joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5a8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0x14], ecx
mov ecx, edx
mov edi, edx
mov esi, dword [esp + 0x30]
call fcn.004cd329
mov ecx, edi
mov edx, esi
mov dword [esp + 4], esi
call fcn.004cd1dc
movzx ecx, word [edi + 0x38]
mov ebp, dword [edi + 0x1c]
mov word [esp + 0xe], ax
movzx eax, ax
mov edx, edi
mov dword [esp + 0x10], eax
and eax, ecx
mov dword [esp + 8], ecx
mov dword [esp], 0
mov edi, eax
xor eax, eax
cmp edi, ebp
jae 0x4e5ad3
mov eax, dword [edx + 0x18]
movzx ecx, word [eax + edi*4]
cmp ecx, 0xffff
je 0x4e5b42
mov dword [esp + 0x18], ecx
movzx eax, word [eax + edi*4 + 2]
mov ebx, edx
mov edx, edi
mov esi, dword [esp + 8]
mov ecx, esi
and ecx, eax
sub edx, ecx
and edx, esi
mov esi, dword [esp + 0x18]
cmp edx, dword [esp]
mov edx, ebx
jb 0x4e5b42
cmp ax, word [esp + 0xe]
jne 0x4e5b3a
mov ecx, dword [edx + 0x20]
mov edx, dword [ebx + 0x28]
push 0xa00a20
push esi
call fcn.004b0b2d
pop ecx
pop edx
mov edx, dword [esp + 4]
lea ecx, [eax + 0x20]
call fcn.004cd805
mov edx, ebx
test al, al
jne 0x4e5b73
inc dword [esp]
inc edi
mov eax, edi
jmp 0x4e5ad3
cmp dword [esp], 0x200
mov eax, dword [edx]
setae cl
xor eax, 2
or eax, dword [edx + 4]
setne al
and al, cl
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + 0xc]
mov ebp, dword [ecx]
mov esi, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 8], ecx
jmp 0x4e5b79
mov bl, 1
mov al, 2
mov ebp, edi
mov ecx, edx
mov edx, dword [esp + 0x14]
test bl, bl
mov dword [edx], ecx
mov ecx, dword [esp + 8]
mov dword [edx + 4], ebp
mov dword [edx + 8], esi
mov dword [edx + 0xc], ecx
mov ecx, dword [esp]
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + 0x14], edi
mov word [edx + 0x18], cx
mov byte [edx + 0x1a], al
je 0x4e5bb6
mov ecx, dword [esp + 4]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004e4eee
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4edc10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x134
mov edi, dword [esp + 0x14c]
mov ebx, dword [esp + 0x148]
call fcn.004edc2d

Function at 0x4f0bcd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x490
mov edi, dword [edx]
cmp edi, dword [edx + 4]
je 0x4f0cfe
mov eax, 0x460
mov dword [esp + 0x24], ecx
mov ecx, 0x350
lea esi, [esp + 0x28]
add eax, edi
mov dword [edx], eax
lea edx, [edi + ecx]
add ecx, esi
call fcn.004f0d0c
mov eax, dword [edi + 0x444]
mov ecx, 0x2d8
lea edx, [edi + ecx]
add ecx, esi
mov dword [esi + 0x444], eax
movsd xmm0, qword [edi + 0x43c]
movsd qword [esi + 0x43c], xmm0
movsd xmm0, qword [edi + 0x448]
movsd qword [esi + 0x448], xmm0
mov eax, dword [edi + 0x450]
mov dword [esi + 0x450], eax
mov eax, dword [edi + 0x348]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x34c]
mov dword [esp + 0x1c], eax
movzx eax, word [edi + 0x458]
mov word [esp + 6], ax
mov eax, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x454]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x18], eax
call fcn.004f0e4c
add edi, 0x10
lea ebx, [esp + 0x38]
mov ecx, ebx
mov edx, edi
call fcn.004f0f3d
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x338], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x33c], eax
movzx eax, word [esp + 6]
mov word [ebx + 0x448], ax
mov eax, dword [esp + 8]
mov dword [ebx - 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [ebx - 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x444], eax
mov eax, dword [esp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esp + 0x18]
mov dword [ebx - 4], eax
mov eax, 0x460
push eax
push esi
push dword [esp + 0x2c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4f0d04
mov dword [ecx], 2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x509290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xbc8
cmp byte [ebp + 0xc], 0
call fcn.005092a8

Function at 0x510884
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov dword [esp + 0x34], ecx
lea ecx, [edx + 0x75]
lea esi, [edx + 0x28]
mov edi, edx
call fcn.005108a4
Function at 0x51793e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x51797b
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x517985
mov dword [esp + 4], 0
jmp 0x517998
mov dword [esp + 4], 0
jmp 0x517998
call fcn.005175be
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x5179c0
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.00567624
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x5179ef
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x9ebea4
push esi
push eax
call fcn.004b2d6a
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
sub esp, 4
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00517b59
add esp, 0x10
cmp byte [esp + 8], 4
je 0x517a4b
mov ecx, ebp
call fcn.0044ed78
cmp al, 0x23
jne 0x517b31
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004bd9e0
pop eax
jmp 0x5179a8
mov esi, dword [esp + 0x28]
test esi, esi
je 0x517b46
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x9ebeb4
push eax
push dword [esp + 0x1c]
call fcn.004b2d6a
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x9ebec4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.004b2d6a
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x5179a6
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x5179a6
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.005f9c0c
add esp, 0x10
cmp byte [esp + 8], 4
je 0x517af9
mov ecx, ebp
call fcn.0044ed78
cmp al, 0x23
jne 0x517b31
mov ecx, ebp
call fcn.004f22d9
jmp 0x517aca
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x517b4c
lea edx, [esp + 0x3c]
push 0x9ebed4
push 0x20
call fcn.0044ec8b
pop ecx
pop ecx
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.004b8e8a
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x5179a6
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x517b4e
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x517b3e
Function at 0x51822b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x518268
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x518272
mov dword [esp + 4], 0
jmp 0x518285
mov dword [esp + 4], 0
jmp 0x518285
call fcn.005175be
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x5182ad
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.00567624
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x5182dc
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x9ebea4
push esi
push eax
call fcn.004b2d6a
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
sub esp, 4
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004f7173
add esp, 0x10
cmp byte [esp + 8], 4
je 0x518338
mov ecx, ebp
call fcn.0044ed78
cmp al, 0x23
jne 0x51841e
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004bd9e0
pop eax
jmp 0x518295
mov esi, dword [esp + 0x28]
test esi, esi
je 0x518433
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x9ebeb4
push eax
push dword [esp + 0x1c]
call fcn.004b2d6a
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x9ebec4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.004b2d6a
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x518293
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x518293
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004f0b62
add esp, 0x10
cmp byte [esp + 8], 4
je 0x5183e6
mov ecx, ebp
call fcn.0044ed78
cmp al, 0x23
jne 0x51841e
mov ecx, ebp
call fcn.004f22d9
jmp 0x5183b7
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x518439
lea edx, [esp + 0x3c]
push 0x9ebed4
push 0x20
call fcn.0044ec8b
pop ecx
pop ecx
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.004b8e8a
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x518293
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x51843b
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x51842b
Function at 0x51e940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x398
mov ebx, edx
call fcn.0051e956
Function at 0x5252f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xec0
lea eax, [esp + 0x8b0]
call fcn.00525313
Function at 0x56dc4a
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, esp
xorps xmm0, xmm0
and dword [esi + 0x20], 0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
push esi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esi + 0x14]
add esp, 0x24
pop esi
ret

Function at 0x56ecec
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [0xa70ce0]
mov esi, ecx
test ebp, ebp
jne 0x56ede3
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x56ed3e
mov ebx, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x56ed3e
mov edi, eax
push str.WakeByAddressSingle
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x56ed3e
mov ebx, eax
mov dword [esp], 0
jmp 0x56eda4
push 0xa39272
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x56edf1
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x56edf1
mov ebp, eax
push str.NtReleaseKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x56edf1
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x56edf1
mov edi, eax
mov dword [esp], ebx
lea eax, [esp + 4]
push 0
push 0
push 0xc0000000
push eax
call ebp
test eax, eax
jne 0x56edf1
mov ebx, dword [esp + 4]
push 0xc
pop ecx
call fcn.00566a96
mov ebp, eax
mov eax, dword [esp]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ebx
xor eax, eax
lock cmpxchg dword [0xa70ce0], ebp
je 0x56ede3
cmp dword [ebp], 0
mov edi, eax
je 0x56edd7
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 4
pop edx
mov ecx, ebp
call fcn.00404240
mov ebp, edi
and dword [esi + 4], 0
mov dword [esi], ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.006415f6
ud2

Function at 0x56eec4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov ecx, 0xa6fe80
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x56eee7
cmp dword [eax + 4], 0
mov esi, eax
jne 0x56ef62
mov ecx, 0xa6fe80
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x56ef67
mov esi, eax
test eax, eax
jne 0x56ef29
push 0x20
pop ecx
call fcn.00566a96
mov dword [eax], 0xa6fe80
and dword [eax + 4], 0
mov ecx, 0xa6fe80
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov edi, esp
mov ecx, edi
call fcn.0056e9cf
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [edi + 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [edi + 0x18]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x56ef62
lock dec dword [0xa70cd8]
add esi, 4
jmp 0x56ef69
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
Function at 0x57748b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov esi, ecx
mov ecx, 0xa6fea0
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5774b0
cmp dword [eax + 4], 0
je 0x5774b0
add eax, 8
jmp 0x57751a
mov ecx, 0xa6fea0
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x577507
mov edi, eax
test eax, eax
jne 0x5774f5
push 0xc
pop ecx
push 4
pop edx
call fcn.004c2304
mov dword [eax], 0xa6fea0
and dword [eax + 4], 0
mov ecx, 0xa6fea0
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x57750b
mov ecx, dword [esi]
and dword [esi], 0
test ecx, ecx
je 0x57750d
mov ecx, dword [esi + 4]
jmp 0x57750d
xor eax, eax
jmp 0x57751a
xor ecx, ecx
mov dword [edi + 4], 1
lea eax, [edi + 8]
mov dword [edi + 8], ecx
pop esi
pop edi
ret
Function at 0x578e68
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ecx, 0xa6fe90
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x578e92
cmp dword [eax + 4], 0
je 0x578e92
add eax, 8
jmp 0x578f1e
mov ecx, 0xa6fe90
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x578f1c
mov edi, eax
test eax, eax
jne 0x578ed7
push 0x14
pop ecx
push 4
pop edx
call fcn.004c2304
mov dword [eax], 0xa6fe90
and dword [eax + 4], 0
mov ecx, 0xa6fe90
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x578ef8
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x578ef8
movzx eax, word [esi + 0xa]
mov ebp, dword [esi + 4]
mov dl, byte [esi + 8]
mov bl, byte [esi + 9]
mov ecx, dword [esi + 0xc]
mov esi, eax
jmp 0x578f00
xor ecx, ecx
xor ebx, ebx
xor edx, edx
xor ebp, ebp
mov dword [edi + 4], 1
mov dword [edi + 8], ebp
mov byte [edi + 0xc], dl
mov byte [edi + 0xd], bl
mov word [edi + 0xe], si
lea eax, [edi + 8]
mov dword [edi + 0x10], ecx
jmp 0x578f1e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x57ad9e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx]
add edx, 0xfffffffa
xor eax, eax
inc eax
cmp edx, 3
cmovb eax, edx
test eax, eax
je 0x57adba
cmp eax, 1
je fcn.0057ae06
ret
add ecx, 8
jmp fcn.0057adc2

Function at 0x57ae06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 5
jne 0x57ae13
add ecx, 4
jmp fcn.005c143f
jmp fcn.0057ae18

Function at 0x57ae18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
xor ecx, ecx
lea edx, [eax - 3]
lea edi, [eax - 2]
cmp edx, 2
cmovb ecx, edi
test ecx, ecx
je 0x57ae66
cmp ecx, 1
jne 0x57aee0
cmp byte [esi + 0x3c], 4
lea ecx, [esi + 4]
jne 0x57ae7f
mov esi, dword [ecx]
movzx eax, byte [esi + 0xad]
test eax, eax
je 0x57ae86
cmp eax, 3
je 0x57ae9d
cmp eax, 4
jne 0x57aed6
lea ecx, [esi + 0xb0]
call fcn.0057e96b
jmp 0x57aea8
cmp eax, 2
je 0x57aee0
lea ecx, [esi + 0x98]
call fcn.0057e878
mov ecx, esi
pop esi
pop edi
jmp fcn.0057e882
pop esi
pop edi
jmp fcn.005c143f
lea ecx, [esi + 0x50]
call fcn.005c7e12
lea eax, [esi + 0x80]
push eax
call fcn.0041a567
pop eax
jmp 0x57aeb0
lea ecx, [esi + 0xb0]
call fcn.0057e923
lea ecx, [esi + 0x50]
call fcn.005c7e12
lea ecx, [esi + 0x78]
call fcn.005c7e12
lea ecx, [esi + 0xa8]
call fcn.0057e8ab
lea ecx, [esi + 0x8c]
call fcn.0057e8b5
lea ecx, [esi + 0x68]
call fcn.0057b164
push 8
pop edx
mov ecx, esi
call fcn.00404240
pop esi
pop edi
ret
Function at 0x5b0dce
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x58]
mov edx, dword [edx + 0x60]
push 0xa03dc8
push dword [edi + 0x50]
call fcn.004bda36
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x80]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x5b0f07
test eax, eax
je 0x5b0e9d
cmp eax, 0x90317
je 0x5b0f00
cmp eax, 0x90321
jne 0x5b0f14
mov dword [edi + 0x20], 0x10000
mov byte [edi + 0x24], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x5b0e88
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.005b0d83
and dword [edi + 0xa0], 0
jmp 0x5b0f25
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x58]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x60]
and dword [edi + 0x48], 0
lea ebx, [edi + 0x40]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.005b0f32
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0043be28
pop eax
and dword [edi + 0x3c], 0
and dword [edi + 0x38], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x5b0ee4
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.005b0d83
mov eax, dword [edi + 0x50]
xor ecx, ecx
or eax, dword [edi + 0x54]
sete cl
mov dword [edi + 0xa0], ecx
jmp 0x5b0f25
mov word [esi], 0x104
jmp 0x5b0f2a
cmp dword [esp + 0x10], 4
jne 0x5b0f1c
mov eax, dword [esp + 0xc]
jmp 0x5b0f1f
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x5b0f2a
xor eax, eax
inc eax
mov dword [edi + 0xa0], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5b114c
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x100]
mov edx, dword [edx + 0x108]
push 0xa03dc8
push dword [edi + 0xf8]
call fcn.004bda36
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x128]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x5b12b2
test eax, eax
je 0x5b122d
cmp eax, 0x90317
je 0x5b12ab
cmp eax, 0x90321
jne 0x5b12bf
mov dword [edi + 0xc8], 0x10000
mov byte [edi + 0xcc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x5b1218
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.005b10f5
and dword [edi + 0x148], 0
jmp 0x5b12d0
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x100]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x108]
and dword [edi + 0xf0], 0
lea ebx, [edi + 0xe8]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.005b0f32
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0043be28
pop eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x5b1289
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.005b10f5
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
sete cl
mov dword [edi + 0x148], ecx
jmp 0x5b12d0
mov word [esi], 0x104
jmp 0x5b12d5
cmp dword [esp + 0x10], 4
jne 0x5b12c7
mov eax, dword [esp + 0xc]
jmp 0x5b12ca
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x5b12d5
xor eax, eax
inc eax
mov dword [edi + 0x148], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret