joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441158
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x4412d8
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x4411a9
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x4411ba
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x4411d0
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x4411f1
cmp dword [ecx], 0
jg 0x4411e5
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x4411e9
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x4411da
test di, di
je 0x4412d8
mov dl, byte [eax + 9]
sub dl, 2
je 0x441216
sub dl, 2
je 0x441236
sub dl, 4
je 0x44126c
sub dl, 8
je 0x441290
jmp 0x4412d8
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x4412d8
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x441226
jmp 0x4412d8
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x4412d8
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x44125c
jmp 0x4412d8
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x4412d8
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x44127c
jmp 0x4412d8
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
cmp ebp, dword [esp + 8]
jae 0x4412d8
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
cmp ebp, dword [esp + 8]
jb 0x4412a5
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44c1e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x44c20b
mov eax, ebx
call fcn.004517f8
cmp byte [ebx + 0x3c], 0
je 0x44c204
mov dword [ebx + 0x14], 0xcf
mov al, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x44c276
mov edx, dword [ebx + 0x180]
cmp byte [edx + 0x10], 0
je 0x44c26e
cmp dword [ebx + 8], 0
je 0x44c22d
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x180]
call dword [edx]
test eax, eax
jne 0x44c23f
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x44c26e
cmp dword [ebx + 8], 0
je 0x44c220
cmp eax, 3
je 0x44c252
dec eax
jne 0x44c220
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x44c220
mov edx, dword [ebx + 0x10c]
add dword [eax + 8], edx
jmp 0x44c220
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x74], ecx
jmp 0x44c294
cmp dword [ebx + 0x14], 0xcc
je 0x44c294
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0044c2a0
pop ebx
ret
Function at 0x4a3db8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4a3dbe
ret

Function at 0x51fce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
and edx, 0xffffffff
mov ecx, 1
mov dword [eax + 8], edx
lea edx, [eax + 8]
mov ebx, dword [edx]
mov esi, ebx
shr esi, 0x1e
xor esi, ebx
imul ebx, esi, 0x6c078965
add ebx, ecx
mov dword [edx + 4], ebx
and dword [edx + 4], 0xffffffff
inc ecx
add edx, 4
cmp ecx, 0x270
jl 0x51fcf0
mov dword [eax], 1
lea edx, [eax + 8]
mov dword [eax + 4], edx
pop esi
pop ebx
ret

Function at 0x51fee4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
lea ecx, [eax + 8]
mov edx, ecx
mov dword [eax], 0x270
mov dword [eax + 4], ecx
mov ecx, 0xe4
jmp 0x51ff2e
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x51ff1f
mov ebx, 0x9908b0df
jmp 0x51ff21
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx + 0x634]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x51fefc
mov ecx, 0x18d
jmp 0x51ff6a
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x51ff5b
mov ebx, 0x9908b0df
jmp 0x51ff5d
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx - 0x38c]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x51ff38
mov ecx, dword [eax + 8]
mov ebx, dword [edx]
mov esi, ecx
and ebx, 0x80000000
and esi, 0x7fffffff
or ebx, esi
shr ebx, 1
test cl, 1
je 0x51ff90
mov eax, 0x9908b0df
jmp 0x51ff92
xor eax, eax
xor ebx, eax
xor ebx, dword [edx - 0x38c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x51ffa0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, eax
dec dword [ebx]
jne 0x51ffae
mov eax, ebx
call fcn.0051fee4
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x51ffe4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
dec dword [ebx]
jne 0x51fff5
mov eax, ebx
call fcn.0051fee4
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp], eax
dec dword [ebx]
jne 0x520034
mov eax, ebx
call fcn.0051fee4
mov eax, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [eax]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp + 4], eax
and dword [esp], 0xffffffff
and dword [esp + 4], 0xfffff
