joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556560
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9c78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x676664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 0x24]
mov edi, dword [ebp + 0x14]
push eax
push str.readExpectedMessage
push edi
lea ecx, [ebp - 0x1c]
call fcn.0044eca0
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 0x24], bl
je 0x5565c1
cmp dword [esi + 0x28], ebx
jne 0x5565c1
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.No_m_pHandler.
mov ecx, edi
call eax
mov dword [esi + 0x3c], ebx
cmp dword [esi + 4], ebx
jne 0x5565d1
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, 5
jne 0x556602
cmp dword [0x6797f0], 0xa
jge 0x5565f9
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
mov ecx, edi
call eax
inc dword [0x6797f0]
mov dword [esi + 0x10], 0x7530
jmp 0x556606
test eax, eax
je 0x556637
cmp dword [esi + 4], 0
jne 0x556614
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x556624
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x556637
sub eax, ecx
cmp eax, dword [esi + 0x10]
ja 0x556685
mov ecx, dword [ebp - 0x10]
push edi
push ebx
push esi
call fcn.00555fa0
test al, al
je 0x5566b7
mov ecx, ebx
call fcn.004aeea0
test al, al
jne 0x5566b7
cmp byte [ebp + 0xc], al
je 0x556660
cmp dword [esi + 0x3c], 0x5d
je 0x5565d4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044ecf0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, ebx
call fcn.004aef00
mov byte [ebx + 0x14], 1
cmp byte [edi + 0x125], 0
je 0x5566b7
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Too_much_time_elapsed_waiting_for_response.
mov ecx, edi
call eax
mov ecx, dword [esi + 0x10]
push ecx
push str.totalTimeoutMs
mov ecx, edi
call fcn.0044e8c0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044ecf0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x556b20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b28a0
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x676664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0x14]
push str.readUntilRcvWindowAdjust
push esi
lea ecx, [ebp - 0x1c]
call fcn.0044ec60
xor ebx, ebx
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb0], ebx
jne 0x556c67
mov edi, dword [ebp + 0x10]
jmp 0x556b80
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], 1
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0xea60
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x44], ebx
call fcn.00410e50
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], ebx
call fcn.004aef00
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push esi
push edi
push eax
call fcn.00555fa0
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x556c0c
push esi
call fcn.00463a30
test al, al
jne 0x556c8c
mov ecx, edi
call fcn.004aee70
test al, al
jne 0x556cd7
cmp byte [ebp - 0x51], bl
jne 0x556ce6
cmp byte [ebp - 0x53], bl
jne 0x556ced
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp + 0x14]
cmp eax, 0xea60
ja 0x556cf4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
call fcn.00411620
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xb0], ebx
je 0x556b80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044ecf0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.aborted_by_user_application.
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x80], vtable.SshReadParams.0
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
call fcn.00411620
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044ecf0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.004aef60
jmp 0x556c9a
push str.Received_DISCONNECT
jmp 0x556c91
push str.Received_CHANNEL_CLOSE
jmp 0x556c91
mov ecx, dword [ebp - 0x10]
push esi
push edi
call fcn.00550220
push str.No_WINDOW_ADJUST_seems_to_be_coming...
jmp 0x556c91
Function at 0x55eff0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x55f00e
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x55f10c
lea ebx, [ebx]
mov eax, ebx
cmp ebx, 0x15b0
jb 0x55f02f
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jb 0x55f0d1
mov edx, eax
shr edx, 4
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub eax, 0x10
dec edx
jne 0x55f042
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x55f0e0
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x55f0d5
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x55f020
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x563860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov cl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x5638aa
mov edx, dword [eax + 0x260]
push edi
movzx edi, cl
mov esi, edx
shr esi, 0x18
xor esi, edi
shl edx, 8
xor edx, dword [esi*4 + 0x674640]
mov esi, dword [ebp - 4]
add esi, ebx
mov dword [eax + 0x260], edx
mov dword [ebp - 4], esi
cmp esi, dword [eax + 0x38]
jl 0x563885
pop edi
mov edx, dword [eax + 0x34]
mov byte [eax + edx + 0x58], bl
mov esi, dword [eax + 0x38]
mov edx, esi
sub edx, ebx
je 0x563938
sub edx, ebx
je 0x56391a
sub edx, ebx
je 0x56390e
mov byte [esi + eax + 0x54], bl
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov cl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
sub cl, 4
mov byte [esi + edx], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x563d50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b31d0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x676664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
je 0x563e2b
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x563d96
cmp ebx, 1
jne 0x563e2b
cmp dword [ebp + 0xc], 4
ja 0x563e2b
push 0xfa74
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
jne 0x563dd3
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [esi + 0x20], eax
mov dword [eax + 4], 0xa
mov dword [eax + 0x20], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0xc64], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov byte [eax + 0x28], bl
mov dword [eax + 0xc54], edi
mov dword [eax + 0xc50], edi
mov dword [eax + 0xc4c], edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5725c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3d6b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x676664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x572650
mov ecx, esi
call fcn.00442080
mov dword [esi], vtable.TreeNode.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov word [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 0xce
mov byte [esi + 0x10], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x585bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x43c]
mov edx, dword [eax + 0x440]
sub esp, 8
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x585c54
push edi
mov edi, edi
inc cl
movzx edi, cl
mov ecx, dword [eax + edi*4 + 0x3c]
add dl, cl
mov dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov ecx, dword [eax + ecx*4 + 0x3c]
mov dword [eax + edi*4 + 0x3c], ecx
add cl, dl
movzx ecx, cl
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov dword [eax + edi*4 + 0x3c], edx
mov dl, byte [eax + ecx*4 + 0x3c]
mov ecx, dword [ebp + 0xc]
xor byte [esi + ecx], dl
mov ecx, dword [ebp - 8]
inc esi
mov edx, edi
cmp esi, dword [ebp + 0x10]
jl 0x585c10
pop edi
mov dword [eax + 0x440], edx
mov dword [eax + 0x43c], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x585ff0
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x586002
xor al, al
pop edi
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebx + 0x14]
call fcn.00410b60
cmp eax, 0x20
jne 0x586021
lea ecx, [ebx + 0x34]
call fcn.00410b60
cmp eax, 0xc
jae 0x58602a
pop esi
pop ebx
xor al, al
pop edi
pop ebp
ret 8
lea ecx, [ebx + 0x14]
call fcn.00410b80
lea ecx, [ebx + 0x34]
mov esi, eax
call fcn.00410b80
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx ecx, byte [esi + 3]
shl ecx, 8
movzx edx, byte [esi + 2]
or ecx, edx
shl ecx, 8
movzx edx, byte [esi + 1]
or ecx, edx
movzx edx, byte [esi]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x10], ecx
movzx ecx, byte [esi + 7]
movzx edx, byte [esi + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x14], ecx
movzx ecx, byte [esi + 0xb]
movzx edx, byte [esi + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 9]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 8]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x18], ecx
movzx ecx, byte [esi + 0xf]
movzx edx, byte [esi + 0xe]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0xd]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0xc]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x1c], ecx
movzx ecx, byte [esi + 0x13]
movzx edx, byte [esi + 0x12]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x11]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x10]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x20], ecx
movzx ecx, byte [esi + 0x17]
movzx edx, byte [esi + 0x16]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x14]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x24], ecx
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x1a]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x19]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x18]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x28], ecx
movzx ecx, byte [esi + 0x1f]
movzx edx, byte [esi + 0x1e]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x1d]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x1c]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], 0
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x34], ecx
movzx ecx, byte [eax + 7]
movzx edx, byte [eax + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x38], ecx
movzx ecx, byte [eax + 0xb]
movzx edx, byte [eax + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 9]
movzx eax, byte [eax + 8]
shl ecx, 8
or ecx, edx
shl ecx, 8
pop esi
or ecx, eax
pop ebx
mov dword [edi + 0x3c], ecx
mov al, 1
pop edi
pop ebp
ret 8
Function at 0x5870b0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x454], ecx
movzx ecx, byte [eax + 7]
shl ecx, 8
movzx esi, byte [eax + 6]
or ecx, esi
movzx esi, byte [eax + 5]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 4]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x458], ecx
movzx ecx, byte [eax + 0xb]
movzx esi, byte [eax + 0xa]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 9]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 8]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x45c], ecx
movzx ecx, byte [eax + 0xf]
movzx esi, byte [eax + 0xe]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xd]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xc]
shl ecx, 8
or ecx, esi
cmp dword [ebp + 0x10], 0x100
mov dword [edx + 0x460], ecx
jne 0x587161
add eax, 0x10
mov ecx, str.expand_32_byte_k
jmp 0x587166
mov ecx, str.expand_16_byte_k
movzx esi, byte [eax + 3]
movzx edi, byte [eax + 2]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 1]
shl esi, 8
or esi, edi
movzx edi, byte [eax]
shl esi, 8
or esi, edi
mov dword [edx + 0x464], esi
movzx esi, byte [eax + 7]
movzx edi, byte [eax + 6]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 5]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 4]
shl esi, 8
or esi, edi
mov dword [edx + 0x468], esi
movzx esi, byte [eax + 0xb]
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 9]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 8]
shl esi, 8
or esi, edi
mov dword [edx + 0x46c], esi
movzx esi, byte [eax + 0xf]
movzx edi, byte [eax + 0xe]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xd]
movzx eax, byte [eax + 0xc]
shl esi, 8
or esi, edi
shl esi, 8
or esi, eax
mov dword [edx + 0x470], esi
movsx eax, byte [ecx + 3]
movsx esi, byte [ecx + 2]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 1]
shl eax, 8
or eax, esi
movsx esi, byte [ecx]
shl eax, 8
or eax, esi
mov dword [edx + 0x444], eax
movsx eax, byte [ecx + 7]
movsx esi, byte [ecx + 6]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 5]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 4]
shl eax, 8
or eax, esi
mov dword [edx + 0x448], eax
movsx eax, byte [ecx + 0xb]
movsx esi, byte [ecx + 0xa]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 9]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 8]
shl eax, 8
or eax, esi
mov dword [edx + 0x44c], eax
movsx eax, byte [ecx + 0xf]
movsx esi, byte [ecx + 0xe]
shl eax, 8
or eax, esi
movsx esi, byte [ecx + 0xd]
movsx ecx, byte [ecx + 0xc]
shl eax, 8
or eax, esi
shl eax, 8
or eax, ecx
pop edi
mov dword [edx + 0x450], eax
pop esi
pop ebp
ret 0x10
Function at 0x587aa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp esi, 0x80
jbe 0x587aba
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x587ac7
mov dword [ebp + 0x10], 0x400
mov eax, dword [ebp + 8]
push edi
push esi
push eax
lea edi, [ebx + 0x88]
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
cmp esi, 0x80
jae 0x587b11
mov al, byte [esi + ebx + 0x87]
mov ecx, edi
lea ecx, [ecx]
movzx edx, byte [ecx]
movzx eax, al
add edx, eax
and edx, 0xff
mov al, byte [edx + 0x6431d8]
mov byte [edi + esi], al
inc esi
inc ecx
cmp esi, 0x80
jb 0x587af0
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 7]
neg ecx
shr edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + ebx + 0x88]
mov edi, 0xff
sar edi, cl
movzx ecx, byte [esi]
and edi, ecx
mov cl, byte [edi + 0x6431d8]
mov byte [esi], cl
test eax, eax
je 0x587b5b
movzx edi, byte [esi + edx - 1]
dec esi
movzx ecx, cl
xor edi, ecx
dec eax
mov cl, byte [edi + 0x6431d8]
mov byte [esi], cl
jne 0x587b45
mov ecx, 0x3f
lea eax, [ebx + 0x106]
pop edi
jmp 0x587b70
movzx edx, byte [eax + 1]
mov esi, 0x100
imul dx, si
movzx esi, byte [eax]
add dx, si
mov word [eax], dx
mov edx, ecx
dec ecx
sub eax, 2
test edx, edx
jne 0x587b70
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x588290
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x675190
ret

Function at 0x5882a0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x6751d8
ret
Function at 0x58b880
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
sub edx, 2
push ebx
push edi
je 0x58b926
dec edx
je 0x58b8e4
dec edx
jne 0x58b9cb
movzx edi, byte [ebp - 4]
mov dl, byte [ecx + eax*4 + 0x18]
xor dl, byte [edi + 0x643470]
movzx edi, byte [ebp - 2]
mov bl, byte [edi + 0x643370]
xor bl, byte [ecx + eax*4 + 0x1a]
movzx edi, byte [ebp - 1]
mov byte [ebp - 4], dl
movzx edx, byte [ebp - 3]
mov dl, byte [edx + 0x643370]
xor dl, byte [ecx + eax*4 + 0x19]
mov byte [ebp - 2], bl
mov bl, byte [edi + 0x643470]
xor bl, byte [ecx + eax*4 + 0x1b]
mov byte [ebp - 1], bl
jmp 0x58b8e7
mov dl, byte [ebp - 3]
movzx edi, byte [ebp - 4]
mov bl, byte [ecx + eax*4 + 0x10]
xor bl, byte [edi + 0x643470]
movzx edx, dl
mov dl, byte [edx + 0x643470]
xor dl, byte [ecx + eax*4 + 0x11]
mov byte [ebp - 3], dl
movzx edx, byte [ebp - 2]
mov dl, byte [edx + 0x643370]
xor dl, byte [ecx + eax*4 + 0x12]
mov byte [ebp - 2], dl
movzx edx, byte [ebp - 1]
mov dl, byte [edx + 0x643370]
xor dl, byte [ecx + eax*4 + 0x13]
jmp 0x58b92c
mov dl, byte [ebp - 1]
mov bl, byte [ebp - 4]
movzx edi, byte [ecx + eax*4 + 8]
movzx ebx, bl
movzx ebx, byte [ebx + 0x643370]
xor edi, ebx
movzx edi, byte [edi + 0x643370]
movzx ebx, byte [ecx + eax*4]
xor edi, ebx
movzx ebx, byte [edi + 0x643470]
movzx edi, byte [ebp - 3]
movzx edi, byte [edi + 0x643470]
mov byte [ebp - 4], bl
movzx ebx, byte [ecx + eax*4 + 9]
xor edi, ebx
movzx edi, byte [edi + 0x643370]
movzx ebx, byte [ecx + eax*4 + 1]
xor edi, ebx
movzx ebx, byte [edi + 0x643370]
movzx edi, byte [ebp - 2]
movzx edi, byte [edi + 0x643370]
mov byte [ebp - 3], bl
movzx ebx, byte [ecx + eax*4 + 0xa]
xor edi, ebx
movzx ebx, byte [ecx + eax*4 + 2]
movzx edi, byte [edi + 0x643470]
movzx edx, dl
movzx edx, byte [edx + 0x643470]
xor edi, ebx
mov bl, byte [edi + 0x643470]
movzx edi, byte [ecx + eax*4 + 0xb]
movzx eax, byte [ecx + eax*4 + 3]
xor edx, edi
movzx edx, byte [edx + 0x643470]
xor edx, eax
mov al, byte [edx + 0x643370]
jmp 0x58b9d1
mov al, byte [ebp - 1]
mov bl, byte [ebp - 2]
movzx ecx, al
mov eax, dword [ecx*4 + 0x644170]
movzx ecx, byte [ebp - 3]
movzx edx, bl
xor eax, dword [edx*4 + 0x643d70]
movzx edx, byte [ebp - 4]
xor eax, dword [ecx*4 + 0x643970]
pop edi
xor eax, dword [edx*4 + 0x643570]
pop ebx
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 3], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esi + 2], dl
mov byte [esi + 1], cl
mov byte [esi], al
mov esp, ebp
pop ebp
ret
Function at 0x590a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.00410b80
mov edi, eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
call fcn.00410b80
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ecx + esi*4 + 4]
mov ecx, dword [ecx + esi*4]
xor ecx, dword [edi]
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
xor esi, esi
jmp 0x590a90
mov edi, ecx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, dword [ebp - 4]
xor edi, dword [ebx + esi*4 + 4]
add esi, 2
xor edx, edi
mov edi, edx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, edx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, edi
mov edi, dword [ebp - 4]
xor ebx, dword [edi + esi*4]
xor ecx, ebx
cmp esi, 0xe
jbe 0x590a90
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 0xc]
xor eax, edx
mov edx, dword [ebp + 8]
pop edi
mov dword [edx + esi*4], eax
mov eax, dword [ebp - 0xc]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8