joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b590280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, dword [ebp + 8]
mov al, byte [esi]
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [esp + 4], ecx
mov byte [esp + 3], al
movzx ebx, al
test bl, 0x40
jne 0x6b5902bd
lea eax, [esi + 0x10]
push dword [esp + 4]
push eax
push esi
call edi
add esp, 0xc
add dword [esi + 0x20], 1
adc dword [esi + 0x24], 0
mov dword [esp + 0xc], edi
mov edi, dword [ebp + 0x14]
and ebx, 7
mov byte [esi], bl
mov eax, ebx
xor eax, 0xf
test ebx, ebx
mov dword [esp + 0x14], eax
je 0x6b5902f7
xor edx, edx
mov ecx, eax
nop
nop
movzx eax, byte [esi + ecx]
or eax, edx
mov byte [esi + ecx], 0
shl eax, 8
inc ecx
cmp ecx, 0xf
mov edx, eax
jne 0x6b5902e0
jmp 0x6b5902f9
xor eax, eax
movzx ecx, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
mov eax, 0xffffffff
cmp ecx, edi
jne 0x6b59046f
lea ecx, [edi + 0xf]
shr ecx, 3
or ecx, 1
mov edx, dword [esi + 0x24]
add ecx, dword [esi + 0x20]
adc edx, 0
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov eax, 0xfffffffe
neg ecx
mov ecx, 0x20000000
sbb ecx, edx
jb 0x6b59046f
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, edi
shr ebx, 4
mov dword [esp + 0x10], eax
je 0x6b5903b9
lea ecx, [esi + 0x10]
push ecx
push esi
push dword [esp + 0xc]
push ebx
push edx
push eax
call dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add esp, 0x18
mov eax, edi
and eax, 0xf
je 0x6b590420
and edi, 0xfffffff0
add dword [esp + 0x10], edi
add ecx, edi
mov dword [esp + 8], ecx
xor edi, edi
mov ecx, 7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, bl
add edx, edi
movzx edi, byte [esi + ecx + 8]
add edx, edi
mov byte [esi + ecx + 8], dl
sub ecx, 1
jb 0x6b5903b3
shr edx, 8
shr ebx, 8
mov edi, edx
or edi, ebx
mov edi, edx
jne 0x6b590390
mov edi, eax
mov edx, dword [esp + 8]
test edi, edi
mov ebx, dword [esp + 0x10]
je 0x6b590420
mov dword [esp + 8], edx
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + eax]
xor byte [esi + eax + 0x10], cl
inc eax
cmp edi, eax
jne 0x6b5903d0
lea eax, [esi + 0x10]
push dword [esp + 4]
push eax
push eax
call dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x18]
push dword [esp + 4]
push eax
push esi
call dword [esp + 0x18]
add esp, 0xc
xor eax, eax
mov edx, dword [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + eax]
xor cl, byte [esp + eax + 0x18]
mov byte [edx + eax], cl
inc eax
cmp eax, edi
jb 0x6b590410
mov edx, dword [esp + 0x14]
lea eax, [esi + edx]
mov ecx, 0x10
sub ecx, edx
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push dword [esp + 4]
push eax
push esi
call dword [esp + 0x18]
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [esi + 0x14], ecx
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor dword [esi + 0x18], ecx
xor dword [esi + 0x1c], eax
mov al, byte [esp + 3]
mov byte [esi], al
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b590480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, dword [ebp + 8]
mov al, byte [esi]
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [esp + 4], ecx
mov byte [esp + 3], al
movzx ebx, al
test bl, 0x40
jne 0x6b5904b5
lea eax, [esi + 0x10]
push dword [esp + 4]
push eax
push esi
call edi
add esp, 0xc
mov dword [esp + 0xc], edi
mov edi, dword [ebp + 0x14]
and ebx, 7
mov byte [esi], bl
mov eax, ebx
xor eax, 0xf
test ebx, ebx
mov dword [esp + 0x14], eax
je 0x6b5904f7
xor edx, edx
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + ecx]
or eax, edx
mov byte [esi + ecx], 0
shl eax, 8
inc ecx
cmp ecx, 0xf
mov edx, eax
jne 0x6b5904e0
jmp 0x6b5904f9
xor eax, eax
movzx ecx, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
mov eax, 0xffffffff
cmp ecx, edi
jne 0x6b590623
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, edi
shr ebx, 4
mov dword [esp + 0x10], eax
je 0x6b590589
lea ecx, [esi + 0x10]
push ecx
push esi
push dword [esp + 0xc]
push ebx
push edx
push eax
call dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add esp, 0x18
mov eax, edi
and eax, 0xf
je 0x6b5905d4
and edi, 0xfffffff0
add dword [esp + 0x10], edi
add ecx, edi
mov dword [esp + 8], ecx
xor edi, edi
mov ecx, 7
nop
nop
nop
nop
nop
nop
nop
movzx edx, bl
add edx, edi
movzx edi, byte [esi + ecx + 8]
add edx, edi
mov byte [esi + ecx + 8], dl
sub ecx, 1
jb 0x6b590583
shr edx, 8
shr ebx, 8
mov edi, edx
or edi, ebx
mov edi, edx
jne 0x6b590560
mov edi, eax
mov edx, dword [esp + 8]
test edi, edi
je 0x6b5905d4
lea eax, [esp + 0x18]
push dword [esp + 4]
push eax
push esi
mov dword [esp + 0x14], edx
call dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add esp, 0xc
xor eax, eax
mov ebx, dword [esp + 0x10]
movzx ecx, byte [ebx + eax]
xor cl, byte [esp + eax + 0x18]
mov byte [edx + eax], cl
xor byte [esi + eax + 0x10], cl
inc eax
cmp edi, eax
jne 0x6b5905b0
lea eax, [esi + 0x10]
push dword [esp + 4]
push eax
push eax
call dword [esp + 0x18]
add esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esi + edx]
mov ecx, 0x10
sub ecx, edx
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push dword [esp + 4]
push eax
push esi
call dword [esp + 0x18]
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [esi + 0x14], ecx
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor dword [esi + 0x18], ecx
xor dword [esi + 0x1c], eax
mov al, byte [esp + 3]
mov byte [esi], al
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b594a50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, edx
mov edi, ecx
mov ebx, dword [ecx + 0x14]
cmp ebx, edx
jae 0x6b594bed
mov eax, dword [edi + 0x18]
cmp eax, esi
ja 0x6b594a9b
mov ecx, esi
sub ecx, eax
add ecx, 4
and ecx, 0xfffffffc
add ecx, eax
mov dword [edi + 0x18], ecx
shl ecx, 4
push 0
push 0x6b774e05
push ecx
push dword [edi + 0x40]
call fcn.6b584d70
add esp, 0x10
test eax, eax
je 0x6b594bfd
mov dword [edi + 0x40], eax
mov ebp, esi
sub ebp, ebx
shl ebx, 4
add ebx, 0x1f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x40]
movzx eax, byte [ecx + ebx - 0x1f]
mov byte [esp + 2], al
mov dh, byte [ecx + ebx - 0x17]
sar al, 7
and al, 0x87
mov byte [esp + 3], al
movzx eax, byte [ecx + ebx - 0x10]
mov ah, al
add ah, al
mov byte [ecx + ebx], ah
mov dl, byte [ecx + ebx - 0x11]
shr al, 7
mov ah, dl
add ah, dl
or ah, al
mov byte [ecx + ebx - 1], ah
movzx eax, byte [ecx + ebx - 0x12]
shr dl, 7
mov ah, al
add ah, al
or ah, dl
mov byte [ecx + ebx - 2], ah
mov dl, byte [ecx + ebx - 0x13]
shr al, 7
mov ah, dl
add ah, dl
or ah, al
mov byte [ecx + ebx - 3], ah
movzx eax, byte [ecx + ebx - 0x14]
shr dl, 7
mov ah, al
add ah, al
or ah, dl
mov byte [ecx + ebx - 4], ah
mov dl, byte [ecx + ebx - 0x15]
shr al, 7
mov ah, dl
add ah, dl
or ah, al
mov byte [ecx + ebx - 5], ah
movzx eax, byte [ecx + ebx - 0x16]
shr dl, 7
mov ah, al
add ah, al
or ah, dl
mov byte [ecx + ebx - 6], ah
shr al, 7
mov dl, dh
add dl, dh
or dl, al
mov byte [ecx + ebx - 7], dl
movzx eax, byte [ecx + ebx - 0x18]
shr dh, 7
mov dl, al
add dl, al
or dl, dh
mov byte [ecx + ebx - 8], dl
movzx edx, byte [ecx + ebx - 0x19]
shr al, 7
mov ah, dl
add ah, dl
or ah, al
mov byte [ecx + ebx - 9], ah
movzx eax, byte [ecx + ebx - 0x1a]
shr dl, 7
mov ah, al
add ah, al
or ah, dl
mov byte [ecx + ebx - 0xa], ah
movzx edx, byte [ecx + ebx - 0x1b]
shr al, 7
mov ah, dl
add ah, dl
or ah, al
mov byte [ecx + ebx - 0xb], ah
movzx eax, byte [ecx + ebx - 0x1c]
shr dl, 7
mov ah, al
add ah, al
or ah, dl
mov byte [ecx + ebx - 0xc], ah
movzx edx, byte [ecx + ebx - 0x1e]
mov ah, byte [ecx + ebx - 0x1d]
shr al, 7
mov dh, ah
add dh, ah
or dh, al
mov byte [ecx + ebx - 0xd], dh
shr ah, 7
mov al, dl
add al, dl
or al, ah
mov byte [ecx + ebx - 0xe], al
movzx eax, byte [esp + 2]
add al, al
shr dl, 7
or dl, al
mov byte [ecx + ebx - 0xf], dl
movzx eax, byte [esp + 3]
xor byte [ecx + ebx], al
add ebx, 0x10
dec ebp
jne 0x6b594ab0
mov dword [edi + 0x14], esi
shl esi, 4
add esi, dword [edi + 0x40]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x6b594bf3
Function at 0x6b5a0010
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp], edx
mov edi, ecx
push ecx
call fcn.6b5b9d80
add esp, 4
test eax, eax
jle 0x6b5a0238
xor esi, esi
mov dword [esp + 8], edi
jmp 0x6b5a0066
push ebx
push dword [esp + 0x28]
call fcn.6b5b9ba0
add esp, 8
test eax, eax
je 0x6b5a0245
nop
nop
nop
nop
nop
nop
inc esi
mov edi, dword [esp + 8]
push edi
call fcn.6b5b9d80
add esp, 4
cmp esi, eax
jge 0x6b5a0238
push esi
push edi
call fcn.6b5b9da0
add esp, 8
mov ebx, eax
push 0x9c
push eax
call fcn.6b5a09f0
add esp, 8
test eax, eax
mov ebp, 0
je 0x6b5a008c
mov ebp, dword [eax + 4]
push 0x9d
push ebx
call fcn.6b5a09f0
add esp, 8
test eax, eax
je 0x6b5a00b0
mov edi, dword [eax + 4]
jmp 0x6b5a00b2
xor edi, edi
push ebx
call fcn.6b5a0a50
add esp, 4
add eax, 0xffffff6a
cmp eax, 5
ja case.0x6b5a00c5.153
jmp dword [eax*4 + 0x6b78a558]
cmp dword [esp + 0x20], 0
je case.0x6b5a00c5.153
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
jne case.0x6b5a00c5.153
push ebx
call fcn.6b5a0a30
add esp, 4
push eax
call fcn.6b56f8d0
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
test eax, eax
jne case.0x6b5a00c5.153
jmp 0x6b5a025b
cmp dword [esp + 0x20], 0
je case.0x6b5a00c5.153
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
jne case.0x6b5a00c5.153
push 0xffffffffffffffff
push dword [esp + 4]
push ebx
call fcn.6b6a49c0
add esp, 0xc
mov ebp, eax
xor eax, eax
test ebp, ebp
je 0x6b5a023d
push ebp
call fcn.6b56f8d0
add esp, 4
mov edi, dword [esp + 0x20]
mov dword [edi], eax
push ebp
call fcn.6b526890
xor eax, eax
add esp, 4
cmp dword [edi], 0
jne case.0x6b5a00c5.153
jmp 0x6b5a023d
cmp dword [esp + 0x24], 0
je case.0x6b5a00c5.153
push ebx
call fcn.6b5a0ab0
add esp, 4
cmp eax, 0x9e
jne case.0x6b5a00c5.153
push ebx
call fcn.6b5a0b00
add esp, 4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6b5a023d
test edi, edi
je 0x6b5a01be
push dword [edi]
push dword [edi + 8]
push ebx
call fcn.6b5ddf30
add esp, 0xc
test eax, eax
je 0x6b5a0252
test ebp, ebp
je 0x6b5a0035
push ebp
lea eax, [esp + 8]
push eax
call fcn.6b522410
add esp, 8
test eax, eax
js 0x6b5a0035
push eax
push dword [esp + 8]
push ebx
call fcn.6b5dde90
add esp, 0xc
mov edi, eax
push 0
push 0x6b78a570
push dword [esp + 0xc]
call fcn.6b584e00
add esp, 0xc
test edi, edi
jne 0x6b5a0035
jmp 0x6b5a0252
push ebx
call fcn.6b5a0a80
add esp, 4
mov ecx, eax
mov edx, dword [esp]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.6b5a0010
add esp, 8
test eax, eax
jne case.0x6b5a00c5.153
jmp 0x6b5a025b
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.6b5dd650
xor eax, eax
add esp, 4
jmp 0x6b5a023d
push ebx
call fcn.6b5dd650
add esp, 4
xor eax, eax
jmp 0x6b5a023d
Function at 0x6b5a9850
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x530
mov ebx, dword [esp + 0x548]
test ebx, ebx
je 0x6b5a98e0
mov edi, dword [esp + 0x544]
push 0x6b78b3f8
push edi
call fcn.6b586a60
add esp, 8
test eax, eax
je 0x6b5a99d6
mov esi, eax
push eax
call dword [sym.imp.msvcrt.dll__fileno]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__fstat]
add esp, 8
test eax, eax
js 0x6b5a9a03
test ebx, ebx
jns 0x6b5a98c3
movzx eax, word [esp + 0x12]
and eax, 0xf000
mov ebx, 0x100
cmp eax, 0x8000
jne 0x6b5a98c3
mov ebx, dword [esp + 0x20]
push 0
push esi
call sub.msvcrt.dll_setbuf
add esp, 8
mov dword [esp], 0
mov eax, 0x500
lea ebp, [esp + 0x30]
jmp 0x6b5a9903
xor eax, eax
jmp 0x6b5a9a3c
mov eax, dword [esp + 4]
sub eax, ebx
mov ebx, eax
mov eax, 0x500
jle 0x6b5a9986
cmp ebx, 0x501
mov edi, 0x400
cmovl edi, ebx
mov dword [esp + 4], ebx
test ebx, ebx
cmovle edi, eax
jmp 0x6b5a9950
test ebx, ebx
je 0x6b5a9986
mov dword [esp + 8], ebx
fild dword [esp + 8]
sub esp, 0x10
mov dword [esp + 4], ebx
mov dword [esp], ebp
fstp qword [esp + 8]
call fcn.6b5a8340
add esp, 0x10
add dword [esp], ebx
cmp dword [esp + 4], 0
jg 0x6b5a98f0
nop
nop
nop
nop
push esi
push edi
push 1
push ebp
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
push esi
call sub.msvcrt.dll_ferror
add esp, 4
test eax, eax
je 0x6b5a991c
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x6b5a991c
push esi
call sub.msvcrt.dll_clearerr
add esp, 4
test ebx, ebx
je 0x6b5a9950
jmp 0x6b5a9920
push 0x500
push ebp
call fcn.6b58f580
add esp, 8
push esi
call sub.msvcrt.dll_fclose
add esp, 4
call fcn.6b5a83d0
test eax, eax
mov eax, dword [esp]
jne 0x6b5a9a3c
call fcn.6b5620e0
push str.RAND_load_file
push 0
push 0x6b78b3fb
call fcn.6b5621e0
add esp, 0xc
push dword [esp + 0x544]
push str.Filename_s
push 0x76
jmp 0x6b5a99f7
call fcn.6b5620e0
push str.RAND_load_file
push 0
push 0x6b78b3fb
call fcn.6b5621e0
add esp, 0xc
push edi
push str.Filename_s
push 0x79
push 0x24
call fcn.6b562290
add esp, 0x10
jmp 0x6b5a9a37
call fcn.6b5620e0
push str.RAND_load_file
push 0
push 0x6b78b3fb
call fcn.6b5621e0
add esp, 0xc
push edi
push str.Filename_s
push 0x71
push 0x24
call fcn.6b562290
add esp, 0x10
push esi
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, 0xffffffff
add esp, 0x530
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b5a9b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
push 0
push 0
push 0x6b78b42a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edi, edi
test eax, eax
je 0x6b5a9b93
mov ebx, eax
mov ecx, 0x6b78b42a
mov dword [esi + 0xc], 0
jmp 0x6b5a9bf3
push 0
push 0
push str.HOME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x6b5a9bb4
mov ebx, eax
mov al, 1
mov dword [esi + 0xc], eax
mov ecx, str.HOME
jmp 0x6b5a9bf3
mov al, 1
mov dword [esi + 0xc], eax
push 0
push 0
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x6b5a9bd5
mov ebx, eax
mov ecx, str.USERPROFILE
jmp 0x6b5a9bf3
push 0
push 0
push str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x6b5a9cbd
mov ebx, eax
mov ecx, str.SYSTEMROOT
lea eax, [ebx + ebx + 3]
and eax, 0xfffffffc
call fcn.6b714eb0
mov edi, esp
and edi, 0xfffffff0
mov esp, edi
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebx
jae 0x6b5a9cbb
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x6b5a9cbb
mov ecx, eax
add eax, 3
and eax, 0xfffffffc
call fcn.6b714eb0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push 0
push 0
push ecx
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x6b5a9cbb
cmp byte [ebx], 0
je 0x6b5a9cbb
mov edi, dword [ebp + 0xc]
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
cmp byte [esi + 0xc], 0
je 0x6b5a9cc7
add eax, 6
cmp eax, edi
mov edi, 0
jae 0x6b5a9cbd
push ebx
mov edi, dword [ebp + 8]
push edi
call sub.msvcrt.dll_strcpy
add esp, 8
push edi
call sub.msvcrt.dll_strlen
add esp, 4
mov word [edi + eax], 0x2f
push edi
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [edi + eax], 0x646e722e
mov byte [edi + eax + 4], 0
jmp 0x6b5a9cbd
xor edi, edi
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
inc eax
cmp eax, edi
mov edi, 0
jae 0x6b5a9cbd
push ebx
mov edi, dword [ebp + 8]
push edi
call sub.msvcrt.dll_strcpy
add esp, 8
jmp 0x6b5a9cbd
Function at 0x6b5b5f10
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x14]
xor eax, eax
mov ecx, 0x13
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, 1
pop edi
ret

Function at 0x6b5b63f0
Capabilities:
Hash data using sha224

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x20]
xor eax, eax
mov ecx, 0x13
rep stosd dword es:[edi], eax
mov dword [edx], 0xc1059ed8
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
mov eax, 1
pop edi
ret

Function at 0x6b5b6450
Capabilities:
Hash data using sha256

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x20]
xor eax, eax
mov ecx, 0x13
rep stosd dword es:[edi], eax
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop edi
ret

Function at 0x6b5b6ba0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax], 0xc1059ed8
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0xd0], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x6b5b6c50
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x6a09e667
mov dword [eax], 0xf3bcc908
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0xd0], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x6b5beeb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6b5beedd
mov eax, dword [eax]
test eax, eax
je 0x6b5beedd
mov eax, dword [eax + 0x20]
test eax, eax
je 0x6b5beedd
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x6b5befb8
push ebp
call sub.msvcrt.dll_strlen
add esp, 4
mov esi, eax
test ebx, ebx
je 0x6b5bef29
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
lea esi, [esi + eax + 0xb]
jmp 0x6b5bef2c
add esi, 6
add esi, 2
push 0
push 0x6b78ce75
push esi
call fcn.6b584cc0
add esp, 0xc
test eax, eax
je 0x6b5bef8e
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.6b586d10
add esp, 0xc
push esi
push ebp
push edi
call fcn.6b586d70
add esp, 0xc
test ebx, ebx
je 0x6b5bef7d
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.6b586d70
add esp, 0xc
push esi
push ebx
push edi
call fcn.6b586d70
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.6b586d70
add esp, 0xc
jmp 0x6b5befba
call fcn.6b5620e0
push str.UI_construct_prompt
push 0
push 0x6b78ce75
call fcn.6b5621e0
add esp, 0xc
push 0
push 0xc0100
push 0x28
call fcn.6b562290
add esp, 0xc
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b617b30
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
push 1
push ebx
call fcn.6b5a94b0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.6b5a9760
add esp, 8
test eax, eax
je 0x6b617bb1
mov edi, eax
mov eax, esp
push 0xf0000040
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x6b617b8c
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x6b617b8e
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.6b5a97f0
add esp, 0xc
push ebx
call fcn.6b5a9480
add esp, 4
test eax, eax
jne 0x6b617c32
push 1
push ebx
call fcn.6b5a94b0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.6b5a9760
add esp, 8
test eax, eax
je 0x6b617c29
mov edi, eax
mov eax, esp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x6b617c08
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x6b617c0a
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.6b5a97f0
add esp, 0xc
push ebx
call fcn.6b5a9480
add esp, 4
test eax, eax
jne 0x6b617c32
push ebx
call fcn.6b5a9480
add esp, 4
add esp, 4
pop esi
pop edi
pop ebx
ret