joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1bd0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4f1bd8
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f1d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x4f1d98
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x38]
call fcn.00406cf0
lea ecx, [ebp - 0xc]
mov edx, 0x4f1db8
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00406cf0
lea ecx, [ebp - 0x10]
mov edx, 0x4f1dd4
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x18]
call fcn.00406cf0
lea ecx, [ebp - 0x14]
mov edx, 0x4f1df0
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.00406cf0
lea ecx, [ebp - 0x18]
mov edx, 0x4f1e0c
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x1c]
call fcn.00406cf0
lea ecx, [ebp - 0x1c]
mov edx, 0x4f1e28
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x1c]
mov eax, 0x4f1e44
call fcn.004130ec
mov byte [ebx + 4], al
lea ecx, [ebp - 0x20]
mov edx, 0x4f1e5c
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call fcn.00406cf0
lea ecx, [ebp - 0x24]
mov edx, 0x4f1e80
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x10]
call fcn.00406cf0
lea ecx, [ebp - 0x28]
mov edx, 0x4f1e98
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x24]
call fcn.00406cf0
lea ecx, [ebp - 0x2c]
mov edx, 0x4f1eb8
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x30]
call fcn.00406cf0
lea ecx, [ebp - 0x30]
mov edx, 0x4f1ed0
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x28]
call fcn.00406cf0
lea ecx, [ebp - 4]
mov edx, 0x4f1eec
mov eax, esi
call fcn.004cbb74
cmp dword [ebp - 4], 0
je 0x4f1d3c
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4f1f00
call fcn.004071d4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00413f34
mov dword [ebx + 0x20], eax
lea ecx, [ebp - 0x34]
mov edx, 0x4f1f10
mov eax, esi
call fcn.004cbb74
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x2c]
call fcn.00406cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1d85
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00406ce8
ret
Function at 0x5184e8
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5185f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.0051840c
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
mov eax, dword [esi + 0x18]
push eax
call fcn.004ca708
test eax, eax
je 0x5185ba
mov eax, ebx
call fcn.00517da0
mov eax, ebx
call fcn.005192bc
mov edx, dword [ebp - 4]
call fcn.004ce8f4
mov eax, ebx
call fcn.005192bc
cmp dword [eax + 0x24], 0x190
jl 0x5185d5
mov eax, ebx
call fcn.005192bc
mov eax, dword [eax + 0x24]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x5d0448]
call fcn.0040a130
mov eax, dword [ebp - 0x14]
push eax
mov eax, ebx
call fcn.005192bc
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
pop eax
call fcn.004150b0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4ce038]
call fcn.004ce978
call fcn.004059cc
jmp 0x5185d5
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5d037c]
call fcn.0040a130
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, ebx
call fcn.00517cd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5185ff
lea eax, [ebp - 0x20]
call fcn.00406ce0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ce8
ret
Function at 0x522994
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5229c2
mov eax, ebx
call fcn.00523448
cmp dword [ebx + 0x40], 0
je 0x5229bb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x522a33
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x522a25
cmp dword [ebx + 8], 0
je 0x5229e4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5229f6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x522a25
cmp dword [ebx + 8], 0
je 0x5229d7
cmp eax, 3
je 0x522a09
dec eax
jne 0x5229d7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5229d7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5229d7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x522a51
cmp dword [ebx + 0x14], 0xcc
je 0x522a51
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00522a5c
pop ebx
ret

Function at 0x5376f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x537708
add esp, 0xfffffff0
call fcn.00405428
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x537822
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404214
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x53780c
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.005334c0
xor eax, eax
push ebp
push 0x5377f9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.005334c0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00406f68
jmp 0x5377ca
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407510
mov eax, dword [ebx + 4]
call fcn.00407070
dec eax
jle 0x5377de
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5377b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537800
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537829
lea eax, [ebp - 4]
call fcn.00406948
ret
Function at 0x53d3f8
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov esi, eax
mov eax, dword [esi + 0x38]
call fcn.00437a14
test eax, eax
setg bl
test bl, bl
je 0x53d4a9
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [esi + 0x5c]
call fcn.00406d7c
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
setne bl
test bl, bl
je 0x53d4a9
mov eax, esi
call fcn.0053dc7c
cmp edx, 0
jne 0x53d454
cmp eax, 0
jbe 0x53d4a3
jmp 0x53d456
jle 0x53d4a3
xor eax, eax
mov dword [esp], eax
push esp
push edi
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
xor eax, eax
or eax, dword [esp + 8]
or edx, dword [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, esi
call fcn.0053dc7c
cmp edx, dword [esp + 0xc]
jne 0x53d4a0
cmp eax, dword [esp + 8]
sete bl
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x543190
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5d64d0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5431b2
shr eax, 1
xor eax, 0xedb88320
jmp 0x5431b4
shr eax, 1
dec edx
jne 0x5431a0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x543199
mov byte [0x5d68d0], 1
pop esi
pop ebx
ret

Function at 0x5431d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5d68d0], 0
jne 0x5431e7
call fcn.00543190
mov eax, edi
dec eax
test eax, eax
jl 0x54320f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5d64d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5431f1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x545fb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x546052.0
jmp dword [ecx*4 + 0x545feb]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x54601d
sub dl, 8
je 0x54602c
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545c60
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545cb8
jmp case.0x546052.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x546052.0
movzx ecx, byte [ecx + 0x546059]
jmp dword [ecx*4 + 0x54606a]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545d64
jmp case.0x546052.0
cmp dl, 3
jne 0x546097
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545dbc
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545d78
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545e00
jmp case.0x546052.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5460c2
sub dl, 8
je 0x5460ce
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545e2c
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545e98
jmp case.0x546052.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5460ed
sub dl, 8
je 0x5460f9
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545f54
jmp case.0x546052.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545f7c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x54619b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00545164
test eax, eax
je 0x54619b
mov eax, ebx
call fcn.005461a4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x546134
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5461a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5461d5
dec al
je 0x546210
dec al
je 0x546255
dec al
je 0x5462be
jmp 0x546348
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x546348
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5461e5
jmp 0x546348
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x546348
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x546220
jmp 0x546348
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x546348
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x546284
xor ebp, ebp
jmp 0x546294
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x54629d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x546265
jmp 0x546348
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x546348
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x546317
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00543218
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5462d2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x576578
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov dword [esp], eax
mov eax, dword [esp]
mov edx, dword [eax + 0x34]
mov eax, dword [edx]
call fcn.0058d1b4
mov dword [esp + 0x18], eax
xor ebx, ebx
mov edx, dword [esp]
mov eax, dword [esp]
mov ebp, dword [edx + 0x38]
xor edx, edx
mov dl, byte [eax + 5]
mov dword [esp + 8], edx
mov ecx, dword [esp]
movzx eax, word [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp]
movzx ecx, word [edx + 0x10]
mov dword [esp + 0x14], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x34]
mov ecx, dword [edx + 0x24]
xor edx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov bl, byte [ebp + eax + 5]
mov eax, dword [esp + 8]
shl ebx, 8
mov dl, byte [ebp + eax + 6]
or ebx, edx
mov eax, dword [esp + 0x18]
sub ecx, ebx
add eax, ebx
lea edx, [ebx + ebp]
call fcn.0054b35c
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
add eax, eax
xor ecx, ecx
add eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0xc]
add edx, 0xfffffffc
mov dword [esp + 0x20], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jge 0x5766b6
mov edi, dword [esp + 4]
xor eax, eax
add edi, edi
add edi, dword [esp + 0x10]
add edi, ebp
movzx esi, byte [edi]
shl esi, 8
mov al, byte [edi + 1]
or esi, eax
cmp esi, dword [esp + 0x1c]
jl 0x57664b
cmp esi, dword [esp + 0x20]
jle 0x57665a
mov eax, 0x451
call fcn.00565d74
jmp 0x576714
mov edx, dword [esp + 0x18]
mov eax, dword [esp]
add edx, esi
call fcn.00576460
movzx eax, ax
sub ebx, eax
cmp ebx, dword [esp + 0x1c]
jl 0x57667c
lea edx, [eax + esi]
cmp edx, dword [esp + 0xc]
jle 0x57668b
mov eax, 0x45d
call fcn.00565d74
jmp 0x576714
lea ecx, [ebx + ebp]
mov edx, dword [esp + 0x18]
xchg ecx, eax
add edx, esi
call fcn.0054b35c
mov edx, ebx
sar edx, 8
mov byte [edi], dl
mov byte [edi + 1], bl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jl 0x576626
mov eax, dword [esp + 8]
mov edx, ebx
sar edx, 8
mov esi, ebx
mov byte [ebp + eax + 5], dl
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 6], bl
mov eax, dword [esp + 8]
mov byte [ebp + eax + 1], 0
mov edx, dword [esp + 8]
mov byte [ebp + edx + 2], 0
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 7], 0
sub esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add eax, ebp
xor edx, edx
mov ecx, esi
call fcn.0054b37c
mov edi, dword [esp]
movzx eax, word [edi + 0xe]
cmp esi, eax
je 0x576712
mov eax, 0x46e
call fcn.00565d74
jmp 0x576714
xor eax, eax
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x58d4e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
add esp, 0xffffffec
mov eax, dword [ebx + 0x3c]
xor ebp, ebp
mov esi, edx
cmp dword [eax], 0
jne 0x58d507
mov ecx, dword [ebx + 0x78]
mov edx, eax
mov eax, ebx
call fcn.0058d054
mov ebp, eax
test ebp, ebp
jne 0x58d614
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x24]
jbe 0x58d614
mov eax, dword [ebx + 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x80]
cdq
call fcn.0054b0b0
mov dword [esp], eax
mov dword [esp + 4], edx
mov ecx, esp
mov edx, 5
mov eax, dword [ebx + 0x3c]
call fcn.00597928
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x24], ecx
jmp 0x58d614
mov edi, dword [esi + 0x14]
cmp edi, dword [ebx + 0x18]
ja 0x58d611
test byte [esi + 0x18], 0x20
jne 0x58d611
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
mov eax, edi
dec eax
xor edx, edx
call fcn.0054b0b0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esi + 0x14], 1
jne 0x58d58d
mov eax, esi
call fcn.0058cab8
cmp dword [ebx + 0xb0], 0
jne 0x58d59f
mov edx, dword [esi + 4]
mov dword [esp + 0x10], edx
jmp 0x58d5c1
push 6
mov ecx, edi
mov edx, dword [esi + 4]
mov eax, dword [ebx + 0xbc]
call dword [ebx + 0xb0]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x58d5c1
mov eax, 7
jmp 0x58d622
push dword [esp + 0xc]
push dword [esp + 0xc]
mov ecx, dword [ebx + 0x80]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x3c]
call fcn.005978d0
mov ebp, eax
cmp edi, 1
jne 0x58d5f6
mov edx, dword [esp + 0x10]
add edx, 0x18
lea eax, [ebx + 0x64]
mov ecx, 0x10
call fcn.0054b35c
cmp edi, dword [ebx + 0x20]
jbe 0x58d5fe
mov dword [ebx + 0x20], edi
inc dword [ebx + 0xa8]
mov ecx, dword [esi + 4]
mov edx, edi
mov eax, dword [ebx + 0x58]
call fcn.00589218
mov esi, dword [esi + 0xc]
test ebp, ebp
jne 0x58d620
test esi, esi
jne 0x58d54f
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5906a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
jle 0x5906c1
mov ebx, ecx
shl ebx, 3
xor ecx, ebx
xor ebx, ebx
mov bl, byte [eax]
inc eax
movzx ebx, byte [ebx + 0x5ca1f4]
xor ecx, ebx
dec edx
test edx, edx
jg 0x5906a7
mov eax, ecx
pop ebx
ret
Function at 0x59eb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0xf8]
call fcn.0059ecf4
lea ecx, [ebp - 0xf8]
mov edx, edi
mov eax, esi
call fcn.0059ed04
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x1a4]
mov ecx, 0xac
call fcn.0054b35c
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp + 0x14]
mov eax, ebx
call fcn.0059ed74
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
shr eax, 5
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x59ece8
lea eax, [ebp - 0x4c]
mov ecx, 0x20
xor edx, edx
call fcn.0054b37c
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.0054b35c
mov eax, dword [ebp - 4]
mov ebx, 4
inc eax
mov edx, eax
mov ecx, eax
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x2c], dl
shr eax, 8
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], al
xor edx, edx
mov al, byte [ebp - 4]
inc eax
mov byte [ebp - 0x29], al
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x59ecae
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0059ed74
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, 0x20
call fcn.0059ee08
xor ebx, ebx
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov cl, byte [eax]
xor byte [edx], cl
inc ebx
inc edx
inc eax
cmp ebx, 0x20
jb 0x59ec81
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.0054b35c
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jb 0x59ec56
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
shl ebx, 5
mov eax, dword [ebp + 0xc]
lea edx, [eax + ebx]
lea eax, [ebp - 0x4c]
jmp 0x59ecce
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc ebx
inc dword [ebp - 8]
inc edx
cmp dword [ebp - 8], 0x20
jae 0x59ecd9
cmp ebx, dword [ebp + 8]
jb 0x59ecc4
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x59ebfe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x59ed74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
push ecx
mov dword [esp], eax
mov eax, dword [ebx + 0xa8]
mov esi, edx
cmp eax, 0xffffffff
je 0x59edf2
cmp eax, 0x40
jbe 0x59eda3
lea edx, [ebx + 0x40]
mov eax, ebx
call fcn.005a0000
mov dword [ebx + 0xa8], 0x20
mov ecx, 0x40
mov eax, dword [ebx + 0xa8]
sub ecx, dword [ebx + 0xa8]
add eax, ebx
xor edx, edx
call fcn.0054b37c
xor edx, edx
mov eax, ebx
xor dword [eax], 0x36363636
inc edx
add eax, 4
cmp edx, 0x10
jb 0x59edc1
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.0059ffe4
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.0059fdf4
mov dword [ebx + 0xa8], 0xffffffff
test esi, esi
je 0x59ee03
lea ecx, [ebx + 0x40]
mov edx, esi
mov eax, dword [esp]
call fcn.0059fdf4
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x59ee08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
cmp dword [ebx + 0xa8], 0xffffffff
je 0x59ee29
mov ecx, ebx
xor edx, edx
xor eax, eax
call fcn.0059ed74
lea edx, [ebx + 0x40]
lea eax, [esp + 4]
call fcn.005a0000
xor eax, eax
mov edx, ebx
xor dword [edx], 0x6a6a6a6a
inc eax
add edx, 4
cmp eax, 0x10
jb 0x59ee39
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.0059ffe4
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.0059fdf4
mov ecx, edi
lea eax, [esp + 4]
mov edx, 0x20
call fcn.0059fdf4
mov edx, edi
lea eax, [esp + 4]
call fcn.005a0000
xor eax, eax
mov edx, dword [esp]
mov ecx, edx
lea edx, [esp + 4]
cmp esi, eax
jbe 0x59ee95
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp esi, eax
ja 0x59ee8a
add esp, 0x24
pop edi
pop esi
pop ebx
ret