joyce8/EMBER2024-capa huggingface dataset:
Function at 0x511ae9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x38
mov eax, 0x20
dec eax
lea ebp, [0xcc58]
dec eax
lea edi, [0xc9b9]
dec ecx
mov esp, ecx
mov word [esp + 0x20], ax
dec eax
lea esi, [0xc9ab]
call fcn.0051b619
dec eax
mov edx, dword [0x131f6]
dec eax
lea ecx, [eax*8 + 8]
dec eax
lea ebx, [0xc99d]
call fcn.005139a9
dec esp
lea ebx, [0xc98d]
inc ebp
xor ecx, ecx
inc ebp
xor edx, edx
nop dword [eax + eax]
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
je 0x511bdf
inc ecx
cmp ch, 0x87
je 0x511cf9
jg 0x511c09
inc ecx
cmp ch, 0x83
je 0x511ccd
jg 0x511c6d
inc ecx
cmp ch, 0x81
je 0x511ce9
inc ecx
cmp ch, 0x82
jne 0x511c89
inc ebp
movsx edx, byte [esp + 1]
dec ebp
lea eax, [esp + 2]
mov edx, 0x24
inc esp
mov ecx, edx
and ecx, 0xf
cmp cl, 0xa
dec esp
mov ecx, ebx
dec eax
cmovne ecx, ebx
dec eax
add ecx, 1
dec ebp
mov esp, eax
nop
dec eax
add eax, 1
dec eax
add ecx, 1
mov byte [eax - 1], dl
movzx edx, byte [ecx - 1]
test dl, dl
jne 0x511bb9
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
jne 0x511b5c
inc ecx
and ecx, 1
je 0x511bec
mov byte [eax], 0x22
dec eax
add eax, 1
mov byte [eax], 0
dec eax
mov dword [0x13123], eax
dec eax
add esp, 0x38
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
cmp ch, 0x24
je 0x511d14
jle 0x511c99
inc ecx
cmp ch, 0x3d
jne 0x511d2d
inc ebp
test edx, edx
je 0x511d48
inc esp
mov edx, edx
inc ebx
lea ecx, [ecx + ecx]
and edx, 0xf
cmp edx, 1
dec eax
arpl dx, dx
inc esp
cmovne ecx, ecx
inc ecx
test dl, 0x10
dec eax
lea ecx, [ebp + edx*4]
je 0x511d50
mov byte [eax], 0x3a
movzx edx, byte [ecx]
dec eax
add eax, 1
dec eax
add ecx, 1
test dl, dl
dec ebp
mov esp, eax
jne 0x511bb9
jmp 0x511b49
inc ecx
cmp ch, 0x84
je 0x511cb9
inc ecx
cmp ch, 0x86
mov edx, 0x24
dec eax
lea ecx, [0xc841]
je 0x511bb0
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x511b49
inc ecx
cmp ch, 0x88
jne 0x511d0a
inc ecx
xor ecx, 1
dec ebp
mov esp, eax
inc ecx
mov ebp, 0x22
inc esp
mov byte [eax], ch
dec eax
add eax, 1
jmp 0x511b49
dec eax
lea ecx, [0xc813]
dec ebp
mov esp, eax
mov edx, 0x24
jmp 0x511bb9
inc ecx
test cl, 1
dec eax
mov ecx, esi
dec eax
cmovne ecx, edi
inc ecx
sar ecx, 1
inc ebp
xor edx, edx
movzx edx, byte [ecx]
adc ecx, ebp
jae 0x511ce3
invalid
invalid
inc ebp
movzx ebp, byte [esp + 1]
dec ecx
add esp, 2
jmp 0x511cac
mov edx, 0x29
dec eax
lea ecx, [0xc7c3]
jmp 0x511bb0
inc ecx
cmp ch, 0x22
jne 0x511c89
mov byte [eax], 0x5c
inc esp
mov byte [esp + 0x20], ch
inc esp
mov edx, ebp
dec eax
add eax, 1
dec eax
lea ecx, [esp + 0x20]
jmp 0x511bb0
inc ecx
cmp ch, 0x5c
je 0x511d14
inc ecx
cmp ch, 0x27
je 0x511d14
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x511b49
dec ebp
mov esp, eax
jmp 0x511cac
movzx edx, byte [ecx]
jmp 0x511c59
Function at 0x554e3a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x554e5a
mov dword [esp], 0x6d8654
call fcn.005741dd
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x7bfa34]
call eax
test eax, eax
jne 0x554e79
mov al, 1
jmp 0x555078
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x554e93
mov dword [esp], 0x6d865c
call fcn.005741dd
mov dword [esp + 8], 1
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.005857a5
xor eax, 1
test al, al
je 0x554ebb
mov al, 0
jmp 0x555078
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
cmp al, 0x2e
jne 0x554ee2
inc dword [ebp - 0xc]
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x554efc
mov dword [esp], 0x6d8664
call fcn.005741dd
mov dword [ebp - 0x1c], 0
jmp 0x554f59
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
movsx eax, al
test eax, eax
je 0x554f18
cmp eax, 0x2e
je 0x554f21
jmp 0x554f53
mov dword [ebp - 0x1c], 1
jmp 0x554f56
cmp dword [ebp - 0x14], 0
jne 0x554f2e
mov al, 0
jmp 0x555078
mov eax, dword [ebp - 0xc]
inc eax
mov al, byte [eax]
test al, al
jne 0x554f41
mov dword [ebp - 0x1c], 1
jmp 0x554f56
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
inc dword [ebp - 0x10]
jmp 0x554f56
inc dword [ebp - 0x14]
inc dword [ebp - 0xc]
cmp dword [ebp - 0x1c], 0
je 0x554f05
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x554f79
mov dword [esp], 0x6d866c
call fcn.005741dd
cmp dword [ebp - 0x10], 1
jg 0x554f86
mov al, 0
jmp 0x555078
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x554fa0
mov dword [esp], 0x6d8674
call fcn.005741dd
cmp dword [ebp - 0x10], 2
jne 0x554ffd
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
jmp 0x554fe7
mov eax, dword [ebp - 0x20]
mov eax, dword [eax*4 + 0x6ca020]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.005857a5
test al, al
je 0x554fe4
mov dword [ebp - 0x24], 1
jmp 0x554fed
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jbe 0x554fb6
cmp dword [ebp - 0x24], 0
jne 0x554ffd
cmp dword [ebp - 0x18], 3
jg 0x554ffd
mov al, 0
jmp 0x555078
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x555017
mov dword [esp], 0x6d867c
call fcn.005741dd
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2e
je 0x55505c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call 0x814568
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call 0x814568
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x28]
jle 0x55505c
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x28]
lea edx, [eax - 1]
mov eax, dword [ebp + 0xc]
add eax, edx
mov al, byte [eax]
cmp al, 0x2e
je 0x55505c
mov al, 0
jmp 0x555078
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x555076
mov dword [esp], 0x6d8684
call fcn.005741dd
mov al, 1
leave
ret
Function at 0x562541
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x562589
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0x6ed514
call fcn.005741dd
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
test eax, eax
jg 0x5625c7
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x5625bc
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0x6ed53a
call fcn.005741dd
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0056250e
nop
leave
ret

Function at 0x5741dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov al, byte [0x7bde7b]
test al, al
je 0x574244
call fcn.0057499e
mov al, byte [0x7b11d8]
test al, al
jne 0x574243
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call 0x814628
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00573eaa
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
xor eax, 1
test al, al
jne 0x574215
jmp 0x574244
nop
leave
ret
Function at 0x58a584
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax - 2]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x58a658
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov edx, eax
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
shr al, 4
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
and eax, 0xff
shl eax, 2
and eax, 0x3c
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 2
mov al, byte [eax]
shr al, 6
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
add eax, 2
mov al, byte [eax]
and eax, 0xff
and eax, 0x3f
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
add dword [ebp - 4], 3
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x58a5a9
mov eax, dword [ebp + 0xc]
mov ecx, 3
mov edx, 0
div ecx
mov eax, edx
cmp eax, 1
je 0x58a684
cmp eax, 2
je 0x58a6e1
jmp 0x58a763
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
jmp 0x58a763
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov edx, eax
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
shr al, 4
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
and eax, 0xff
shl eax, 2
and eax, 0x3c
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
nop
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
sub edx, eax
mov eax, edx
leave
ret
Function at 0x5961e5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x38
mov eax, 0x20
dec eax
lea ebp, [0xcc58]
dec eax
lea edi, [0xc9b9]
dec ecx
mov esp, ecx
mov word [esp + 0x20], ax
dec eax
lea esi, [0xc9ab]
call fcn.0059fd15
dec eax
mov edx, dword [0x131f6]
dec eax
lea ecx, [eax*8 + 8]
dec eax
lea ebx, [0xc99d]
call fcn.005980a5
dec esp
lea ebx, [0xc98d]
inc ebp
xor ecx, ecx
inc ebp
xor edx, edx
nop dword [eax + eax]
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
je 0x5962db
inc ecx
cmp ch, 0x87
je 0x5963f5
jg 0x596305
inc ecx
cmp ch, 0x83
je 0x5963c9
jg 0x596369
inc ecx
cmp ch, 0x81
je 0x5963e5
inc ecx
cmp ch, 0x82
jne 0x596385
inc ebp
movsx edx, byte [esp + 1]
dec ebp
lea eax, [esp + 2]
mov edx, 0x24
inc esp
mov ecx, edx
and ecx, 0xf
cmp cl, 0xa
dec esp
mov ecx, ebx
dec eax
cmovne ecx, ebx
dec eax
add ecx, 1
dec ebp
mov esp, eax
nop
dec eax
add eax, 1
dec eax
add ecx, 1
mov byte [eax - 1], dl
movzx edx, byte [ecx - 1]
test dl, dl
jne 0x5962b5
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
jne 0x596258
inc ecx
and ecx, 1
je 0x5962e8
mov byte [eax], 0x22
dec eax
add eax, 1
mov byte [eax], 0
dec eax
mov dword [0x13123], eax
dec eax
add esp, 0x38
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
cmp ch, 0x24
je 0x596410
jle 0x596395
inc ecx
cmp ch, 0x3d
jne 0x596429
inc ebp
test edx, edx
je 0x596444
inc esp
mov edx, edx
inc ebx
lea ecx, [ecx + ecx]
and edx, 0xf
cmp edx, 1
dec eax
arpl dx, dx
inc esp
cmovne ecx, ecx
inc ecx
test dl, 0x10
dec eax
lea ecx, [ebp + edx*4]
je 0x59644c
mov byte [eax], 0x3a
movzx edx, byte [ecx]
dec eax
add eax, 1
dec eax
add ecx, 1
test dl, dl
dec ebp
mov esp, eax
jne 0x5962b5
jmp 0x596245
inc ecx
cmp ch, 0x84
je 0x5963b5
inc ecx
cmp ch, 0x86
mov edx, 0x24
dec eax
lea ecx, [0xc841]
je 0x5962ac
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x596245
inc ecx
cmp ch, 0x88
jne 0x596406
inc ecx
xor ecx, 1
dec ebp
mov esp, eax
inc ecx
mov ebp, 0x22
inc esp
mov byte [eax], ch
dec eax
add eax, 1
jmp 0x596245
dec eax
lea ecx, [0xc813]
dec ebp
mov esp, eax
mov edx, 0x24
jmp 0x5962b5
inc ecx
test cl, 1
dec eax
mov ecx, esi
dec eax
cmovne ecx, edi
inc ecx
sar ecx, 1
inc ebp
xor edx, edx
movzx edx, byte [ecx]
adc ecx, ebp
jae 0x5963df
invalid
invalid
inc ebp
movzx ebp, byte [esp + 1]
dec ecx
add esp, 2
jmp 0x5963a8
mov edx, 0x29
dec eax
lea ecx, [0xc7c3]
jmp 0x5962ac
inc ecx
cmp ch, 0x22
jne 0x596385
mov byte [eax], 0x5c
inc esp
mov byte [esp + 0x20], ch
inc esp
mov edx, ebp
dec eax
add eax, 1
dec eax
lea ecx, [esp + 0x20]
jmp 0x5962ac
inc ecx
cmp ch, 0x5c
je 0x596410
inc ecx
cmp ch, 0x27
je 0x596410
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x596245
dec ebp
mov esp, eax
jmp 0x5963a8
movzx edx, byte [ecx]
jmp 0x596355
Function at 0x5d0f0d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4347f7
call fcn.005f79d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.005c6b86
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.005c6b86
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.005c6b86
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.005c6b86
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.005c6b86
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.005c6b86
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.005c6b86
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x5d1676
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43491f
call fcn.005f79d1
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005c6c59
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.005c6c59
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.005c6c59
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.005c6c59
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.005c6c59
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.005c6c59
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.005c6c59
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x5d6f43
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x5d6f70
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x444740]
xor eax, edi
inc esi
cmp esi, edx
jb 0x5d6f4f
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x5d9d97
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, ecx
jbe 0x5d9eae
mov ecx, edx
mov edx, dword [esp + 4]
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
dec ecx
jne 0x5d9da7
ret 4
Function at 0x5da993
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov dword [ebp - 8], ecx
push esi
xor ebx, ebx
xor eax, eax
push edi
mov dword [ebp - 4], edx
xor ecx, ecx
mov byte [ebp + eax - 0x50], bl
add eax, 1
adc ecx, ebx
jne 0x5da9b8
cmp eax, 0x40
jb 0x5da9a8
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xc], ebx
jb 0x5daa49
ja 0x5da9cd
cmp dword [ebp + 8], ebx
jbe 0x5daa49
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
cmp edx, ebx
je 0x5da9ef
mov eax, edi
xor ecx, ecx
and eax, 0xff
or eax, ecx
jne 0x5da9ef
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 8]
cmp eax, ebx
jne 0x5daa4b
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov eax, dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push esi
call dword [eax + 0x14]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
cmp eax, 0x40
ja 0x5daa52
xor ecx, ecx
xor edx, edx
cmp eax, ebx
jbe 0x5daa29
xor ecx, dword [ebp + edx - 0x50]
add edx, 4
cmp edx, eax
jb 0x5daa1e
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x5daa34
cmp ecx, dword [eax]
jne 0x5daa52
add edi, 1
adc dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x5da9d0
ja 0x5daa49
cmp edi, dword [ebp + 8]
jb 0x5da9d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
push 1
pop eax
jmp 0x5daa4b

Function at 0x5db2dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435422
call fcn.005f79d1
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.005db382
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.005d178b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x5db2e8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435422
call fcn.005f79d1
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.005db382
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.005d178b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x5dd830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43578a
call fcn.005f79d1
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.005c6b86
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.005dd88a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x5dd83b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43578a
call fcn.005f79d1
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.005c6b86
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.005dd88a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x5dd8dc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4357d5
call fcn.005f79d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.005e627e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.005dd932
push dword [esi + 0x24]
call fcn.005c5d5a
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.005f5026
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.005dde6f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret