0x5403d1
lea ecx, [ecx]
mov eax, ecx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x5403bf
lea esp, [esp]
mov ebx, dword [ebp - 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebx, 4
xor ebx, eax
add edx, dword [esi + ebx*4 + 0x30c9c]
mov eax, ecx
cmp eax, 1
jne 0x540390
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov dword [edi + ecx*4], edx
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, dword [esi + 0x32390]
jb 0x540380
mov edx, dword [ebp - 0x14]
mov eax, 0xe
cmp dword [esi + 0x32390], eax
jbe 0x5403f6
mov edi, edi
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [esi + 0x32390]
jb 0x5403e0
mov eax, dword [edi]
mov dword [ebx - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebx - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebx], eax
mov ecx, dword [edi + 0xc]
mov dword [ebx + 4], ecx
mov eax, 4
lea ecx, [ebx + 8]
jmp 0x540420
movzx ebx, byte [esi + eax + 0x3049c]
mov ebx, dword [edi + ebx*4]
add ebx, dword [edx + ecx]
inc eax
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x80
jb 0x540420
mov ebx, dword [ebp - 8]
sub dword [ebp - 0xc], 0xffffff80
sub edx, 0x200
add ebx, 0x200
add edi, 0x100
sub dword [ebp - 4], 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], ebx
jne 0x540370
pop edi
mov dword [esi + 0x3baf0], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5415d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x50], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x4c], edx
mov dword [eax + 0x54], edx
lea esi, [eax + 0x6c]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x5415f7
pop esi
ret

Function at 0x542ca0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x542cab
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.00542cc0
Function at 0x5459c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ccfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6385e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push 0x643954
mov dword [esp + 0x18], 0x643954
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
cmp byte [0x643824], 0
jne 0x545a33
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 2
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call fcn.00545cd0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x545a66
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebx + 0x10], 0
je 0x545a8f
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 5
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebx + 0x2c]
push ecx
lea edx, [esp + 0x20]
lea edi, [ebx + 0x14]
push edx
call fcn.005482d0
mov ecx, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push ecx
call esi
test eax, eax
jne 0x545ae4
lea esi, [esp + 0x1c]
call fcn.00548330
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xa
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
sub edx, eax
sub edx, 5
mov dword [esp + 0x15], edx
mov dl, byte [esp + 0x18]
mov byte [esp + 0x14], 0xe9
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
lea eax, [esp + 0x10]
push eax
push ecx
push 5
push edx
call esi
lea esi, [esp + 0x1c]
call fcn.00548330
push 0x643954
mov byte [ebx + 0x10], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ccf88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6385e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push 0x643954
mov dword [esp + 0x1c], 0x643954
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
cmp byte [0x643824], 0
jne 0x545bc3
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 2
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call fcn.00545cd0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x545bf6
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebx + 0x10], 0
jne 0x545c1f
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 6
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebx + 0x2c]
push ecx
lea edx, [esp + 0x20]
lea edi, [ebx + 0x14]
push edx
call fcn.005482d0
mov ecx, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
push eax
push 0x40
push 5
push ecx
call esi
test eax, eax
jne 0x545c74
lea esi, [esp + 0x1c]
call fcn.00548330
push 0x643954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xa
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebx]
mov dword [ecx], edx
mov al, byte [eax + 4]
mov byte [ecx + 4], al
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push edx
push 5
push eax
call esi
lea esi, [esp + 0x1c]
call fcn.00548330
push 0x643954
mov byte [ebx + 0x10], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x548370
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cce98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6385e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x5483b5
push eax
jmp 0x548410
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x2c], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x54840f
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
cmp dword [ebp - 0x20], eax
jne 0x548401
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x24], eax
je 0x548401
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x24]
call fcn.005487c0
lea ecx, [ebp - 0x2c]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x5483e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x548430
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xc]
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x2f0], esi
call fcn.00407370
cmp dword [esi + 0xc], ebx
ja 0x548465
cmp ebx, dword [esi + 0x10]
jbe 0x54846a
call fcn.0054dbee
push esi
lea ecx, [ebp - 0x2ec]
call fcn.004067e0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], ebx
lea eax, [ebp - 0x2f0]
lea ebx, [ebp - 0x2ec]
call fcn.00547c20
lea esp, [esp]
lea ecx, [ebp - 0x2e4]
call fcn.004073e0
test al, al
je 0x5484c5
lea ecx, [ebp - 0x2ec]
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.004073c0
test al, al
jne 0x5484ca
call fcn.0054dbee
mov edx, dword [ebp - 0x2e0]
cmp edx, dword [ebp - 0x2e8]
je 0x54860d
lea ecx, [ebp - 0x2e4]
call fcn.004073e0
test al, al
jne 0x5484f0
call fcn.0054dbee
lea ecx, [ebp - 0x2e4]
call fcn.00407390
mov ecx, dword [ebp - 0x2e0]
cmp ecx, dword [eax + 0x10]
jb 0x54850b
call fcn.0054dbee
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2c8
lea ecx, [ebp - 0x2d8]
push 0
push ecx
call fcn.00555bf0
add esp, 0xc
lea edx, [ebp - 0x2dc]
push edx
push ebx
mov dword [ebp - 0x2dc], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x548606
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
xor esi, esi
sar eax, 2
test eax, eax
jbe 0x5485b6
cmp esi, eax
jb 0x548575
call fcn.0054dbee
mov ecx, dword [edi + 0xc]
mov eax, dword [ebp - 0x224]
cmp eax, dword [ecx + esi*4]
je 0x548592
mov eax, dword [edi + 0x10]
sub eax, ecx
inc esi
sar eax, 2
cmp esi, eax
jb 0x548575
jmp 0x5485b6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
sar ecx, 2
cmp esi, ecx
jb 0x5485aa
call fcn.0054dbee
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + esi*4]
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x2dc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2e4]
call fcn.004073e0
test al, al
jne 0x5485df
call fcn.0054dbee
lea ecx, [ebp - 0x2e4]
call fcn.00407390
mov edx, dword [ebp - 0x2e0]
cmp edx, dword [eax + 0x10]
jb 0x5485fa
call fcn.0054dbee
add dword [ebp - 0x2e0], 4
jmp 0x5484a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret
Function at 0x548620
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
push edi
mov edi, dword [esi + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.00407370
cmp dword [esi + 0xc], edi
ja 0x548643
cmp edi, dword [esi + 0x10]
jbe 0x548648
call fcn.0054dbee
push esi
lea ecx, [ebp - 0x14]
call fcn.004067e0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
lea ebx, [ebp - 0x14]
mov dword [ebp - 8], edi
call fcn.00547c20
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0xc]
call fcn.004073e0
test al, al
je 0x54868d
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004073c0
test al, al
jne 0x548692
call fcn.0054dbee
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
je 0x548707
lea ecx, [ebp - 0xc]
call fcn.004073e0
test al, al
jne 0x5486ab
call fcn.0054dbee
lea ecx, [ebp - 0xc]
call fcn.00407390
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x10]
jb 0x5486c0
call fcn.0054dbee
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0
push 2
call edi
mov esi, eax
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.004073e0
test al, al
jne 0x5486e9
call fcn.0054dbee
lea ecx, [ebp - 0xc]
call fcn.00407390
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x10]
jb 0x5486fe
call fcn.0054dbee
add dword [ebp - 8], 4
jmp 0x548671
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54cb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.0054b5c0
add esp, 8
mov eax, 0xa0
mov esi, dword [esp + 0x18]
lea edi, [esi + eax]
add esi, 0x20
mov edx, dword [esi - 0x10]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
mov eax, dword [ebx*8 + 0x637800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637803]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637802]
movzx ebx, dh
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637801]
mov dword [esi - 0x10], eax
mov edx, dword [esi - 0xc]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
mov eax, dword [ebx*8 + 0x637800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637803]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637802]
movzx ebx, dh
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637801]
mov dword [esi - 0xc], eax
mov edx, dword [esi - 8]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
mov eax, dword [ebx*8 + 0x637800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637803]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637802]
movzx ebx, dh
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637801]
mov dword [esi - 8], eax
mov edx, dword [esi - 4]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
mov eax, dword [ebx*8 + 0x637800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637803]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637802]
movzx ebx, dh
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637801]
mov dword [esi - 4], eax
mov edx, dword [esi]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
mov eax, dword [ebx*8 + 0x637800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637803]
movzx ebx, dl
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637802]
movzx ebx, dh
movzx ebx, byte [ebx*8 + 0x637001]
xor eax, dword [ebx*8 + 0x637801]
mov dword [esi], eax
xor eax, dword [esi - 0xc]
mov dword [esi + 4], eax
xor eax, dword [esi - 8]
mov dword [esi + 8], eax
xor eax, dword [esi - 4]
mov dword [esi + 0xc], eax
add esi, 0x10
cmp edi, esi
jg 0x54cc89
jmp 0x54d1c0
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ebp, dword [edi]
mov edx, dword [edi + 4]
mov dword [esi], ebp
mov dword [esi + 4], edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov ebp, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esi + 8], ebp
mov dword [esi + 0xc], edx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
add esi, 0x10
sub edi, 0x10
cmp edi, esi
jg 0x54d1c4
pop edi
pop esi
pop ebx
pop ebp
xor eax, eax
ret
Function at 0x54d4f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6385e0]
jne 0x54d4ff
repz ret
jmp fcn.005542c6

Function at 0x55fcf5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00555463
and dword [ebp - 4], 0
cmp dword [0x64322c], 0
mov ebx, eax
jne 0x55fda6
push 0x5d8934
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55fe57
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5d8928
push edi
call esi
test eax, eax
je 0x55fe57
push eax
call fcn.005553f1
mov dword [esp], 0x5d8918
push edi
mov dword [0x64322c], eax
call esi
push eax
call fcn.005553f1
mov dword [esp], 0x5d8904
push edi
mov dword [0x643230], eax
call esi
push eax
call fcn.005553f1
mov dword [esp], 0x5d88e8
push edi
mov dword [0x643234], eax
call esi
push eax
call fcn.005553f1
pop ecx
mov dword [0x64323c], eax
test eax, eax
je 0x55fda6
push 0x5d88d0
push edi
call esi
push eax
call fcn.005553f1
pop ecx
mov dword [0x643238], eax
mov eax, dword [0x643238]
cmp eax, ebx
je 0x55fdfe
cmp dword [0x64323c], ebx
je 0x55fdfe
push eax
call fcn.0055546c
push dword [0x64323c]
mov esi, eax
call fcn.0055546c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x55fdfe
test edi, edi
je 0x55fdfe
call esi
test eax, eax
je 0x55fdf5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55fdf5
test byte [ebp - 0xc], 1
jne 0x55fdfe
or dword [ebp + 0x10], 0x200000
jmp 0x55fe37
mov eax, dword [0x643230]
cmp eax, ebx
je 0x55fe37
push eax
call fcn.0055546c
pop ecx
test eax, eax
je 0x55fe37
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x55fe37
mov eax, dword [0x643234]
cmp eax, ebx
je 0x55fe37
push eax
call fcn.0055546c
pop ecx
test eax, eax
je 0x55fe37
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x64322c]
call fcn.0055546c
pop ecx
test eax, eax
je 0x55fe57
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55fe59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5658c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
jb 0x565925
push edi
mov edi, esi
shr edi, 3
jmp 0x5658e0
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 3]
xor byte [eax + 3], dl
movzx edx, byte [ecx + 4]
xor byte [eax + 4], dl
movzx edx, byte [ecx + 5]
xor byte [eax + 5], dl
movzx edx, byte [ecx + 6]
xor byte [eax + 6], dl
movzx edx, byte [ecx + 7]
xor byte [eax + 7], dl
add eax, 8
add ecx, 8
sub esi, 8
sub edi, 1
jne 0x5658e0
pop edi
test esi, esi
je 0x56593b
sub ecx, eax
jmp 0x565930
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x565930
pop esi
ret
Function at 0x568a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bf279
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6385e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
mov edi, dword [ecx]
push eax
mov eax, dword [edi + 4]
push edx
mov dword [esp + 0x20], 3
call eax
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
add eax, eax
add eax, eax
push eax
push edx
mov edx, dword [edi + 4]
mov byte [esp + 0x20], 2
call edx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x28]
mov edi, dword [ecx]
push eax
mov eax, dword [edi + 4]
push edx
mov byte [esp + 0x20], 1
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
add eax, eax
push eax
mov eax, dword [esi + 0x18]
push eax
mov byte [esp + 0x20], 0
call edx
mov dword [esi], vtable.Botan::SymmetricAlgorithm.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x569730
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bf4e5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6385e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
cmp dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov edi, 1
je 0x5697d8
mov dword [esi + 4], 0x5d931c
mov dword [esi + 0x88], 0x5d93f0
mov dword [esi + 0x12c], 0x5d9314
mov dword [esi + 0x80], vtable.Botan::Public_Key.0
push 0
lea ecx, [esi + 0x84]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
call fcn.00569660
mov eax, dword [esi + 0x12c]
mov dword [esi + method.Botan::Public_Key.virtual_16], vtable.Botan::Private_Key.0
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], edi
mov dword [ecx + esi + method.Botan::DataSource.virtual_0], 0x5d925c
mov dword [esp + 0x10], 7
mov edx, dword [esi + 4]
mov dword [esi], vtable.Botan::IF_Scheme_PrivateKey.3.0
mov eax, dword [edx + 4]
mov dword [eax + esi + 4], vtable.Botan::IF_Scheme_PrivateKey.2.0
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 8]
mov dword [edx + esi + 4], vtable.Botan::IF_Scheme_PrivateKey.1.0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
mov dword [ecx + esi + 4], vtable.Botan::IF_Scheme_PrivateKey.0
lea ebx, [esi + 8]
push 0
mov ecx, ebx
call fcn.005694f0
mov dword [ebx + 0x10], edi
lea ebx, [esi + 0x1c]
push 0
mov ecx, ebx
mov dword [esp + 0x24], 2
call fcn.005694f0
mov dword [ebx + 0x10], edi
lea ebx, [esi + 0x30]
push 0
mov ecx, ebx
mov byte [esp + 0x24], 3
call fcn.005694f0
mov dword [ebx + 0x10], edi
lea ebx, [esi + 0x44]
push 0
mov ecx, ebx
mov byte [esp + 0x24], 4
call fcn.005694f0
mov dword [ebx + 0x10], edi
lea ebx, [esi + 0x58]
push 0
mov ecx, ebx
mov byte [esp + 0x24], 5
call fcn.005694f0
mov dword [ebx + 0x10], edi
lea ebx, [esi + 0x6c]
push 0
mov ecx, ebx
mov byte [esp + 0x24], 6
call fcn.005694f0
mov dword [ebx + 0x10], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4

Function at 0x569f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c0c78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x6385e0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
push str.Internal_error:
push ecx
call fcn.00447490
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00565b20
cmp dword [esp + 0x20], 0x10
jb 0x569fb1
mov edx, dword [esp + 0xc]
push edx
call fcn.0054d4ea
add esp, 4
mov eax, esi
mov dword [esi], vtable.Botan::Internal_Error.0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4