mov eax, dword [esp]
mov edx, dword [esp + 4]
or edx, 0x3ff00000
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00456890
fld qword [esp]
fsub dword [0x52009c]
pop ecx
pop edx
pop ebx
ret
Function at 0x52ce6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, eax
lea ecx, [eax + 4]
xor eax, eax
cmp ecx, edx
jbe 0x52ce90
movsx ebx, byte [edx]
add eax, ebx
mov ebx, eax
shl ebx, 0xa
add eax, ebx
mov ebx, eax
shr ebx, 6
xor eax, ebx
inc edx
cmp ecx, edx
ja 0x52ce78
mov edx, eax
shl edx, 3
add eax, edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 0xf
add eax, edx
test eax, eax
jne 0x52ceac
or eax, 0xffffffff
pop ebx
ret

Function at 0x5724b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 4]
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ecx + 8], 0x6d60cc
mov dword [ecx + 0xc], esp
mov eax, 0x50d923
mov dword [ecx + 4], eax
xor eax, eax
mov word [ecx + 0x10], 0
mov dword [ecx + 0x1c], eax
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
mov word [ecx + 0x10], 8
mov eax, 0x6b057c
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6b0594
mov ebx, dword [edx]
mov dword [ebx], eax
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 4
mov ebx, 0x6d7390
mov dword [eax], ebx
mov eax, 0x6d731c
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6d7354
mov ebx, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [edx]
add eax, 8
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 8], ebx
lea ebx, [eax + 0x10]
xor esi, esi
mov dword [ebx + 8], esi
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0x80
mov ebx, dword [ebp - 0x2c]
cmp ebx, dword [ebp - 0x30]
jbe 0x572561
lea ebx, [ebp - 0x2c]
jmp 0x572564
lea ebx, [ebp - 0x30]
mov ebx, dword [ebx]
mov dword [eax], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x30
mov dword [eax + 8], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x5c
mov dword [eax], ebx
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 0xc], ebx
xor ebx, ebx
mov dword [eax + 0x10], ebx
xor ebx, ebx
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
inc dword [ecx + 0x1c]
mov eax, dword [edx]
mov byte [eax + 0x28], 0
mov eax, dword [edx]
mov dword [eax + 0x50], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x58], ebx
xor ebx, ebx
mov eax, dword [edx]
add eax, 0x40
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov eax, dword [edx]
xor ebx, ebx
mov byte [eax + 0x54], 0
mov eax, dword [edx]
mov dword [eax + 0x3c], ebx
mov eax, dword [ecx]
mov dword fs:[0], eax
mov eax, dword [edx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58d6e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea ecx, [ebp - 0x28]
lea edx, [ebp - 4]
push ebx
mov dword [ebp - 4], eax
mov eax, 0x50d923
mov dword [ecx + 8], 0x6dd9a4
mov dword [ecx + 0xc], esp
mov dword [ecx + 4], eax
mov word [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x1c], eax
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
mov word [ecx + 0x10], 8
mov ebx, dword [edx]
mov eax, 0x6b057c
mov dword [ebx], eax
mov eax, 0x6b0594
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6ddefc
inc dword [ecx + 0x1c]
mov ebx, dword [edx]
mov dword [ebx], eax
xor ebx, ebx
mov eax, dword [edx]
add eax, 4
mov dword [eax], ebx
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 0xc], ebx
xor ebx, ebx
mov dword [eax + 0x10], ebx
xor ebx, ebx
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
inc dword [ecx + 0x1c]
mov eax, dword [edx]
mov dword [eax + 0x24], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x20], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x30], ebx
xor ebx, ebx
mov eax, dword [edx]
mov byte [eax + 0x34], 0
mov eax, dword [edx]
mov dword [eax + 0x38], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x3c], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x2c], ebx
mov eax, dword [edx]
mov dword [eax + 0x28], ebx
mov ecx, dword [ecx]
mov dword fs:[0], ecx
mov eax, dword [edx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59a68c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x6e0288
mov dword [ebp - 0x1c], esp
mov eax, 0x50d923
mov dword [ebp - 0x24], eax
lea ebx, [ebp - 4]
mov word [ebp - 0x18], 0
mov dword [ebp - 0xc], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x28]
mov dword fs:[0], eax
mov word [ebp - 0x18], 8
mov eax, dword [ebx]
call fcn.005962e8
add dword [ebp - 0xc], 2
mov ecx, dword [ebx]
mov edx, 0x6e098c
mov dword [ecx], edx
xor edx, edx
mov eax, dword [ebx]
mov dword [eax + 0x1c], edx
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0x20], eax
xor ecx, ecx
mov edx, dword [ebx]
mov dword [edx + 0x24], ecx
mov eax, dword [ebx]
mov dword [eax + 0x28], 0x140
mov edx, dword [ebx]
mov dword [edx + 0x2c], 0xf0
mov ecx, dword [ebx]
xor edx, edx
mov byte [ecx + 0x30], 0
mov eax, dword [ebx]
mov dword [eax + 0x34], edx
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0x3c], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x59bd0c
mov edx, dword [ebx]
mov dword [ebp - 0x2c], edx
push dword [ecx + 4]
push dword [ecx]
call fcn.004af334
mov edx, dword [ebx]
mov dword [edx + 0x38], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
mov byte [eax + 0x48], 0
mov edx, dword [ebx]
mov byte [edx + 0x49], 0
mov ecx, dword [ebx]
mov byte [ecx + 0x5c], 0
mov eax, dword [ebx]
mov dword [eax + 0x60], 0xffffffff
mov edx, dword [ebx]
mov dword [edx + 0x64], 0xffffffff
mov ecx, dword [ebx]
mov byte [ecx + 0x68], 0
mov eax, dword [ebx]
mov dword [eax + 0x6c], 0xffffffff
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x50], ecx
mov eax, dword [ebx]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebx]
xor eax, eax
mov dword [edx + 0x58], eax
mov edx, dword [ebx]
mov dword [edx + 0x54], eax
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f2490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x6eaa28
mov edi, eax
xor ecx, ecx
mov eax, edi
cmp edx, ecx
jle 0x5f24c7
mov bl, byte [eax]
xor byte [0x7b03b8], bl
mov bl, byte [0x7b03b8]
mov ebp, dword [esi]
xor byte [ebp + 0x7af1b8], bl
inc dword [esi]
and dword [esi], 0xfff
inc ecx
inc eax
cmp edx, ecx
jg 0x5f24a3
xor eax, eax
mov al, byte [edi]
and eax, 1
add dword [esi], eax
and dword [esi], 0xfff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5f2e98
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x5f926c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], eax
mov ebx, 0x50d923
mov dword [ebp - 0x20], 0x6ebfc0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x18], 0
xor ebx, ebx
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword fs:[0]
mov dword [ebp - 0x28], ebx
lea ebx, [ebp - 0x28]
mov dword fs:[0], ebx
mov word [ebp - 0x18], 8
mov esi, dword [eax]
mov ebx, 0x6dcac8
mov dword [esi], ebx
mov ebx, 0x6ec148
inc dword [ebp - 0xc]
mov esi, dword [eax]
mov dword [esi], ebx
mov ebx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [eax]
mov ebx, dword [ebp + 0x14]
mov dword [ecx + 0xc], ebx
xor ebx, ebx
mov ecx, dword [eax]
mov dword [ecx + 0x40], ebx
xor ebx, ebx
mov ecx, dword [eax]
mov dword [ecx + 0x1c], ebx
mov ecx, dword [eax]
mov ebx, dword [eax]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax]
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov ebx, dword [eax]
mov ecx, dword [eax]
mov ebx, dword [ebx + 0x20]
mov esi, dword [ebx + 0x10]
mov dword [ecx + 0x30], esi
mov esi, dword [ebx + 0x14]
mov dword [ecx + 0x34], esi
mov ecx, dword [eax]
mov byte [ecx + 0x44], 0
mov ecx, dword [eax]
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov ecx, dword [eax]
mov dword [ecx + 0x24], 0xffffffff
mov ebx, dword [eax]
mov ecx, edx
mov dword [ebx + 4], ecx
inc dword [ecx + 4]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [eax]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x62cc1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x6fb9ac
mov dword [ebp - 0x1c], esp
mov eax, 0x50d923
mov dword [ebp - 0x24], eax
mov ebx, ecx
mov word [ebp - 0x18], 0
xor ecx, ecx
lea esi, [ebp - 4]
mov dword [ebp - 0xc], ecx
mov eax, dword fs:[0]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
mov dword fs:[0], ecx
mov word [ebp - 0x18], 8
mov ecx, dword [esi]
mov eax, 0x6fc95c
mov dword [ecx], eax
mov eax, 0x6fc940
inc dword [ebp - 0xc]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
mov dword [eax + 4], edx
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x34], ecx
mov ecx, 0xa
mov eax, dword [esi]
push esi
mov esi, ebx
lea edi, [eax + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
pop esi
imul dword [ebx + 4]
mov edx, dword [esi]
mov dword [edx + 0x40], eax
mov ecx, dword [esi]
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov eax, dword [esi]
push dword [eax + 0x34]
push dword [eax + 0x30]
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
call fcn.0043b914
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x64d2f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0xc
cmp eax, 8
mov dword [ebp - 0x10], ecx
mov ebx, 2
jg 0x64d37c
lea ecx, [ebx*4]
cmp ecx, esi
je 0x64d3df
xor eax, eax
cmp eax, ebx
jge 0x64d374
mov edx, edi
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [edx]
add eax, 8
movaps xmm1, xmmword [edx + 0x10]
movaps xmm3, xmmword [edx + ebx*4]
movaps xmm2, xmmword [edx + ebx*4 + 0x10]
movaps xmm5, xmm0
movaps xmm4, xmm1
addps xmm5, xmm3
subps xmm0, xmm3
addps xmm4, xmm2
movaps xmmword [edx], xmm5
subps xmm1, xmm2
movaps xmmword [edx + 0x10], xmm4
movaps xmmword [edx + ebx*4], xmm0
movaps xmmword [edx + ebx*4 + 0x10], xmm1
add edx, 0x20
cmp eax, ebx
jl 0x64d338
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0064c7a8
cmp esi, 0x20
mov ebx, 8
jle 0x64d316
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0064ca48
lea eax, [ebx*4]
cmp eax, esi
jge 0x64d316
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0064ca48
lea eax, [ebx*4]
cmp eax, esi
jl 0x64d398
jmp 0x64d316
xor ecx, ecx
cmp ecx, ebx
jge 0x64d374
mov eax, edi
lea edx, [ebx + ebx*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [eax + ebx*8]
add ecx, 4
movaps xmm6, xmmword [edi + edx*4]
movaps xmm2, xmmword [eax]
movaps xmm7, xmmword [eax + ebx*4]
movaps xmm4, xmm0
subps xmm0, xmm6
shufps xmm0, xmm0, 0xb1
movaps xmm3, xmm2
addps xmm3, xmm7
xorps xmm0, xmmword [0x7d4360]
subps xmm2, xmm7
addps xmm4, xmm6
movaps xmm5, xmm3
movaps xmm1, xmm2
addps xmm5, xmm4
movaps xmmword [eax], xmm5
subps xmm3, xmm4
addps xmm1, xmm0
movaps xmmword [eax + ebx*8], xmm3
subps xmm2, xmm0
movaps xmmword [eax + ebx*4], xmm1
add eax, 0x10
movaps xmmword [edi + edx*4], xmm2
add edx, 4
cmp ecx, ebx
jl 0x64d3f8
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x64e508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0064dde8

Function at 0x65745c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor edx, edx
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x34], 0x702ae4
mov dword [ebp - 0x30], esp
mov eax, 0x50d923
mov dword [ebp - 0x38], eax
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x20], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x3c]
mov dword fs:[0], eax
call fcn.0065a8c0
mov esi, eax
cmp byte [0x702925], 0
jne 0x6574c8
mov word [ebp - 0x2c], 8
mov edx, str.script_editor
mov eax, 0x7bf3e0
call fcn.00696a98
inc dword [ebp - 0x20]
dec dword [ebp - 0x20]
inc byte [0x702925]
mov ecx, dword [ebx + 0x30]
mov edx, 0x70293e
push ecx
lea eax, [ebp - 4]
mov word [ebp - 0x2c], 0x14
call fcn.00696a98
inc dword [ebp - 0x20]
mov edx, dword [0x7bf3e0]
mov ecx, dword [eax]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00696c6c
mov ecx, dword [ebx + 0x34]
mov edx, 0x702943
push ecx
lea eax, [ebp - 8]
mov word [ebp - 0x2c], 0x20
call fcn.00696a98
inc dword [ebp - 0x20]
mov edx, dword [0x7bf3e0]
mov ecx, dword [eax]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00696c6c
mov ecx, dword [ebx + 0x38]
mov edx, 0x702947
push ecx
lea eax, [ebp - 0xc]
mov word [ebp - 0x2c], 0x2c
call fcn.00696a98
inc dword [ebp - 0x20]
mov edx, dword [0x7bf3e0]
mov ecx, dword [eax]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00696c6c
mov ecx, dword [ebx + 0x3c]
mov edx, 0x70294d
push ecx
lea eax, [ebp - 0x10]
mov word [ebp - 0x2c], 0x38
call fcn.00696a98
inc dword [ebp - 0x20]
mov edx, dword [0x7bf3e0]
mov ecx, dword [eax]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00696c6c
mov ecx, dword [ebx + 0x304]
mov edx, str.content
mov eax, dword [ecx + 0x230]
push eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x2c], 0x44
call fcn.00696a98
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov edx, 0x7bf3e0
mov eax, esi
call fcn.0065a8cc
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00696c6c
cmp byte [ebx + 0x217], 3
sete cl
and ecx, 1
mov edx, 0x702954
push ecx
lea eax, [ebp - 0x18]
mov word [ebp - 0x2c], 0x50
call fcn.00696a98
inc dword [ebp - 0x20]
mov edx, dword [0x7bf3e0]
mov ecx, dword [eax]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00696c6c
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret