joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60b4cf
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x55
push str.oledrop1.cpp
mov eax, dword [ebp - 0x24]
push eax
call fcn.00575350
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x38], 0
push 1
call dword [sym.imp.user32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x60b533
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x34]
or al, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], eax
jmp 0x60b560
push 2
call dword [sym.imp.user32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x60b560
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x34]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], ecx
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.005cd2c4
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x30], 0
jne 0x60b63a
call fcn.005cd2b3
cmp eax, dword [ebp + 8]
je 0x60b58d
jmp 0x60b63a
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
jne 0x60b5c5
push 1
push pe_nt_image_headers32
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
je 0x60b61a
cmp dword [ebp - 0x1c], 0x202
je 0x60b5e9
cmp dword [ebp - 0x1c], 0x205
je 0x60b5e9
cmp dword [ebp - 0x1c], 0x201
je 0x60b5e9
cmp dword [ebp - 0x1c], 0x204
jne 0x60b5eb
jmp 0x60b63a
cmp dword [ebp - 0x1c], 0x100
jne 0x60b5fc
cmp dword [ebp - 0x18], 0x1b
jne 0x60b5fc
jmp 0x60b63a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
call fcn.005c67c6
neg eax
sbb eax, eax
inc eax
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x684d5c]
jbe 0x60b635
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x30], 1
jmp 0x60b571
call dword [sym.imp.user32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x30]
mov esp, ebp
pop ebp
ret 4
Function at 0x622dab
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62cdaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c4
mov ecx, 0x682c78
call fcn.005d83e0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
jne 0x622e5c
cmp dword [ebp + 8], 0
jne 0x622dee
lea ecx, [ebp - 0x1a0]
mov dword [ebp + 8], ecx
mov word [ebp - 0x1a8], 0x101
mov edx, dword [ebp + 8]
push edx
mov ax, word [ebp - 0x1a8]
push eax
call sub.ws2_32.dll_WSAStartup
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
je 0x622e1e
xor eax, eax
jmp 0x622fbf
mov ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 1
jne 0x622e46
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
sar ecx, 8
and ecx, 0xff
and ecx, 0xff
cmp ecx, 1
je 0x622e52
call sub.ws2_32.dll_WSACleanup
xor eax, eax
jmp 0x622fbf
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0x622d68
call fcn.005d92f4
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0x30], 0
jne 0x622ed8
push 0x54
push str.sockcore.cpp
push 0x1c
call fcn.00564ccf
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1b4], 0
je 0x622eac
push 0xa
mov ecx, dword [ebp - 0x1b4]
call fcn.0055f6b0
mov dword [ebp - 0x1c8], eax
jmp 0x622eb6
mov dword [ebp - 0x1c8], 0
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1b0]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x34], 0
jne 0x622f49
push 0x56
push str.sockcore.cpp
push 0x1c
call fcn.00564ccf
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1bc], 0
je 0x622f1d
push 0xa
mov ecx, dword [ebp - 0x1bc]
call fcn.0055f6b0
mov dword [ebp - 0x1cc], eax
jmp 0x622f27
mov dword [ebp - 0x1cc], 0
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x1b8], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b8]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp - 0x1ac]
cmp dword [edx + 0x38], 0
jne 0x622fba
push 0x58
push str.sockcore.cpp
push 0x1c
call fcn.00564ccf
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c4], 0
je 0x622f8e
push 0xa
mov ecx, dword [ebp - 0x1c4]
call fcn.00559f40
mov dword [ebp - 0x1d0], eax
jmp 0x622f98
mov dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1c0]
mov dword [ecx + 0x38], edx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x623ece
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call sub.ws2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x414a60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x414a82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414a89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414a78
mov eax, 1
add ebx, ebx
jne 0x414a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414a90
jne 0x414aac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414a90
xor ecx, ecx
sub eax, 3
jb 0x414ac0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414b32
mov ebp, eax
add ebx, ebx
jne 0x414acb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414afc
inc ecx
add ebx, ebx
jne 0x414ae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414add
jne 0x414af9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414add
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414b1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414b0d
jmp 0x414a7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414b1c
add edi, ecx
jmp 0x414a7e
pop esi
mov edi, esi
mov ecx, 0x3a1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414b3a
cmp byte [edi], 5
jne 0x414b3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414b3f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414bae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14fe8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15060]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414b6c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15064]
or eax, eax
je 0x414ba8
mov dword [ebx], eax
add ebx, 4
jmp 0x414b89
call dword [esi + 0x1506c]
mov ebp, dword [esi + 0x15068]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414be2
sub esp, 0xffffff80
jmp 0x4022ef
Function at 0x413037
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x41303d
pop eax
sub eax, 0x3d
push eax
lea edi, [eax - 0x12000]
push edi
add word [edi + 0x11704], 1
lea esi, [eax + 0x1f0]
or ebp, 0xffffffff
xor ebx, ebx
nop
nop
nop
jmp 0x41306a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413075
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413064
mov eax, 1
add ebx, ebx
jne 0x413087
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x41307c
jne 0x413098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41307c
xor ecx, ecx
sub eax, 3
jb 0x413106
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413122
mov ebp, eax
add ebx, ebx
jne 0x4130b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4130c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4130e8
inc ecx
add ebx, ebx
jne 0x4130d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x4130c9
jne 0x4130e5
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4130c9
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x41310c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4130f8
jmp 0x41306a
mov eax, ebp
jmp 0x4130ac
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41310c
add edi, ecx
jmp 0x41306a
pop esi
pop ebp
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x25d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413133
cmp byte [edi], 1
jne 0x413133
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x413138
pop edi
mov eax, dword [edi]
or eax, eax
je 0x41319d
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11000]
add ebx, esi
push eax
add edi, 8
call dword [ebp]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413160
push edx
mov ecx, edi
jns 0x41318d
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [ebp + 4]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x41317a
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4131ce
cmp al, 0xef
ja 0x4131c1
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4131a3
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4131b0
popal
jmp section.UPX0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7a8a418c
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ec6173f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x40102b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x40102e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x401016
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x40100b
mov esp, ebp
pop ebp
ret

Function at 0x44b855
Capabilities:
Hash data with crc32

Disassembly:
mov edx, 0xbc0fe390
insb byte es:[edi], dx
ja 0x44b89b
pop es
wait
cmp eax, 0xec8b550e
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x44b880
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x44b883
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x44b86b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
clc
cmp dword [ebp - 8], 0x100
jne 0x44b860
mov esp, ebp
pop ebp
ret
Function at 0x45e461
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x3c
popfd
xchg ecx, eax
insd dword es:[edi], dx
arpl word [edx], si
fidiv dword [eax + 0x1d]
iretd
outsd dx, dword [esi]
sbb eax, 0xd842df54
daa
stosb byte es:[edi], al
and byte [0x74bcfc92], bl
xor al, 0x6e
loopne 0x45e385
mov ah, 0x4b
out 0x5d, eax
mov eax, 0x9b0fd535
cli
sub bl, 0xb3
and ecx, dword [eax - 0x1b]
add edi, ebx
test eax, 0x3f3d10bc
pop esp
rcr byte [ecx + 0x6d766902], 0xe2
cmp dh, byte [ecx]
mov ecx, 0x2ef76f8e
xchg esp, eax
into
fsubr st(3)
mov bl, 0xd3
vrcpss xmm6, xmm4, xmm0
cmp eax, 0x2d97d45d
enter 0xffffffffffff9fe0, 0x13
sub byte [eax], al
or eax, 0x788b3fbe
xchg esi, eax
mov esi, 0x96788b3f
aas
mov edi, dword [eax - 0x6a]
scasd eax, dword es:[edi]
mov ch, byte [ecx - 0x4c]
sar dword [ecx - 0x411bb5a6], cl
sbb al, byte [ecx - 0x70]
dec byte [edx - 0x13218c20]
sub al, 0x66
mov esi, 0x82460f8
xor al, 0x9d
popfd
popfd
pop ss
jno 0x45e440
dec ebp
popal
jnp 0x45e3f2
das
push ss
js 0x45e4b4
jae 0x45e484
inc esi
pop eax
jb 0x45e441
mov al, byte [0x69c05141]
push esp
xor bh, bh
adc dword [ebp + 0x2826a7a5], ebp
and bl, byte [eax + 0x13]
mov byte [0x92b14aa0], al
sub byte es:[edx], ah
pop eax
adc esp, dword [edx - 0x6d4eb560]
dec edi
cmc
imul ecx, dword [edx], 0xffffffc4
push 0xffffffffffffff8d
lodsd eax, dword [esi]
push eax
mul dword [eax + 0x30d670d9]
lodsb al, byte [esi]
xor eax, edx
xor byte [ebp - 0x1b8f6c6e], cl
popal
adc ebx, dword [eax + 0x66ad2ba9]
dec edi
enter 0xffffffffffffdee1, 0xffffffffffffffcd
inc ebx
jno 0x45e471
ret
xor al, 0x20
pushal
jge 0x45e4e9
or dword [ebp - 0x4f923a52], eax
xor esi, dword [ebx + 0x783f182]
cwde
popal
push esi
in al, dx
bsr esi, edx
imul edi, ebp, 0xffffffca
sbb al, 0xc
in al, 0x81
pop ss
fstp xword [ebx - 0x70]
dec edx
sub eax, 0x3b0abc
nop
adc eax, dword [ecx]
push es
jae 0x45e559
sub eax, 0xb095dc46
nop
jns 0x45e480
mov eax, dword [0xf4b1d070]
cmp eax, 0xb24c027a
cmp eax, 0x4f5c5f5a
pushfd
insb byte es:[edi], dx
xchg edi, eax
jae 0x45e546
cmc
cmp eax, 0x1db0fa7
mov word [ebp - 0x4c], ds
jg 0x45e576
mov ah, 0x7f
imul ecx, dword [edx + eax*4], 0x11
dec ebx
sub al, 0xa4
or al, 0x82
adc dword [ebx + 0x2c], ecx
movsb byte es:[edi], byte [esi]
sub eax, 0xcdb59fa1
sbb cl, 0x2b
pop ebp
jp 0x45e508
adc ebx, dword [ebp - 0x2d]
sar byte [ebx + 0x44], 1
ljmp 0xf749
sbb esp, ebx
push eax
and byte [ecx - 0x2e], ah
or eax, 0x1a84fd14
sub esp, dword [0x6d09cca4]
push ss
sbb esp, dword [eax + 0x4b9fba54]
aaa
in al, dx
movsd dword es:[edi], dword [esi]
arpl word [ebx + 0x6c085193], di
lodsb al, byte [esi]
dec eax
mov bh, 0x21
mov eax, dword [0x800ffc5e]
sbb al, 0xdc
fstp qword [edi + 0x2c]
dec edi
xchg esi, eax
iretd
Function at 0x4e1370
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4e139b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x4e139e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4e1386
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x4e137b
mov esp, ebp
pop ebp
ret

Function at 0x5ce96d
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
push esi
sub eax, 0x1883c79a
and eax, 0x93e273cf
sbb byte [0x93e273cf], ah
lcall 0x3b66, 0x7ef5cbd5
xlatb
xor dword [ebx - 0x7c6346cb], eax
imul ebx, dword [eax], 0x49
stosb byte es:[edi], al
mov edi, dword [edi]
test dword [ebx], eax
mov dword [edi], esp
fld qword [esi - 0x3229e2c5]
push 0xffffffffffffffb7
adc al, 0xb1
jnp 0x5ce973
dec esp
les ebp, [edx]
mov edx, 0x855beeb4
add byte [eax + 0x78], al
insd dword es:[edi], dx
lea edi, [edi + 0x7df4157b]
dec edi
in eax, 0xca
invalid

Function at 0x6596ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661388
cmp edx, dword [eax]
je 0x65970f
add eax, 8
inc ecx
cmp eax, 0x661418
jl 0x659700
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661388]
jne 0x65983d
mov eax, dword [0xa5bee8]
cmp eax, 1
je 0x659817
test eax, eax
jne 0x659740
cmp dword [0x6612b4], 1
je 0x659817
cmp edx, 0xfc
je 0x65983d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659777
lea eax, [ebp - 0x1a4]
push 0x65e970
push eax
call fcn.0065a0d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a560
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6597ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a560
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e96c
push edi
call fcn.0065c430
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e950
push eax
call fcn.0065a0d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a0e0
lea eax, [ebp - 0xa0]
push 0x65e94c
push eax
call fcn.0065a0e0
push dword [esi + 0x66138c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a0e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e924
push eax
call fcn.0065c3a4
add esp, 0x2c
pop edi
jmp 0x65983d
lea eax, [ebp + 8]
lea esi, [esi + 0x66138c]
push 0
push eax
push dword [esi]
call fcn.0065a560
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7c4980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x7eb01c]
push edi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x50b03b2
nop
push eax
nop
call 0x77e75da0
mov ebx, eax
push 0x7f4fb0
mov dword [ebp - 4], ebx
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
mov byte [ebx + edi], 0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x7c4a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x779197f0
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x7f4fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x7c4a26
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
push 0x7f4fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x50b03b8
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7c6e30
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x7c6ed1
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x77918cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x7c6f00
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x7c6f00
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x7c6ed1
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x77918cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x7c6f00
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x7c6f00
movzx eax, word [esi + 0x46]
test ax, ax
je 0x7c6f00
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.009f90f4]
push eax
call dword [fcn.009f9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x7c6ed7
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.007c74d0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0xcbb010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0x7ed014], al
je 0xcbb02d
inc eax
cmp byte [eax + 0x7ed014], 0
jne 0xcbb023
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00c99a40
mov dword [esi], eax
test eax, eax
je 0xcbb04b
push 0x7ed014
push eax
call dword [fcn.009f9134]
mov esi, dword [0x9f8aa4]
xor eax, eax
cmp byte [esi], al
je 0xcbb05e
inc eax
cmp byte [esi + eax], 0
jne 0xcbb057
inc eax
call fcn.00c99a40
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0xcbb075
push esi
push ebx
call dword [fcn.009f9134]
lea eax, [ebp - 0x24]
push eax
call dword [0x9f9044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x9f8ec0], si
cmp dword [ebp + 0xc], edi
jle 0xcbb0e9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x9f8ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0xcbb0a0
mov word [0x9f8ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0xcbb161
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0xcbb131
cmp dword [ecx], 0
je 0xcbb131
cmp dword [0x9f91c4], ecx
jne 0xcbb11b
mov dword [0x9f91c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0xcbb131
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xcbb161
cmp dword [ecx], 0
je 0xcbb161
cmp dword [0x9f91c4], eax
jne 0xcbb14b
mov dword [0x9f91c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0xcbb161
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret