joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a2c0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], pe_nt_image_headers32
inc edx
sub eax, edx
cmp eax, 8
jae 0x54a301
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.006e6ec0
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.00549840
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.006e6ec0
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.00549840
movzx eax, byte [esi + 8]
mov ecx, dword [esi + 8]
mov byte [edi], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
shr ecx, 0x18
mov byte [edi + 3], cl
mov ecx, dword [esi + 0xc]
mov eax, ecx
shr eax, 8
mov byte [edi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 6], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
shr ecx, 0x18
mov byte [edi + 7], cl
mov ecx, dword [esi + 0x10]
mov eax, ecx
shr eax, 8
mov byte [edi + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x14]
shr ecx, 0x18
mov byte [edi + 0xc], al
mov byte [edi + 0xb], cl
mov ecx, dword [esi + 0x14]
mov eax, ecx
shr eax, 8
mov byte [edi + 0xd], al
mov eax, ecx
push 0x98
shr eax, 0x10
shr ecx, 0x18
push 0
push esi
mov byte [edi + 0xe], al
mov byte [edi + 0xf], cl
call fcn.006e6ec0
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x54a3f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xdc], ecx
xor eax, eax
push ebx
mov ecx, edx
mov byte [ebp - 8], 0
push esi
xorps xmm0, xmm0
mov byte [ebp - 0x3c], 0
push edi
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x3b], ax
lea esi, [ecx + 1]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 0xd0], 0x67452301
mov dword [ebp - 0xcc], 0xefcdab89
mov dword [ebp - 0xc8], 0x98badcfe
mov dword [ebp - 0xc4], 0x10325476
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x54a460
sub ecx, esi
push ecx
lea ecx, [ebp - 0xd8]
call fcn.0054a210
add esp, 4
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x38]
call fcn.0054a2c0
xor ebx, ebx
nop dword [eax + eax]
movzx eax, byte [ebp + ebx - 0x38]
push eax
lea eax, [ebp - 0x3c]
push 0x784dc0
push eax
call fcn.00407ae0
lea eax, [ebp - 0x3c]
add esp, 0xc
mov esi, eax
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54a4b0
lea edi, [ebp - 0x28]
sub eax, esi
dec edi
nop dword [eax]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x54a4c0
mov ecx, eax
inc ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 0x10
jl 0x54a490
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0x28]
mov eax, ecx
sub edx, eax
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x54a4f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x560cc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x80], 1
xor esi, esi
test edi, edi
je 0x560d48
push ebx
mov ebx, 0xff
nop word [eax + eax]
mov dword [ebp + esi*4 - 0x7c], 1
mov ecx, esi
test esi, esi
je 0x560d28
nop
mov eax, dword [ebp + ecx*4 - 0x80]
xor edx, edx
movzx eax, byte [eax + 0x8b4138]
add eax, esi
div ebx
movzx eax, byte [edx + 0x8b4258]
xor eax, dword [ebp + ecx*4 - 0x84]
mov dword [ebp + ecx*4 - 0x80], eax
sub ecx, 1
jne 0x560d00
mov eax, dword [ebp - 0x80]
xor edx, edx
movzx eax, byte [eax + 0x8b4138]
add eax, esi
inc esi
div ebx
movzx eax, byte [edx + 0x8b4258]
mov dword [ebp - 0x80], eax
cmp esi, edi
jb 0x560cf0
pop ebx
lea ecx, [edi - 2]
xor edx, edx
mov eax, ecx
shl eax, 5
sub eax, ecx
lea ecx, [eax + 0x8b3db0]
nop word [eax + eax]
mov eax, dword [ebp + edx*4 - 0x80]
mov al, byte [eax + 0x8b4138]
mov byte [ecx + edx], al
inc edx
cmp edx, edi
jbe 0x560d60
mov ecx, dword [ebp - 4]
mov byte [edi + 0x8b4236], 1
xor ecx, ebp
pop edi
pop esi
call fcn.006a7b19
mov esp, ebp
pop ebp
ret

Function at 0x560d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x8b33b8], 0
push esi
mov esi, edx
mov dword [ebp - 0xc], ecx
jne 0x560dd7
call fcn.00560c70
xorps xmm0, xmm0
mov dword [0x8b4250], 0
movups xmmword [0x8b4238], xmm0
mov byte [0x8b4254], 0
movq qword [0x8b4248], xmm0
mov dword [0x8b33b8], 1
cmp esi, 0x1e
jbe 0x560de4
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push esi
push 0
push ebx
call fcn.006e6ec0
add esp, 0xc
cmp byte [esi + 0x8b4236], 0
jne 0x560e05
mov ecx, esi
call fcn.00560cc0
lea eax, [esi - 2]
xor edi, edi
mov edx, eax
mov dword [ebp - 8], edi
shl edx, 5
sub edx, eax
add edx, 0x8b3db0
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], edi
jbe 0x560ecd
mov dword [ebp - 0x18], 0xff
nop dword [eax]
mov eax, dword [ebp + 8]
movzx ecx, byte [edi + eax]
movzx eax, byte [ebx]
xor ecx, eax
mov al, byte [ecx + 0x8b4138]
mov byte [ebp - 1], al
cmp al, 0xff
je 0x560e7f
mov ecx, 1
cmp esi, ecx
jbe 0x560e7f
movzx eax, al
lea edi, [esi - 1]
mov dword [ebp - 0x14], eax
add edi, edx
nop dword [eax]
movzx eax, byte [edi]
lea edi, [edi - 1]
add eax, dword [ebp - 0x14]
xor edx, edx
div dword [ebp - 0x18]
mov al, byte [edx + 0x8b4258]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jb 0x560e60
mov edi, dword [ebp - 8]
lea eax, [esi - 1]
push eax
lea eax, [ebx + 1]
push eax
push ebx
call fcn.006e5e40
mov cl, byte [ebp - 1]
add esp, 0xc
cmp cl, 0xff
je 0x560eb8
mov eax, dword [ebp - 0x10]
xor edx, edx
movzx ecx, cl
movzx eax, byte [eax]
add eax, ecx
mov ecx, 0xff
div ecx
mov al, byte [edx + 0x8b4258]
mov byte [esi + ebx - 1], al
jmp 0x560ebd
mov byte [esi + ebx - 1], 0
mov edx, dword [ebp - 0x10]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0xc]
jb 0x560e30
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5610e0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x7cdffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x561100
mov esi, 1
mov edx, 0x8b4958
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x8b4980
jl 0x561140
mov eax, 1
mov byte [0x8b4358], 0x63
mov byte [0x8b48bb], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x8b4358], bl
mov byte [ebx + 0x8b4858], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x561180
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x8b4358]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x8b5d80], ecx
rol ecx, 8
mov dword [esi*4 + 0x8b5980], ecx
rol ecx, 8
mov dword [esi*4 + 0x8b4d80], ecx
rol ecx, 8
mov dword [esi*4 + 0x8b4980], ecx
movzx ecx, byte [esi + 0x8b4858]
test ecx, ecx
je 0x5612c0
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x5612cc
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x8b5580], eax
rol eax, 8
mov dword [esi*4 + 0x8b5180], eax
rol eax, 8
mov dword [esi*4 + 0x8b6180], eax
rol eax, 8
mov dword [esi*4 + 0x8b4458], eax
inc esi
cmp esi, 0x100
jl 0x561200
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x5621c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x7cdffc]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.006e6ec0
add esp, 8
lea edi, [ebx + 8]
mov edx, esi
mov dword [ebx + 4], edi
lea ecx, [esp + 0x14]
call fcn.00561330
mov edx, eax
add esp, 4
mov dword [esp + 0xc], edx
test edx, edx
jne 0x5623a3
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x56238d
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x8b4358]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x8b4458]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b6180]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b5180]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b5580]
mov dword [edi], edx
movzx eax, byte [ecx + 4]
movzx edx, byte [eax + 0x8b4358]
movzx eax, byte [ecx + 7]
mov edx, dword [edx*4 + 0x8b5580]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b4458]
movzx eax, byte [ecx + 6]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b6180]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b5180]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 8]
movzx edx, byte [eax + 0x8b4358]
movzx eax, byte [ecx + 0xb]
mov edx, dword [edx*4 + 0x8b5580]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b4458]
movzx eax, byte [ecx + 0xa]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b6180]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b5180]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xc]
movzx edx, byte [eax + 0x8b4358]
movzx eax, byte [ecx + 0xf]
mov edx, dword [edx*4 + 0x8b5580]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b4458]
movzx eax, byte [ecx + 0xe]
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b6180]
movzx eax, byte [ecx + 0xd]
sub ecx, 0x10
movzx eax, byte [eax + 0x8b4358]
xor edx, dword [eax*4 + 0x8b5180]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x562250
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x5623b0
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006a7b19
mov esp, ebp
pop ebp
ret
Function at 0x6b31e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x6b3229
mov al, byte [esi]
push eax
call fcn.006be860
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x6b3207
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x6b4440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x6b445e
cmp dword [esi + 0x6c], 0
je 0x6b445e
push 2
push 3
push esi
call fcn.006bee00
add esp, 0xc
push dword [ebp + 0xc]
call fcn.006c08a0
add esp, 4
test esi, esi
je 0x6b447e
cmp dword [esi + 0x6c], 0
je 0x6b447e
push 3
push esi
call fcn.006bee40
add esp, 8
pop esi
pop ebp
ret

Function at 0x6bc3e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1d0], 0
je 0x6bc424
push esi
push 1
push edi
call fcn.006af7a0
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.006af7a0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x6bc45a
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x771d80
push 2
push eax
call fcn.006ee624
push dword [edi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.006ee624
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x6be550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.006be5a0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00700423
Function at 0x6cb020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.006ee9d1
add esp, 0x18
test eax, eax
je 0x6cb042
cmp eax, 0xffffffff
jne 0x6cb044
xor eax, eax
pop ebp
ret
Function at 0x6d2770
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x6d279f
push str.Couldnt_set_desired_mode
push edx
call fcn.006bc460
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x6d27b6
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.006bc540
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x6d27cd
push edi
call fcn.006d24d0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x6d27e1
push edi
call fcn.006d1500
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x6d27f5
push edi
call fcn.006d24b0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x6d2805
push edi
call fcn.006d2650
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x6e2110
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x6e3190
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x7ce07c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x6e31bd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x6e3207
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x6e320d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x6e326b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x6e3230
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x6e3297
mov eax, dword [esi + 4]
push 1
push 0x777d7e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x777d7f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x6e3270
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x6e32a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x6e32f0
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmp dl, 2
cmovb ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x6e32b2
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x704d21
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00704ba0
Function at 0x962488
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [edi + edx*8], bh
test ax, 0x4df6
xor edx, ebx
not edx
jmp 0xdf0aec
test eax, 0xd9337ba7
stc
test si, 0xf51
cmp eax, esi
add edi, ecx
push edi
ret
call fcn.00973d64
inc eax
test dword [edi], ebp
js 0x96245b
push edx
fdivr dword [edi + 0x15]
inc ecx
cmp bh, byte [eax + 0x7e]
pop ebp
jle 0x9624f8
je 0x96243b
rcr ebx, cl
shr byte [edx], 0x1e
xor ah, ch
mov byte [edx], al
xor eax, 0xf10a30f4
pop esp
add eax, dword [eax + ebp*4]
xor ebx, dword [esi + 0x7a]
test byte cs:[0xeff4b8b0], ah
stosb byte es:[edi], al
out 0x51, al
jae 0x962499
adc eax, eax
xchg ebx, eax
sar dword [ebx - 0xa], 1
and ebp, dword [edi - 0x1c447bd]
ljmp 0x6ea2
push ss
add eax, 0xa7a740d5
dec esp
lodsb al, byte [esi]
stosd dword es:[edi], eax
pop ecx
xlatb
imul esi, dword [esi], 0xf95dbabc
push ebx
sub bh, byte [ebx + 0x3e]
or dword [ebx - 0x18004f61], eax
movsb byte es:[edi], byte [esi]
xchg esi, eax
test al, 0xff
invalid
jmp fcn.008d53e1
dec edx
cmc
ror edx, 3
xor edx, 0x4d4a371b
xor ebx, edx
add edi, edx
jmp 0xadffca

Function at 0x9f5f12
Capabilities:
Encode data using xor

Disassembly:
push edx
pushfd
mov edx, 0x3b350d6
push edi
not edx
add edx, edx
push 0x6255016e
mov edi, dword [esp]
cmp edi, 0x323813a9
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], 0xd8d1dc72
mov edi, dword [esp + edi - 0x6255016a]
jo 0x9f5f31
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00df3873
or bl, byte [eax]
pop ecx
invalid
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffb8
sar dword [esi - 0x2aa371e7], cl
invalid
dec ebp
jae 0x415398
nop
sbb eax, 0x1817311a
sti
cmp byte [esi + 0x3c50b19a], al
out dx, al
adc cl, byte [edx]
ljmp 0x479c

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32233255
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x11e05bfa
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x411932
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b47c
and dword [ebp - 0x14], 0
cmp dword [0x432ca4], 0
mov dword [ebp - 0x18], eax
jne 0x4119e5
push 0x403e68
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411a8d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e5c
push ebx
call edi
test eax, eax
je 0x411a8d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e4c
push ebx
mov dword [0x432ca4], eax
call edi
push eax
call esi
push 0x403e38
push ebx
mov dword [0x432ca8], eax
call edi
push eax
call esi
push 0x403e1c
push ebx
mov dword [0x432cac], eax
call edi
push eax
call esi
mov dword [0x432cb4], eax
test eax, eax
je 0x4119e5
push 0x403e04
push ebx
call edi
push eax
call esi
mov dword [0x432cb0], eax
mov eax, dword [0x432cb0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411a3e
cmp dword [0x432cb4], ecx
je 0x411a3e
push eax
call esi
push dword [0x432cb4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411a3e
test ebx, ebx
je 0x411a3e
call edi
test eax, eax
je 0x411a35
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411a35
test byte [ebp - 8], 1
jne 0x411a3e
or dword [ebp + 0x10], 0x200000
jmp 0x411a71
mov eax, dword [0x432ca8]
cmp eax, dword [ebp - 0x18]
je 0x411a71
push eax
call esi
test eax, eax
je 0x411a71
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411a71
mov eax, dword [0x432cac]
cmp eax, dword [ebp - 0x18]
je 0x411a71
push eax
call esi
test eax, eax
je 0x411a71
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x432ca4]
call esi
test eax, eax
je 0x411a8d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411a8f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093db
leave
ret