joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565540
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
add eax, dword [edx - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 8]
add ebx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
add eax, dword [edx - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp + 8]
add esi, dword [eax - 0x14]
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jb 0x56563f
inc eax
mov dword [ebp - 0x14], eax
mov eax, edi
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x10]
mov edx, ebx
call fcn.00573c80
mov edx, ebx
shl edx, 4
add eax, edx
lea edx, [edi + esi]
xor eax, edx
push eax
mov eax, edi
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x20]
mov edx, ebx
shr edx, 0x1b
call fcn.00573c80
mov edx, ebx
shr edx, 5
add eax, edx
pop edx
xor edx, eax
add dword [ebp - 0xc], edx
add edi, 0x9e3779b9
mov eax, edi
shr eax, 0xb
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x10]
mov edx, esi
call fcn.00573c80
mov edx, esi
shl edx, 4
add eax, edx
lea edx, [edi + ebx]
xor eax, edx
push eax
mov eax, edi
shr eax, 0xb
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x20]
mov edx, esi
shr edx, 0x1b
call fcn.00573c80
mov edx, esi
shr edx, 5
add eax, edx
pop edx
xor edx, eax
add dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov esi, eax
dec dword [ebp - 0x14]
jne 0x565596
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
xor ebx, dword [eax - 0xc]
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
xor esi, dword [eax - 4]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x570c3c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x570e0d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x570de8
push dword fs:[edx]
mov dword fs:[edx], esp
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004bb470
mov edx, eax
mov eax, edi
call fcn.004bd0e0
mov ebx, eax
lea eax, [ebx + 0x50]
mov edx, dword [esi + 0x50]
call fcn.00405064
mov al, byte [esi + 0x80]
mov byte [ebx + 0x80], al
lea eax, [ebx + 0x14]
mov edx, dword [esi + 0x14]
call fcn.00405064
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov al, byte [esi + 0x7d]
mov byte [ebx + 0x7d], al
mov al, byte [esi]
mov byte [ebx], al
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov al, byte [esi + 2]
mov byte [ebx + 2], al
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov ax, word [esi + 0x6c]
mov word [ebx + 0x6c], ax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0x30]
call fcn.00405064
lea eax, [ebx + 0x34]
mov edx, dword [esi + 0x34]
call fcn.00405064
lea eax, [ebx + 0x38]
mov edx, dword [esi + 0x38]
call fcn.00405064
lea eax, [ebx + 0x44]
mov edx, dword [esi + 0x44]
call fcn.00405064
lea edx, [ebp - 4]
mov eax, dword [esi + 0x3c]
call fcn.0040c074
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, 0x268
call fcn.00580e8c
mov edx, dword [ebp - 8]
pop eax
call fcn.0040542c
jne 0x570d3b
lea eax, [ebx + 0x3c]
call fcn.00405010
jmp 0x570d46
lea eax, [ebx + 0x3c]
mov edx, dword [esi + 0x3c]
call fcn.00405064
lea eax, [ebx + 0x48]
mov edx, dword [esi + 0x48]
call fcn.00405064
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov al, byte [esi + 0x7c]
mov byte [ebx + 0x7c], al
lea eax, [ebx + 0x58]
mov edx, dword [esi + 0x58]
call fcn.00405064
lea eax, [ebx + 0x5c]
mov edx, dword [esi + 0x5c]
call fcn.00405064
mov eax, dword [esi + 0x14]
call fcn.00591578
mov byte [ebx + 1], al
mov eax, dword [esi + 0x14]
call fcn.00591630
mov byte [ebx + 2], al
mov eax, dword [0x604c40]
mov eax, dword [eax]
cmp edi, dword [eax + 0x5f0]
je 0x570daa
mov al, byte [esi]
mov byte [ebx], al
jmp 0x570dad
mov byte [ebx], 0
lea eax, [ebx + 0x4c]
mov edx, dword [esi + 0x4c]
call fcn.00405064
lea edx, [ebp - 0xc]
mov al, byte [esi + 0x7c]
call fcn.004f5a44
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x40]
call fcn.00405064
mov al, byte [esi + 0x7c]
call fcn.004f4f04
and eax, 0xff
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x570df2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570e14
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405034
ret
Function at 0x573c88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
or ebx, 0xffffffff
mov eax, esi
call fcn.004052e0
test eax, eax
jle 0x573cc2
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
mov edi, ebx
and edi, 0xff
xor ecx, edi
mov ecx, dword [ecx*4 + 0x6027bc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x573ca0
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x574f88
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 0x9e3779b9
mov edi, eax
imul edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor esi, dword [eax - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
xor eax, dword [edx - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 8]
xor ebx, dword [eax - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
xor eax, dword [edx - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
dec eax
cmp eax, 0
jb 0x575094
mov dword [ebp - 0x14], eax
mov eax, esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, edi
shr eax, 0xb
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x10]
mov edx, esi
call fcn.00573c80
mov edx, esi
shl edx, 4
add eax, edx
lea edx, [edi + ebx]
xor eax, edx
push eax
mov eax, edi
shr eax, 0xb
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x20]
mov edx, esi
shr edx, 0x1b
call fcn.00573c80
mov edx, esi
shr edx, 5
add eax, edx
pop edx
xor edx, eax
sub dword [ebp - 0x10], edx
sub edi, 0x9e3779b9
mov eax, edi
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x10]
mov edx, ebx
call fcn.00573c80
mov edx, ebx
shl edx, 4
add eax, edx
lea edx, [edi + esi]
xor eax, edx
push eax
mov eax, edi
and eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 0x20]
mov edx, ebx
shr edx, 0x1b
call fcn.00573c80
mov edx, ebx
shr edx, 5
add eax, edx
pop edx
xor edx, eax
sub dword [ebp - 0xc], edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
jne 0x574fe7
mov eax, dword [ebp + 8]
sub esi, dword [eax - 0x14]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
sub edx, dword [eax - 0x18]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
sub ebx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
sub edx, dword [eax - 0x20]
mov eax, dword [ebp - 4]
mov dword [eax], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590ff8
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x591133
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x604eac]
cmp dword [eax], 0
jne 0x59102c
mov dl, 1
mov eax, dword [0x49f110]
call fcn.0049f3a0
mov edx, dword [0x604eac]
mov dword [edx], eax
mov eax, 0x90
call fcn.0040bf90
mov edi, eax
mov ebx, edi
lea eax, [ebx + 0x18]
mov edx, dword [esi + 0x18]
call fcn.00405064
lea eax, [ebx + 0x14]
mov edx, dword [esi + 0x14]
call fcn.00405064
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
lea eax, [ebx + 0x50]
mov edx, dword [esi + 0x50]
call fcn.00405064
lea eax, [ebx + 0x20]
mov edx, dword [esi + 0x20]
call fcn.00405064
mov al, byte [esi + 0x7c]
mov byte [ebx + 0x7c], al
mov byte [ebx + 0x7e], 0
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0x30]
call fcn.00405064
lea eax, [ebx + 0x38]
mov edx, dword [esi + 0x38]
call fcn.00405064
lea eax, [ebx + 0x34]
mov edx, dword [esi + 0x34]
call fcn.00405064
lea eax, [ebx + 0x3c]
mov edx, dword [esi + 0x3c]
call fcn.00405064
lea eax, [ebx + 0x58]
mov edx, dword [esi + 0x58]
call fcn.00405064
lea eax, [ebx + 0x4c]
mov edx, dword [esi + 0x4c]
call fcn.00405064
lea eax, [ebx + 0x48]
mov edx, dword [esi + 0x48]
call fcn.00405064
lea eax, [ebx + 0x54]
mov edx, dword [esi + 0x54]
call fcn.00405064
lea eax, [ebx + 0x5c]
mov edx, dword [esi + 0x5c]
call fcn.00405064
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x44]
mov edx, dword [esi + 0x44]
call fcn.00405064
lea eax, [ebx + 0x40]
mov edx, dword [esi + 0x40]
call fcn.00405064
mov eax, dword [0x604eac]
mov eax, dword [eax]
mov edx, edi
call fcn.0049f414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59113d
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5a0d4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffff7ec
mov ebx, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00407d60
mov edx, dword [ebx + 0x78]
sub eax, dword [edx + 0x384]
cmp eax, 0xea60
jbe 0x5a0d87
mov byte [ebx + 0x14], 1
mov cl, 1
mov edx, ebx
mov eax, dword [esp]
call fcn.005a4018
jmp 0x5a0f34
lea ecx, [esp + 0x10]
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x328]
xor edx, edx
call fcn.004a5650
test al, al
jne 0x5a0dcd
cmp dword [esp + 0x10], 0
je 0x5a0f34
cmp dword [esp + 0x10], 0x2733
je 0x5a0f34
mov byte [ebx + 0x14], 1
mov cl, 1
mov edx, ebx
mov eax, dword [esp]
call fcn.005a4018
jmp 0x5a0f34
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x328]
mov ecx, 0x400
call fcn.004a5604
mov dword [esp + 0xc], eax
cmp dword [esp + 0x10], 0x2733
je 0x5a0f34
cmp dword [esp + 0x10], 0
je 0x5a0e17
mov byte [ebx + 0x14], 1
mov cl, 1
mov edx, ebx
mov eax, dword [esp]
call fcn.005a4018
jmp 0x5a0f34
lea edx, [esp + 0x414]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0xc]
call fcn.0040310c
mov esi, dword [esp + 0xc]
dec esi
test esi, esi
jl 0x5a0e66
inc esi
lea eax, [esp + 0x414]
lea edx, [esp + 0x14]
movzx ecx, word [ebx + 0x60]
shr ecx, 8
xor cl, byte [eax]
mov byte [edx], cl
xor ecx, ecx
mov cl, byte [eax]
add cx, word [ebx + 0x60]
imul cx, cx, 0xcb6f
add cx, 0x41ba
mov word [ebx + 0x60], cx
inc edx
inc eax
dec esi
jne 0x5a0e40
call fcn.00407d60
mov edx, dword [ebx + 0x78]
mov dword [edx + 0x384], eax
mov eax, dword [esp + 4]
mov esi, dword [eax + 0xac]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, esi
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xac]
mov ecx, dword [esp + 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [esp + 4]
call 0x50488c
test al, al
je 0x5a0ecb
mov byte [ebx + 0x14], 1
mov cl, 1
mov edx, ebx
mov eax, dword [esp]
call fcn.005a4018
jmp 0x5a0f34
cmp byte [esp + 8], 0
je 0x5a0f34
mov byte [ebx + 0x31], 0
mov eax, dword [esp + 4]
mov byte [eax + 0xa8], 0
mov eax, dword [esp + 4]
cmp dword [eax + 0xac], 0
je 0x5a0efc
mov eax, dword [esp + 4]
add eax, 0xac
call fcn.005fa88c
mov byte [ebx + 0x74], 3
call fcn.00407d60
mov dword [ebx + 0x88], eax
mov eax, dword [esp + 4]
call 0x503fb0
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
call fcn.0040660c
test eax, eax
jne 0x5a0f34
mov byte [ebx + 0x14], 1
mov cl, 1
mov edx, ebx
mov eax, dword [esp]
call fcn.005a4018
add esp, 0x814
pop esi
pop ebx
ret
Function at 0x5a3c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x328]
xor edx, edx
call fcn.004a5650
test al, al
jne 0x5a3ce3
cmp dword [ebp - 0xc], 0
je 0x5a3ea4
cmp dword [ebp - 0xc], 0x2733
je 0x5a3ea4
mov edx, dword [ebp + 0x10]
mov eax, dword [0x60d1e8]
call fcn.0049f450
mov eax, dword [ebx + 0xc8]
call fcn.005a3eac
mov edx, ebx
mov eax, esi
call fcn.005a3660
jmp 0x5a3ea4
cmp dword [ebp + 8], 0
jle 0x5a3cee
mov ecx, dword [ebp + 8]
jmp 0x5a3cf3
mov ecx, 0x400
mov eax, ecx
cdq
cmp edx, dword [ebx + 0xbc]
jne 0x5a3d08
cmp eax, dword [ebx + 0xb8]
jbe 0x5a3d10
jmp 0x5a3d0a
jle 0x5a3d10
mov ecx, dword [ebx + 0xb8]
lea eax, [ebp - 0xc]
push eax
lea edx, [esi + 0x90]
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x328]
call fcn.004a5604
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0x2733
je 0x5a3ea4
cmp dword [ebp - 0xc], 0
je 0x5a3d64
mov edx, dword [ebp + 0x10]
mov eax, dword [0x60d1e8]
call fcn.0049f450
mov eax, dword [ebx + 0xc8]
call fcn.005a3eac
mov edx, ebx
mov eax, esi
call fcn.005a3660
jmp 0x5a3ea4
lea edx, [esi + 0x490]
lea eax, [esi + 0x90]
mov ecx, dword [ebp - 8]
call fcn.0040310c
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x5a3db7
inc edx
xor eax, eax
movzx ecx, word [ebx + 0x60]
shr ecx, 8
xor cl, byte [esi + eax + 0x490]
mov byte [esi + eax + 0x90], cl
xor ecx, ecx
mov cl, byte [esi + eax + 0x490]
add cx, word [ebx + 0x60]
imul cx, cx, 0xcb6f
add cx, 0x41ba
mov word [ebx + 0x60], cx
inc eax
dec edx
jne 0x5a3d83
mov ecx, dword [ebx + 0xc8]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xc0]
mov edx, dword [ebx + 0xc4]
add eax, dword [ebx + 0x90]
adc edx, dword [ebx + 0x94]
push edx
push eax
lea eax, [esi + 0x90]
mov edx, ebx
xchg ecx, eax
call fcn.00518634
mov eax, dword [ebp - 8]
cdq
add dword [ebx + 0xc0], eax
adc dword [ebx + 0xc4], edx
mov eax, dword [ebp - 8]
cdq
add dword [esi + 0x58], eax
adc dword [esi + 0x5c], edx
mov eax, dword [ebp - 8]
cdq
add dword [esi + 0x60], eax
adc dword [esi + 0x64], edx
mov eax, dword [ebp - 4]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 8]
cdq
sub dword [ebx + 0xb8], eax
sbb dword [ebx + 0xbc], edx
mov eax, dword [ebp - 8]
cdq
add dword [ebx + 0xb0], eax
adc dword [ebx + 0xb4], edx
mov ecx, dword [ebx + 0xc8]
mov eax, dword [ebp - 8]
cdq
add dword [ecx + 0x30], eax
adc dword [ecx + 0x34], edx
mov eax, dword [esi + 0x18b4]
cmp eax, ecx
je 0x5a3e54
cmp eax, ebx
jne 0x5a3e5e
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0059c6ac
cmp dword [ebx + 0xbc], 0
jne 0x5a3e72
cmp dword [ebx + 0xb8], 0
ja 0x5a3e97
jmp 0x5a3e74
jg 0x5a3e97
mov edx, dword [ebp + 0x10]
mov eax, dword [0x60d1e8]
call fcn.0049f450
mov eax, dword [ebx + 0xc8]
call fcn.005a3eac
mov edx, ebx
mov eax, esi
call fcn.005a3660
jmp 0x5a3ea4
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jne 0x5a3c8f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5bd638
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
test eax, eax
jle 0x5bd801
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x70]
mov edx, dword [ebx + 0x74]
add eax, 1
adc edx, 0
cmp edx, dword [ebx + 0x64]
jne 0x5bd672
cmp eax, dword [ebx + 0x60]
ja 0x5bd688
jmp 0x5bd674
jg 0x5bd688
mov byte [ebp - 5], 0
mov cl, 1
mov edx, ebx
mov eax, esi
call fcn.005bcfc8
jmp 0x5bd801
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [ebx + 0x60]
adc edx, dword [ebx + 0x64]
push edx
push eax
mov eax, dword [ebx + 0x70]
mov edx, dword [ebx + 0x74]
add eax, 1
adc edx, 0
cmp edx, dword [esp + 4]
jne 0x5bd6b5
cmp eax, dword [esp]
pop edx
pop eax
jae 0x5bd6c3
jmp 0x5bd6b9
pop edx
pop eax
jge 0x5bd6c3
mov eax, dword [ebx + 0x70]
inc eax
sub eax, dword [ebx + 0x60]
mov dword [ebp - 0x10], eax
cmp dword [ebx + 0x4ac], 0
jne 0x5bd769
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebx + 8]
call fcn.00420f0c
add eax, 1
adc edx, 0
cmp edx, dword [esp + 4]
jne 0x5bd6f0
cmp eax, dword [esp]
pop edx
pop eax
je 0x5bd801
lea edx, [ebx + 0xa6]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov dword [ebx + 0x4ac], eax
cmp dword [ebx + 0x4ac], 0
je 0x5bd801
cmp byte [ebx + 0x4b0], 0
je 0x5bd769
mov edx, dword [ebx + 0x4ac]
dec edx
test edx, edx
jl 0x5bd769
inc edx
xor eax, eax
movzx ecx, word [ebx + 0x4b2]
shr ecx, 8
xor byte [ebx + eax + 0xa6], cl
xor ecx, ecx
mov cl, byte [ebx + eax + 0xa6]
add cx, word [ebx + 0x4b2]
imul cx, cx, 0xcb6f
add cx, 0x41ba
mov word [ebx + 0x4b2], cx
inc eax
dec edx
jne 0x5bd733
lea eax, [ebp - 0xc]
push eax
lea edx, [ebx + 0xa6]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x328]
mov ecx, dword [ebx + 0x4ac]
call fcn.004a55dc
mov ecx, eax
cmp dword [ebp - 0xc], 0x2733
je 0x5bd801
cmp dword [ebp - 0xc], 0
je 0x5bd7a9
mov byte [ebp - 5], 0
xor ecx, ecx
mov edx, ebx
mov eax, esi
call fcn.005bcfc8
jmp 0x5bd801
mov eax, ecx
cdq
add dword [ebx + 0x60], eax
adc dword [ebx + 0x64], edx
xor eax, eax
mov dword [ebx + 0x4ac], eax
mov eax, dword [ebx + 4]
mov edx, dword [esi + 0x27b0]
mov dword [eax + 0x384], edx
mov eax, ecx
cdq
add dword [esi + 0x30a8], eax
adc dword [esi + 0x30ac], edx
mov eax, ecx
cdq
add dword [esi + 0x30b0], eax
adc dword [esi + 0x30b4], edx
cmp ebx, dword [esi + 0x2c88]
jne 0x5bd7f8
mov edx, ecx
mov eax, esi
call fcn.005b8fe8
dec dword [ebp - 0x14]
jne 0x5bd65a
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e77d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x5e78ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x5e7889
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 1], 1
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
mov edx, dword [ebx + 0x30]
sub edx, 0x80
xor ecx, ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [ebp - 4]
mov ecx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 8]
lea edx, [ebp - 4]
mov ecx, 3
call fcn.00405100
mov eax, dword [ebp - 8]
mov edx, 0x5e78c8
call fcn.0040542c
jne 0x5e7852
mov byte [ebx + 0x28], 0x80
mov edx, dword [ebx + 0x30]
xor eax, eax
mov al, byte [ebx + 0x28]
sub edx, eax
sub edx, 0x20
xor ecx, ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, ebx
mov ecx, 0x20
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, 0x20
jge 0x5e787f
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e7897
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e78b4
lea eax, [ebp - 8]
call fcn.00405010
ret

Function at 0x5eba2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x5eba79
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov edx, dword [ebp - 4]
mov ecx, 0x28
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edi, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
cmp edi, 0x28
jge 0x5eba6f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5eba85
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f339c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5f3461
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0x10
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040c074
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.004052e0
mov edx, eax
test edx, edx
jle 0x5f340b
mov esi, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + esi - 1]
and al, 0xff
and eax, 0xff
mov ecx, ebx
shl ecx, 3
shl eax, cl
xor dword [ebp - 4], eax
inc ebx
and ebx, 0x80000003
jns 0x5f3407
dec ebx
or ebx, 0xfffffffc
inc ebx
inc esi
dec edx
jne 0x5f33e1
imul eax, dword [ebp - 4], 0x4f1bbcdc
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [ebp - 0x19]
push ecx
mov ecx, 0x20
pop ebx
sub ecx, ebx
add ecx, 0x20
call fcn.004063c8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f3468
lea eax, [ebp - 8]
call fcn.00405010
ret

Function at 0x5f3470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov dword [esp], eax
mov byte [esp + 0x18], 0x10
xor edi, edi
xor ebx, ebx
mov eax, dword [esp]
call fcn.004052e0
mov edx, eax
test edx, edx
jle 0x5f34be
mov esi, 1
mov eax, dword [esp]
mov al, byte [eax + esi - 1]
and al, 0xff
and eax, 0xff
mov ecx, ebx
shl ecx, 3
shl eax, cl
xor edi, eax
inc ebx
and ebx, 0x80000003
jns 0x5f34ba
dec ebx
or ebx, 0xfffffffc
inc ebx
inc esi
dec edx
jne 0x5f3495
imul eax, edi, 0x4f1bbcdc
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov cl, byte [esp + 0x18]
push ecx
mov ecx, 0x20
pop ebx
sub ecx, ebx
add ecx, 0x20
call fcn.004063c8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x5f4e48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.004052e0
test eax, eax
je 0x5f4ebc
mov eax, esi
call fcn.004052e0
mov edx, eax
mov eax, dword [esp]
call fcn.0040566c
mov eax, dword [esp]
mov edx, esi
call fcn.00405064
mov eax, esi
call fcn.004052e0
mov ebp, eax
test ebp, ebp
jbe 0x5f4ebc
mov ebx, 1
mov eax, dword [esp]
call fcn.00405538
mov dl, byte [esi + ebx - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [esi + ebx - 1]
add di, ax
imul ax, di, 0x5ab3
add ax, 0x8d1e
mov edi, eax
inc ebx
dec ebp
jne 0x5f4e8c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret