joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e0f90
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x10]
push eax
push 0
push esi
push 0x5e0ec0
push 0
push 0
call fcn.0061408e
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
setne al
pop esi
ret

Function at 0x5e1a80
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xorps xmm0, xmm0
movups xmmword [ebp], xmm0
movq qword [ebp + 0x10], xmm0
movups xmmword [ebp + 0x30], xmm0
movq qword [ebp + 0x40], xmm0
nop
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x38], xmm0
nop
lock inc dword [esp + 0x10]
nop
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
rdtsc
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 8], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x10], xmm0
nop
lock inc dword [esp + 0x10]
nop
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x20]
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 1
mov dword [ebp + 0x2c], 0
call esi
rdtsc
push 5
mov edi, eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
call esi
mov esi, dword [esp + 0x18]
sub esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x24]
push ecx
push esi
push dword [esp + 0x34]
rdtsc
push dword [esp + 0x34]
sub eax, edi
sbb edx, ebx
push edx
push eax
call fcn.005e1e50
mov dword [ebp + 0x18], eax
add esp, 0x18
mov dword [ebp + 0x1c], edx
rdtsc
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 8], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x10], xmm0
nop
lock inc dword [esp + 0x10]
nop
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5eb110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646545
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp + 0x10]
push 0
lea eax, [eax*4 + 2]
push eax
call fcn.0041aee0
mov byte [ebp - 4], 1
lea edx, [ebp + 8]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp + 0x10]
push 1
mov dword [ebp - 0x10], eax
call fcn.005b43d0
mov ecx, dword [ebp + 8]
add esp, 4
or edi, 0xffffffff
mov edx, dword [eax]
cmp ecx, edx
je 0x5eb198
mov dword [ebp + 8], edx
mov dword [eax], 0
test ecx, ecx
je 0x5eb198
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb198
push ecx
call fcn.005a47b0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5eb1ae
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb1ae
push ecx
call fcn.005a47b0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5eb1ba
mov eax, dword [ecx + 0xc]
jmp 0x5eb1bf
mov eax, 0x651f68
mov ebx, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
push ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5eb28b
mov esi, dword [ebp - 0x10]
call fcn.005a45d0
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x5eb214
push 0
push esi
push ebx
mov ecx, eax
call fcn.005a57f0
mov esi, eax
mov dword [ebp + 0x10], esi
test esi, esi
je 0x5eb219
cmp dword [esi + 0xc], 0
jne 0x5eb219
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp + 0x10], esi
push 0xffffffffffffffff
lea edx, [ebp + 0x10]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.005b47f0
mov edx, dword [ebp + 0xc]
add esp, 4
mov ebx, dword [ebp - 0x28]
mov ecx, dword [edx]
cmp ecx, dword [eax]
je 0x5eb259
mov ebx, dword [eax]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x28]
mov dword [eax], 0
test ecx, ecx
je 0x5eb259
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb259
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x5eb26f
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb26f
push ecx
call fcn.005a47b0
test esi, esi
je 0x5eb284
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x5eb284
push ecx
mov ecx, esi
call fcn.005a47b0
mov esi, 1
jmp 0x5eb28d
xor esi, esi
push ebx
call fcn.00606eda
mov ecx, dword [ebp + 8]
add esp, 4
test ecx, ecx
je 0x5eb2aa
lock xadd dword [ecx], edi
dec edi
jne 0x5eb2aa
push ecx
call fcn.005a47b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5eb2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64657d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.005b4610
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x5eb323
lea eax, [edi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp + 0xc]
call fcn.00406030
push edi
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 0xc]
push str.WriteRegError__S__d
push eax
call fcn.005abfb0
add esp, 0x10
lea eax, [ebp + 0xc]
lea ecx, [ebp + 8]
push eax
call fcn.005a5bf0
push 0x6a3e24
mov eax, ecx
push eax
call fcn.006089ec
int3

Function at 0x5eb370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6465b5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 1
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.005b43d0
mov ecx, dword [ebp + 8]
add esp, 4
or esi, 0xffffffff
mov edx, dword [eax]
cmp ecx, edx
je 0x5eb3d9
mov dword [ebp + 8], edx
mov dword [eax], 0
test ecx, ecx
je 0x5eb3d9
mov eax, esi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb3d9
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x5eb3ef
mov eax, esi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb3ef
push ecx
call fcn.005a47b0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5eb3fb
mov eax, dword [ecx + 0xc]
jmp 0x5eb400
mov eax, 0x651f68
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x5eb447
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5eb42e
lock xadd dword [ecx], esi
dec esi
jne 0x5eb42e
push ecx
call fcn.005a47b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
call fcn.00406030
push edi
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push str.WriteRegError__S__d
push eax
call fcn.005abfb0
add esp, 0x10
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.005a5bf0
push 0x6a3e24
mov eax, ecx
push eax
call fcn.006089ec
int3
Function at 0x5eb540
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646605
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0xa002
lea ecx, [ebp - 0x24]
call fcn.0041aee0
mov dword [ebp - 4], 0
push dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
push ebx
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test edi, edi
jne 0x5eb66d
mov ecx, ebx
call fcn.005b4610
mov esi, eax
add esi, esi
call fcn.005a45d0
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x5eb5d8
push edi
push esi
push ebx
mov ecx, eax
call fcn.005a57f0
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x5eb5dd
cmp dword [esi + 0xc], edi
jne 0x5eb5dd
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp + 8], esi
push 0
lea edx, [ebp + 8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.005b47f0
mov edx, dword [ebp + 0xc]
add esp, 4
mov ebx, dword [ebp - 0x20]
mov edi, dword [eax]
mov ecx, dword [edx]
mov dword [ebp + 8], edi
or edi, 0xffffffff
cmp ecx, dword [ebp + 8]
je 0x5eb627
mov ebx, dword [ebp + 8]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x20]
mov dword [eax], 0
test ecx, ecx
je 0x5eb627
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb627
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5eb63d
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x5eb63d
push ecx
call fcn.005a47b0
test esi, esi
je 0x5eb650
lock xadd dword [esi], edi
dec edi
jne 0x5eb650
push ecx
mov ecx, esi
call fcn.005a47b0
push ebx
call fcn.00606eda
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp + 8]
call fcn.00406030
push edi
lea eax, [esi + 0xc]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 8]
push str.EnumRegError__S__d
push eax
call fcn.005abfb0
add esp, 0x10
lea eax, [ebp + 8]
lea ecx, [ebp + 0xc]
push eax
call fcn.005a5bf0
push 0x6a3e24
mov eax, ecx
push eax
call fcn.006089ec
int3
Function at 0x5f9260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], 0x10d040e
push edi
mov dword [esp + 0x10], 0x80b0f02
xor ebp, ebp
mov dword [esp + 0x14], 0xc060a03
mov dword [esp + 0x18], 0x7000905
lea edi, [ebx + 0x800]
mov dword [esp + 0x1c], 0xe08010f
mov dword [esp + 0x20], 0x4030b06
mov dword [esp + 0x24], 0xd020709
mov dword [esp + 0x28], 0xa05000c
mov dword [esp + 0x2c], 0xe09000a
mov dword [esp + 0x30], 0x50f0306
mov dword [esp + 0x34], 0x70c0d01
mov dword [esp + 0x38], 0x802040b
mov dword [esp + 0x3c], 0x30e0d07
mov dword [esp + 0x40], 0xa090600
mov dword [esp + 0x44], 0x5080201
mov dword [esp + 0x48], 0xf040c0b
mov dword [esp + 0x4c], 0x1040c02
mov dword [esp + 0x50], 0x60b0a07
mov dword [esp + 0x54], 0xf030508
mov dword [esp + 0x58], 0x90e000d
mov dword [esp + 0x5c], 0xf0a010c
mov dword [esp + 0x60], 0x8060209
mov dword [esp + 0x64], 0x4030d00
mov dword [esp + 0x68], 0xb05070e
mov dword [esp + 0x6c], 0xe020b04
mov dword [esp + 0x70], 0xd08000f
mov dword [esp + 0x74], 0x7090c03
mov dword [esp + 0x78], 0x1060a05
mov dword [esp + 0x7c], 0x408020d
mov dword [esp + 0x80], 0x10b0f06
mov dword [esp + 0x84], 0xe03090a
mov dword [esp + 0x88], 0x70c0005
push esi
nop dword [eax]
mov esi, ebp
lea edi, [edi + 4]
shr esi, 4
mov edx, ebp
and edx, 0xf
inc ebp
movzx ecx, byte [esp + esi + 0x10]
movzx eax, byte [esp + edx + 0x20]
shl ecx, 4
or ecx, eax
movzx eax, byte [esp + edx + 0x40]
shl ecx, 0x18
ror ecx, 0x15
mov dword [edi - 0x804], ecx
movzx ecx, byte [esp + esi + 0x30]
shl ecx, 4
or ecx, eax
movzx eax, byte [esp + edx + 0x60]
shl ecx, 0x10
ror ecx, 0x15
mov dword [edi - 0x404], ecx
movzx ecx, byte [esp + esi + 0x50]
shl ecx, 4
or ecx, eax
movzx eax, byte [esp + edx + 0x80]
shl ecx, 8
ror ecx, 0x15
mov dword [edi - 4], ecx
movzx ecx, byte [esp + esi + 0x70]
shl ecx, 4
or ecx, eax
ror ecx, 0x15
mov dword [edi + 0x3fc], ecx
cmp ebp, 0x100
jl 0x5f9380
pop esi
xor ecx, ecx
lea eax, [ecx + 1]
mov byte [ecx + ebx + 0x1000], al
inc ecx
cmp ecx, 0x20
jl 0x5f9402
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x80
ret
Function at 0x5fa040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp], edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
test ecx, ecx
jne 0x5fa066
lea ecx, [edx + 0x1000]
mov dword [esp + 0x28], ecx
test eax, eax
mov edi, esi
cmovne edi, eax
mov eax, dword [esp + 0x34]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
mov eax, dword [esp + 0x30]
shr eax, 3
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
test eax, eax
je 0x5fa0d4
nop dword [eax]
dec eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edx
call fcn.005f9480
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x14]
xor ebx, dword [esi]
add esi, 8
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
xor ebp, eax
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
mov dword [edi], ebx
mov dword [edi + 4], ebp
add edi, 8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
test eax, eax
jne 0x5fa090
mov eax, dword [esp + 0x30]
and eax, 7
mov dword [esp + 0x30], eax
je 0x5fa134
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push esi
push eax
mov dword [esp + 0x2c], 0
call fcn.00609db0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
add esp, 0xc
push eax
push dword [esp + 0x2c]
call fcn.005f9480
push dword [esp + 0x30]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x20]
mov ebp, dword [esp + 0x1c]
xor dword [esp + 0x20], ebx
xor dword [esp + 0x24], ebp
push eax
push edi
call fcn.00609db0
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x5fa141
mov dword [eax], ebx
mov dword [eax + 4], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18

Function at 0x5fa150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov edx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 8], edx
push esi
mov esi, dword [esp + 0x28]
push edi
test ebp, ebp
jne 0x5fa173
lea ebp, [edx + 0x1000]
mov ecx, dword [esp + 0x34]
test eax, eax
mov ebx, dword [esp + 0x30]
mov edi, esi
cmovne edi, eax
shr ebx, 3
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x5fa1d0
lea eax, [esp + 0x14]
mov ecx, edx
push eax
push ebp
call fcn.005f9480
mov edx, dword [esi]
mov eax, edx
xor eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
add esi, 8
mov dword [edi], eax
mov eax, ecx
xor eax, dword [esp + 0x18]
mov dword [edi + 4], eax
add edi, 8
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
sub ebx, 1
jne 0x5fa196
mov ebx, dword [esp + 0x30]
and ebx, 7
je 0x5fa226
push ebx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push esi
push eax
mov dword [esp + 0x2c], 0
call fcn.00609db0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
add esp, 0xc
push eax
push ebp
call fcn.005f9480
mov eax, dword [esp + 0x14]
xor dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push ebx
push eax
push edi
call fcn.00609db0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
Function at 0x5faa00
Capabilities:
Check mutex on windows
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629860
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x6af4e8]
test eax, eax
jne 0x5fabc3
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp dword [0x6b0dcc], eax
jne 0x5faa7e
push 0x10
call fcn.00606edf
add esp, 4
mov esi, eax
push 0
push 0
push 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call ebx
mov ecx, esi
mov dword [esi], eax
mov dword [0x6b0dcc], esi
call fcn.005e0970
mov dword [ebp - 4], 1
mov edi, dword [0x6ac16c]
test edi, edi
jne 0x5faac2
push 0x10
call fcn.00606edf
add esp, 4
mov esi, eax
push edi
push edi
push edi
mov dword [esi + 0xc], 1
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call ebx
mov ecx, esi
mov dword [esi], eax
mov dword [0x6ac16c], esi
call fcn.005e0970
mov edi, dword [0x6ac16c]
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
push 0xffffffffffffffff
push dword [edi]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x5faaea
mov dword [edi + 8], ebx
jmp 0x5faaee
test eax, eax
jne 0x5faaff
inc dword [edi + 0xc]
mov ebx, 1
inc dword [edi + 8]
inc dword [edi + 4]
mov dword [ebp - 0x14], ebx
cmp dword [0x6af4e8], 0
jne 0x5fab9e
push 0x1085
call fcn.00606edf
mov esi, eax
add esp, 4
lea ecx, [esi + 0x54]
mov dword [esi], vtable.CCryptRandom.0
mov dword [esi + 4], 0xa
call fcn.005f9260
push 0
push 0
push 0
mov byte [esi + 0x1074], 1
mov dword [esi + 0x1081], 1
mov dword [esi + 0x1079], 0
mov dword [esi + 0x107d], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xf0000040
push 1
push 0
mov dword [esi + 0x1075], eax
lea eax, [esi + 8]
push 0
push eax
mov dword [eax], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
lea eax, [esi + 0xc]
push 0
push eax
call fcn.00608810
add esp, 0xc
mov dword [0x6af4e8], esi
test ebx, ebx
jg 0x5fabab
cmp dword [0x6ac6c4], 0
jne 0x5fabb6
dec ebx
mov ecx, edi
mov dword [ebp - 0x14], ebx
call fcn.005e0810
lea ecx, [ebp - 0x18]
call fcn.0041d9b0
mov eax, dword [0x6af4e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fabe0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6473b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x6af4ec]
test eax, eax
jne 0x5fad2a
mov dword [ebp - 4], eax
cmp dword [0x6b0dcc], eax
jne 0x5fac5a
push 0x10
call fcn.00606edf
add esp, 4
mov esi, eax
push 0
push 0
push 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, esi
mov dword [esi], eax
mov dword [0x6b0dcc], esi
call fcn.005e0970
mov dword [ebp - 4], 1
mov esi, dword [0x6ac16c]
test esi, esi
jne 0x5facad
push 0x10
call fcn.00606edf
add esp, 4
mov esi, eax
push 0
push 0
push 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, esi
mov dword [esi], eax
mov dword [0x6ac16c], esi
call fcn.005e0970
mov esi, dword [0x6ac16c]
mov dword [ebp - 4], 0xffffffff
push 0xffffffffffffffff
push dword [esi]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x5facdc
mov dword [esi + 8], 0
jmp 0x5face0
test eax, eax
jne 0x5facf0
inc dword [esi + 0xc]
inc dword [esi + 8]
inc dword [esi + 4]
mov dword [ebp - 0x14], 1
cmp dword [0x6af4ec], 0
jne 0x5fad15
push 0x1020
call fcn.00606edf
add esp, 4
mov esi, eax
mov ecx, esi
call fcn.005f9260
mov dword [0x6af4ec], esi
lea ecx, [ebp - 0x18]
call fcn.0041d900
lea ecx, [ebp - 0x18]
call fcn.0041d9b0
mov eax, dword [0x6af4ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5fd0a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x647825
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6a6040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x6c], edi
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp + 0xc]
call fcn.005b1400
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
test esi, esi
je 0x5fd11e
mov eax, dword [esi + 4]
jmp 0x5fd120
xor eax, eax
test esi, esi
je 0x5fd129
mov edx, dword [esi + 0xc]
jmp 0x5fd12e
mov edx, 0x651f68
push eax
lea ecx, [ebp - 0x68]
call fcn.00606270
add esp, 4
lea ecx, [ebp - 0x68]
push edi
call fcn.005ff0d0
or ebx, 0xffffffff
test esi, esi
je 0x5fd15b
mov eax, ebx
lock xadd dword [esi], eax
dec eax
jne 0x5fd15b
push ecx
mov ecx, esi
call fcn.005a47b0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5fd16f
lock xadd dword [ecx], ebx
dec ebx
jne 0x5fd16f
push ecx
call fcn.005a47b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00606a47
mov esp, ebp
pop ebp
ret 8
Function at 0x601200
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, ecx
mov dword [esp + 0x10], eax
mov ebx, edx
test edi, edi
je 0x6012a9
nop dword [eax]
or esi, 0xffffffff
cmp byte [0x6ac61e], 0
jne 0x60129e
imul ebp, eax, 0x2c
mov eax, dword [ebp + 0x6af554]
dec eax
cmp eax, 5
ja case.default.0x60123b
jmp dword [eax*4 + 0x6012b4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push dword [ebp + 0x6af550]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x601261
mov esi, dword [esp + 0x18]
jmp case.default.0x60123b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x601288
push 0
push edi
push ebx
push dword [ebp + 0x6af550]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne case.default.0x60123b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
or esi, esi
mov dword [ebp + 0x6af55c], eax
test esi, esi
js 0x6012a1
add ebx, esi
sub edi, esi
je 0x6012a9
mov eax, dword [esp + 0x10]
jmp 0x601220
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x601242
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, ecx
mov dword [esp + 0x10], eax
mov ebx, edx
test edi, edi
je 0x6012a9
nop dword [eax]
or esi, 0xffffffff
cmp byte [0x6ac61e], 0
jne 0x60129e
imul ebp, eax, 0x2c
mov eax, dword [ebp + 0x6af554]
dec eax
cmp eax, 5
ja case.default.0x60123b
jmp dword [eax*4 + 0x6012b4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push dword [ebp + 0x6af550]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x601261
mov esi, dword [esp + 0x18]
jmp case.default.0x60123b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x601288
push 0
push edi
push ebx
push dword [ebp + 0x6af550]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne case.default.0x60123b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
or esi, esi
mov dword [ebp + 0x6af55c], eax
test esi, esi
js 0x6012a1
add ebx, esi
sub edi, esi
je 0x6012a9
mov eax, dword [esp + 0x10]
jmp 0x601220
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret