joyce8/EMBER2024-capa huggingface dataset:
Function at 0x254570
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x254670
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0x254689
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0x2546e2
cmp eax, edx
jae 0x2546ce
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0x2546c0
lea eax, [esi + 0x2c]
push esi
call fcn.00252ac0
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0x2546ff
jmp 0x2546f0
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0x2546f0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.00252ac0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x254ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x254f44
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x254ed1
call eax
dec dword [ebp - 8]
call fcn.0026fcdb
mov esi, eax
call fcn.0026fcdb
cmp esi, eax
jne 0x254ef0
xor edi, 1
call fcn.0026fcdb
cmp esi, eax
je 0x254ee4
call fcn.0026fcdb
mov esi, eax
call fcn.0026fcdb
cmp esi, eax
jne 0x254f0c
xor ebx, 1
call fcn.0026fcdb
cmp esi, eax
je 0x254f00
cmp edi, ebx
je 0x254ed4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x254ed1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x254ec5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x255050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0026e2e0
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0x2550a0
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x2550a0
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x255084
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.0026e2e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x25e824
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x25e85b
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x25e83b
pop edi
pop esi
pop ebp
ret

Function at 0x2629c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.00256666
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00256505
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.0026de0d
add esp, 0x20
jmp 0x262a22
cmp esi, 0x3fffffff
ja 0x262a06
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00256505
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.0026de0d
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x2629fc
lea eax, [ebp - 0x210]
push eax
call fcn.002565ce
pop ecx
pop esi
leave
ret

Function at 0x262a3c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.00256666
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.00256505
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0026de0d
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.002565ce
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x262d2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.00257614
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x262dbe
push ebx
push dword [ebp + 8]
dec esi
call fcn.002577a3
pop ecx
pop ecx
cmp eax, 3
jne 0x262d87
test edi, edi
je 0x262db3
push 0
push ebx
push dword [ebp + 8]
call fcn.0025798c
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0026b44d
add esp, 0x10
test eax, eax
jle 0x262db3
xor edi, edi
inc edi
jmp 0x262db5
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.00257188
add esp, 0xc
test edi, edi
je 0x262db3
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0026ca3e
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x262db5
xor edi, edi
inc ebx
test esi, esi
jne 0x262d48
test edi, edi
je 0x262dc3
xor eax, eax
inc eax
jmp 0x262dd2
push 0
push 0
push dword [ebp + 8]
call fcn.0025632f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xee8638
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee8642
or eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xee8648
pop ebp
sub ebp, 0x10
sub ebp, 0xae8638
jmp 0xee865e
mov eax, 0xae8638
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x36a75e94
xor byte [eax], dl
inc eax
dec ecx
jne 0xee8675
jmp 0xee8688
pop ds
pop ecx
pop ds
sbb eax, 0x949494a8
adc eax, 0x94946c55
xchg esp, eax
xchg edi, eax
pop ecx
sub al, 0x91
xchg esp, eax
xchg esp, eax
xchg esp, eax
mov esp, 0x63949494
jbe 0xee863c
pop esp
pop ds
adc eax, 0x94949498
xchg edi, eax
push ecx
les ebx, [ecx]
invalid
Function at 0x6695fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x669848
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor edx, edx
mov eax, 0x669864
call fcn.006683b8
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00669418
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 4]
mov edx, 0x66988c
call fcn.0040b558
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006683b8
cmp dword [ebp - 4], 0
je 0x669674
mov eax, dword [ebp - 4]
call fcn.006679a0
test al, al
jne 0x669685
xor edx, edx
mov eax, 0x6698b0
call fcn.006683b8
jmp 0x669813
cmp byte [ebx + 0x3c], 0
je 0x669695
lea eax, [ebp - 8]
call fcn.0040a7d0
jmp 0x6696a2
lea eax, [ebp - 8]
mov edx, 0x6698e4
call fcn.0040abf8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov eax, 0x6698f0
mov dword [ebp - 0x44], eax
mov eax, 0x6698fc
mov dword [ebp - 0x40], eax
push 0x669918
push dword [ebp - 4]
push 0x669930
push dword [ebp - 8]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040b5e0
mov eax, dword [ebp - 0x58]
call fcn.0040b2ec
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 5
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x669813
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x669813
xor edx, edx
push ebp
push 0x66980c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x669783
lea eax, [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.0042675c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0x11
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x669940
call fcn.004283f8
mov eax, dword [ebp - 0x5c]
xor edx, edx
call fcn.006683b8
call fcn.00409fc0
jmp 0x669813
xor eax, eax
push ebp
push 0x6697d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040a7d0
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0042675c
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x6699b8
call fcn.0040b558
mov eax, dword [ebp - 0x6c]
xor edx, edx
call fcn.006683b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6697df
lea eax, [ebp - 0xc]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66984f
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040a830
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a830
ret
Function at 0x66a078
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x66a286
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 4]
mov eax, dword [ebx]
xor edx, edx
call fcn.00669038
cmp dword [ebp - 4], 0
jne 0x66a0ce
xor edx, edx
mov eax, 0x66a2a4
call fcn.006683b8
mov byte [ebp - 9], 1
jmp 0x66a251
xor edx, edx
mov eax, 0x66a2dc
call fcn.006683b8
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, 0x66a314
mov dword [ebp - 0x40], eax
mov eax, 0x66a320
mov dword [ebp - 0x3c], eax
push 0x66a33c
push dword [ebp - 4]
push 0x66a350
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0040b5e0
mov eax, dword [ebp - 0x50]
call fcn.0040b2ec
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x66a251
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x66a251
xor edx, edx
push ebp
push 0x66a24a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x66a1b8
lea eax, [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.0042675c
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0x11
lea edx, [ebp - 0x5c]
xor ecx, ecx
mov eax, 0x66a368
call fcn.004283f8
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006683b8
call fcn.00409fc0
jmp 0x66a251
xor eax, eax
push ebp
push 0x66a20d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a7d0
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.0042675c
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 8]
mov edx, 0x66a3e4
call fcn.0040b558
mov eax, dword [ebp - 0x64]
xor edx, edx
call fcn.006683b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a214
lea eax, [ebp - 8]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a28d
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a830
ret

Function at 0x672be0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, 0x1505
mov esi, ebx
mov eax, edi
call fcn.0040b2ec
mov edx, eax
jmp 0x672c1b
movzx eax, cx
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor eax, ebx
mov ebx, eax
movzx eax, word [edx + 2]
test eax, eax
je 0x672c23
mov ecx, esi
shl ecx, 5
add esi, ecx
xor eax, esi
mov esi, eax
add edx, 4
movzx ecx, word [edx]
test cx, cx
jne 0x672bf7
imul eax, esi, 0x5d588b65
add eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6802c4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
dec edx
test edx, edx
jl 0x6802e4
inc edx
mov ebx, ecx
xor bl, byte [eax]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x6d274c]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
jne 0x6802cb
mov eax, ecx
pop ebx
ret

Function at 0x6a89e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x75ca18], 0
jne 0x6a89f7
call fcn.006a899c
mov eax, edi
dec eax
test eax, eax
jl 0x6a8a1f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x75c618]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6a8a01
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6aba44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6aba75
dec al
je 0x6abab0
dec al
je 0x6abaf4
dec al
je 0x6abb66
jmp 0x6abc01
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6abc01
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6aba85
jmp 0x6abc01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abc01
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6abac0
jmp 0x6abc01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abc01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6abb27
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6abb3c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6abb54
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6abb04
jmp 0x6abc01
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abc01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6abbcd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006a8a28
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6abb82
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x479ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x52000]
push edi
jmp 0x479eea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x479ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479ee0
mov eax, 1
add ebx, ebx
jne 0x479f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x479f14
jne 0x479f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f33
dec eax
add ebx, ebx
jne 0x479f20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x479ef8
add ebx, ebx
jne 0x479f2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x479f85
xor ecx, ecx
sub eax, 3
jb 0x479f4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x479fba
sar eax, 1
mov ebp, eax
jmp 0x479f56
add ebx, ebx
jne 0x479f56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f24
inc ecx
add ebx, ebx
jne 0x479f64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f24
add ebx, ebx
jne 0x479f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x479f66
jne 0x479f82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x479f66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x479fa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x479f96
jmp 0x479ee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x479fa4
add edi, ecx
jmp 0x479ee6
pop esi
mov edi, esi
mov ecx, 0x3202
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x479fc2
cmp byte [edi], 0x16
jne 0x479fc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x479fc7
lea edi, [esi + 0x77000]
mov eax, dword [edi]
or eax, eax
je 0x47a03f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7a9d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7aac8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x479ff4
mov ecx, edi
jns 0x47a023
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7aacc]
or eax, eax
je 0x47a039
mov dword [ebx], eax
add ebx, 4
jmp 0x47a011
call dword [esi + 0x7aadc]
mov ebp, dword [esi + 0x7aad0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47a073
sub esp, 0xffffff80
jmp 0x44da33
Function at 0x401750
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebx], bl
ficom dword [ebp + 0x13]
add dword [edi + eax*2], edx
dec ecx
pop ss
sbb byte [ecx], bl
sbb dl, byte [eax - 0x6f6f6f70]
nop
nop
nop
and eax, 0xf1909090
mov dword [ebp - 0x75], edx
push ebp
mov ebp, esp
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ebx, dword [ecx]
push cs
rol byte [eax], 0x50
add dword [edi + 0x40], 0x68
je 0x401735
inc eax
add byte [ecx - 1], dl
adc eax, 0x7c180
mov eax, dword [0x4102c4]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push str.Total_of__d_requests_completed_n
sub dword [0x40c196], edx
and dword [eax - 0x34], 0x6a
add edi, edi
adc eax, 0x40c161
push 1
call dword [0x40c161]
nop

Function at 0x405e3a
Capabilities:
Query environment variable

Disassembly:
mov dword [0x410384], 0x880001
xchg ebx, eax
adc eax, 0xffdc5c
mov esi, eax
test esi, esi
je 0x405db3
mov eax, dword [0xb5410358]
invalid
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
push 0xffffffffffffffff
push ebx
inc dword [eax + 0x24]
rol dword [eax], 0x50
jle 0x405d4d
add byte [eax], al
add byte [ebx - 0x3b81e54a], cl
inc eax
adc bl, cl
je 0x405e02
lea esi, [eax*4 + 4]
push esi
call dword [ebx + 0x5c]
rol dword [eax], 0x83
les eax, [ecx + ecx*4]
pop es
call dword [0x40c1d1]
mov edi, dword [edi]
into
mov esi, dword [eax]
inc ebx
rol dword [0xa5f3fae9], 1
retf 0xd083
call word [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xchg ebx, eax
fldcw word [eax]
rol dword [eax - 0x35], 0x2f
salc
mov esi, dword [ebp + edi*8 + 0x1674c985]
or al, 0xd6
mov edi, dword [eax]
salc
push edi
mov dword [eax], 0
invalid
call dword [0x72c04c]
jmp 0x405db3