joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce10
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x364
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41ce3a
cmp dword [esp + 4], 6
jne 0x41ce3a
cmp dword [esp + 8], 0
je 0x41ce64
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ce64
push 0xc00
call eax
test eax, eax
jne 0x41cf17
push 0x106
lea ecx, [esp + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41cf17
cmp eax, 0x104
ja 0x41cf17
lea edx, [esp + 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esp + eax*2 + 0x92], 0x5c
je 0x41ceb1
mov ecx, 0x5c
mov word [esp + eax*2 + 0x94], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x41cf16
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ebp, [esp + eax*2 + 0xa4]
mov ecx, ebp
jmp 0x41cee0
mov al, byte [esi]
movsx dx, al
mov word [ecx], dx
inc esi
add ecx, 2
test al, al
jne 0x41cee0
push str..dll
lea eax, [esp + 0xa8]
push eax
call edi
push 8
push 0
lea ecx, [esp + 0xac]
push ecx
call ebx
cmp byte [esi], 0
jne 0x41ced6
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x364
ret

Function at 0x420c10
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esi + 0x20]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x420c32
push eax
call ebx
jmp 0x420c3f
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x420c60
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x420c4f
push eax
call ebx
jmp 0x420c5c
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x420c6f
call ebp
test eax, eax
jne 0x420cb6
mov eax, 1
test eax, eax
jne 0x420cb6
cmp dword [esi + 0x18], 0
je 0x420c7c
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
lea eax, [esp + 0xc]
push eax
push 0
push esi
push fcn.00421a90
push 0
push 0
call fcn.00425bf6
add esp, 0x18
mov dword [esi + 0x18], eax
test eax, eax
jne 0x420c75
call ebp
test eax, eax
jne 0x420cb6
pop edi
mov eax, 1
and eax, 0xffff
pop ebp
or eax, 0x80070000
pop ebx
pop ecx
ret
jle 0x420cc2
and eax, 0xffff
or eax, 0x80070000
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4221d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42c6b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
add eax, 0x10
push eax
lea esi, [esp + 0x18]
call fcn.0040e8d0
xor eax, eax
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
cmp dword [ecx + 4], eax
jbe 0x422388
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov ecx, dword [esp + 0x3c]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 4]
mov edx, ebx
sub edx, edi
mov dword [esp + 0x10], esi
cmp eax, edx
jbe 0x4222a9
add eax, edi
mov ecx, eax
shr ecx, 1
lea esi, [ecx + eax + 0x10]
and esi, 0xfffffff0
dec esi
cmp esi, edi
jb 0x4223e7
cmp esi, 0x40000000
jae 0x4223e7
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004259f0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4223a6
lea eax, [edi + edi + 2]
push eax
push ebp
push ebx
call fcn.00429520
push ebp
call fcn.004259b6
mov ebp, ebx
mov ebx, esi
mov esi, dword [esp + 0x20]
add esp, 0x10
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [ecx + ecx + 2]
push edx
push eax
lea ecx, [ebp + edi*2]
push ecx
call fcn.00429520
add edi, dword [esi + 4]
add esp, 0xc
cmp byte [0x4395bd], 0
mov dword [esp + 0x18], edi
jne 0x4222f5
push ebp
lea esi, [esp + 0x24]
call fcn.0040ef80
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 0x20]
push edx
call fcn.004259b6
add esp, 4
jmp 0x4222fe
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ebx, edi
jne 0x422365
mov eax, edi
shr eax, 1
lea esi, [eax + edi + 0x10]
and esi, 0xfffffff0
dec esi
cmp esi, edi
jb 0x4223d0
cmp esi, 0x40000000
jae 0x4223d0
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004259f0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4223bb
lea eax, [edi + edi + 2]
push eax
push ebp
push ebx
call fcn.00429520
push ebp
call fcn.004259b6
mov ebp, ebx
mov ebx, esi
add esp, 0x10
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [ebp + edi*2], 0x5c
inc eax
inc edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x3c], eax
cmp eax, dword [ecx + 4]
jb 0x422220
push ebp
call fcn.004259b6
mov ecx, dword [esp + 0x30]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push 0x433900
lea edx, [esp + 0x44]
xor al, al
push edx
mov byte [esp + 0x48], al
call fcn.0042a55f
xor al, al
mov byte [esp + 0x40], al
push 0x433900
lea eax, [esp + 0x44]
push eax
call fcn.0042a55f
push 0x4338cc
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], 0x13329ad
call fcn.0042a55f
push 0x4338cc
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x48], 0x13329ad
call fcn.0042a55f
int3
Function at 0x422ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42c420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esp + 0x14], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x20], bx
push 8
mov dword [esi + 0x24], ebx
call fcn.004259f0
add esp, 4
cmp eax, ebx
jne 0x422b36
push 0x433900
lea eax, [esp + 0xf]
push eax
mov byte [esp + 0x13], bl
call fcn.0042a55f
xor ecx, ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 3
mov word [eax], cx
lea edx, [esi + 0x30]
push edx
mov byte [esp + 0x18], 2
call fcn.004185b0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x422e90
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x42ca28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push esi
lea ebx, [edi + 0x68]
push eax
lea esi, [ebx + 0xc]
call fcn.0040e9d0
push ebx
mov ecx, 0x61
call fcn.00410a70
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0xce4
lea esi, [esp + 8]
call fcn.00416a80
mov dword [esp + 0x1c], 0
mov edx, dword [eax]
mov ecx, dword [edi + 0x6c]
push edx
call fcn.00414990
mov eax, dword [esp + 8]
push eax
call fcn.004259b6
mov ecx, dword [edi + 0x6c]
add esp, 4
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x14]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x423440
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x42cea1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push ebp
mov ebp, dword [esp + 0xe0]
push esi
push edi
lea eax, [esp + 0x2c]
xor ebx, ebx
push eax
mov byte [ebp], bl
call fcn.00423680
mov edx, dword [esp + 0xdc]
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0xd0], ebx
push edx
lea esi, [esp + 0x34]
mov dword [esp + 0x30], ecx
call fcn.0040e9d0
mov eax, dword [esp + 0xe0]
push eax
lea esi, [esp + 0x40]
call fcn.0040e9d0
push 0xf0
call fcn.004259f0
add esp, 4
cmp eax, ebx
jne 0x4234cd
push 0x433900
lea ecx, [esp + 0x1b]
push ecx
mov byte [esp + 0x1f], bl
call fcn.0042a55f
mov dword [esp + 0x18], eax
push eax
mov byte [esp + 0xd4], 1
call fcn.00423840
mov esi, eax
mov byte [esp + 0xd0], bl
mov dword [esp + 0x48], esi
cmp esi, ebx
je 0x4234f8
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x423508
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x4c], esi
cmp byte [esp + 0xe4], bl
je 0x4235fc
mov eax, dword [esp + 0x48]
mov dword [eax + 0xd8], 1
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
lea edx, [esp + 0x34]
push edx
push 0x423430
push ebx
push ebx
mov byte [esp + 0xe8], 2
call fcn.00425bf6
mov esi, eax
add esp, 0x18
mov dword [esp + 0x18], esi
cmp esi, ebx
jne 0x423572
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, ebx
jne 0x423568
mov esi, 1
lea eax, [esp + 0x2c]
push eax
jmp 0x423648
push 8
mov dword [esp + 0x20], ebx
call fcn.004259f0
add esp, 4
cmp eax, ebx
jne 0x423597
push 0x433900
lea ecx, [esp + 0x1b]
push ecx
mov byte [esp + 0x1f], bl
call fcn.0042a55f
mov ecx, 3
xor edx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ecx
mov word [eax], dx
mov byte [esp + 0xd0], cl
push 0xce4
lea ecx, [esp + 0x20]
call fcn.004147d0
mov edi, dword [esp + 0x48]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00422e90
mov edx, dword [esp + 0x1c]
push edx
call fcn.004259b6
add esp, 4
push esi
mov byte [esp + 0xd4], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x423606
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x423606
lea eax, [esp + 0x2c]
push eax
call fcn.00423060
mov esi, dword [esp + 0xec]
lea ecx, [esp + 0xb8]
push ecx
call fcn.0040e9d0
cmp dword [esi + 4], ebx
jne 0x42362f
mov edx, dword [esp + 0x48]
add edx, 0xe4
push edx
call fcn.0040e9d0
mov eax, dword [esp + 0x48]
mov cl, byte [eax + 0xe0]
mov esi, dword [esp + 0xb4]
lea edx, [esp + 0x2c]
mov byte [ebp], cl
push edx
mov dword [esp + 0xd4], 0xffffffff
call fcn.00423780
mov ecx, dword [esp + 0xc8]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc4
ret 0x18
Function at 0x427a5e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4371f8]
jne 0x427a68
repz ret
jmp fcn.004292d5

Function at 0x427fbb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4371f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004269d9
and dword [ebp - 0x14], 0
cmp dword [0x438e7c], 0
mov dword [ebp - 0x18], eax
jne 0x42806e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x428116
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42ee5c
push ebx
call edi
test eax, eax
je 0x428116
mov esi, dword [0x437b74]
push eax
call esi
push 0x42ee4c
push ebx
mov dword [0x438e7c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x438e80], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x438e84], eax
call edi
push eax
call esi
mov dword [0x438e8c], eax
test eax, eax
je 0x42806e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x438e88], eax
mov eax, dword [0x438e88]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x437b70]
cmp eax, ecx
je 0x4280c7
cmp dword [0x438e8c], ecx
je 0x4280c7
push eax
call esi
push dword [0x438e8c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4280c7
test ebx, ebx
je 0x4280c7
call edi
test eax, eax
je 0x4280be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4280be
test byte [ebp - 8], 1
jne 0x4280c7
or dword [ebp + 0x10], 0x200000
jmp 0x4280fa
mov eax, dword [0x438e80]
cmp eax, dword [ebp - 0x18]
je 0x4280fa
push eax
call esi
test eax, eax
je 0x4280fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4280fa
mov eax, dword [0x438e84]
cmp eax, dword [ebp - 0x18]
je 0x4280fa
push eax
call esi
test eax, eax
je 0x4280fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438e7c]
call esi
test eax, eax
je 0x428116
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x428118
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427a5e
leave
ret
Function at 0xec49df
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0xec4a56
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0xec4a07
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xec4dc3
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0xec4dd9
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0xec4dd0
pop ebp
ret

Function at 0xec4de1
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0xec4df9
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0xec4dee
pop ebp
ret

Function at 0xec5775
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.00ec58f5
pop ecx
pop ecx
test eax, eax
je 0xec579a
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0xec5846
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0xec5880
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0xec5864
test edx, edx
jne 0xec585a
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0xec59d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0xec59f9
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0xec59ed
pop edi
pop esi
pop ebp
ret
Function at 0xec59fc
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor esi, esi
push edi
mov eax, esi
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jb 0xec5a0c
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x104]
mov eax, edi
movzx ecx, bl
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + edi - 0x104], al
inc edi
mov byte [ebp + esi - 0x104], bl
cmp edi, 0x100
jb 0xec5a1d
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov eax, esi
test ebx, ebx
je 0xec5ac6
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x14], ecx
sub edi, ecx
inc eax
movzx ecx, al
mov dword [ebp - 4], ecx
mov dl, byte [ebp + ecx - 0x104]
movzx eax, dl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + ecx - 0x104], al
mov byte [ebp + esi - 0x104], dl
movzx ecx, byte [ebp + ecx - 0x104]
movzx eax, dl
add ecx, eax
mov eax, dword [ebp + 0x14]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x104]
xor cl, byte [edi + eax]
mov byte [eax], cl
inc eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 4]
sub ebx, 1
jne 0xec5a70
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xec5dcf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x397
push ebx
push esi
mov esi, dword [ebp + 8]
xor esi, 0x76c7
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0xafb9
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0xec5e50
je 0xec5e49
sub eax, 0x5f
je 0xec5e42
sub eax, 9
je 0xec5e3b
sub eax, 0x7b
je 0xec5e34
sub eax, 0x100
je 0xec5e2d
sub eax, 0x8b
je 0xec5e26
sub eax, 0x1f
jne 0xec5e76
mov eax, 0xec5f7a
jmp 0xec5e95
mov eax, 0xec5c28
jmp 0xec5e95
mov eax, 0xec5f41
jmp 0xec5e95
mov eax, 0xec5cd3
jmp 0xec5e95
mov eax, fcn.00ec5d23
jmp 0xec5e95
mov eax, 0xec5fb3
jmp 0xec5e95
mov eax, 0xec5cdf
jmp 0xec5e95
sub eax, 0x4db
je 0xec5e90
sub eax, 0x170
je 0xec5e89
sub eax, 0x3f
je 0xec5e82
sub eax, 0x6e
je 0xec5e7b
sub eax, 0xca
jne 0xec5e76
mov eax, 0xec5f08
jmp 0xec5e95
mov eax, dword [ebp + 8]
jmp 0xec5e95
mov eax, 0xec5fec
jmp 0xec5e95
mov eax, 0xec5c61
jmp 0xec5e95
mov eax, 0xec5d17
jmp 0xec5e95
mov eax, 0xec5c9a
call eax
mov edi, eax
test edi, edi
je 0xec5eee
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0xec5eee
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00ec5bae
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0xec5ef7
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0xec5ed0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0xec5ef0
Function at 0xec6826
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
push edi
lea eax, [ebp - 0x15c]
push eax
push 0x90
push 4
push 0x4e7
push 0xedcc28
call fcn.00ec4e03
add esp, 0x14
xor esi, esi
xor eax, eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0x15c]
push esi
push esi
push esi
push esi
push eax
call dword [0xedcb84]
mov edi, eax
xor eax, eax
mov dword [ebp - 8], edi
test edi, edi
je 0xec6a46
mov word [ebp - 0x30], ax
xor ecx, ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x3c
push eax
push esi
push esi
push dword [ebp + 8]
inc ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [0xedcc10]
test eax, eax
jne 0xec68d2
push edi
call dword [0xedcac8]
xor eax, eax
jmp 0xec6a46
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x34]
push ebx
push esi
mov word [ecx + eax*2], dx
push dword [ebp - 0x30]
push dword [ebp - 0x38]
push edi
call dword [0xedcbe0]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0xec68f9
push edi
jmp 0xec695a
mov eax, dword [ebp - 0x1c]
cmp word [eax], si
jne 0xec6907
push 0x2f
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x54]
push eax
push 8
push 0xf
push 0x6e7
push 0xedcc28
call fcn.00ec4e03
add esp, 0x14
xor eax, eax
cmp dword [ebp - 0x3c], 2
mov ecx, 0x800000
mov word [ebp - 0x4c], ax
cmove eax, ecx
or eax, 0x100
push eax
push esi
push esi
push esi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x54]
push eax
push ebx
call dword [0xedcc00]
mov ebx, eax
test ebx, ebx
jne 0xec6967
push edi
call dword [0xedcac8]
push dword [ebp - 0xc]
call dword [0xedcac8]
xor eax, eax
jmp 0xec6a45
lea eax, [ebp - 0xc8]
mov edi, esi
push eax
push 0x72
push 0xd
push 0x3cb
push 0xedcc28
call fcn.00ec4e03
add esp, 0x14
xor eax, eax
mov word [ebp - 0x56], ax
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0xc8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
push ebx
call dword [0xedca00]
test eax, eax
jne 0xec69d8
call fcn.00ec4588
cmp eax, 0x2f8f
jne 0xec69d4
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x13300
push eax
push 0x1f
push ebx
call dword [0xedca70]
test eax, eax
push 1
pop eax
cmovne edi, eax
test edi, edi
jne 0xec698c
mov eax, dword [ebp + 0x18]
push esi
push ebx
mov dword [eax], esi
call dword [0xedcbcc]
mov edi, dword [ebp - 8]
test eax, eax
je 0xec6a2c
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push esi
push 0x20000013
push ebx
call dword [0xedcbf8]
mov ecx, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
mov dword [ecx], eax
cmp eax, 0xc8
jne 0xec6a2c
push dword [ebp + 0x14]
push ebx
call fcn.00ec673f
pop ecx
pop ecx
mov esi, eax
push edi
call dword [0xedcac8]
push dword [ebp - 0xc]
call dword [0xedcac8]
push ebx
call dword [0xedcac8]
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xec6f5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0xec7001
push ebx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
mov eax, ebx
sub eax, ecx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
sub eax, ecx
push edi
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x44]
xor edi, edi
push eax
call fcn.00ec7093
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add dword [eax + 0x20], 1
jne 0xec6fa2
inc dword [eax + 0x24]
cmp esi, 0x40
jbe 0xec6fd9
mov ebx, dword [ebp - 4]
mov edx, edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x44]
add ecx, edx
push 0x40
mov al, byte [ebx + ecx]
xor al, byte [ecx]
inc edx
mov byte [edi + ecx], al
pop eax
cmp edx, eax
jb 0xec6faf
mov ebx, dword [ebp + 0x10]
sub esi, eax
add dword [ebp + 0x14], eax
add ebx, eax
add dword [ebp + 0xc], eax
add dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
jmp 0xec6f86
test esi, esi
je 0xec6fff
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
sub eax, ecx
sub ebx, ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x44]
add ecx, edi
mov al, byte [eax + ecx]
xor al, byte [ecx]
inc edi
mov byte [ebx + ecx], al
mov eax, dword [ebp + 0xc]
cmp edi, esi
jb 0xec6fea
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xec7024
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x100
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov eax, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 8], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
jne 0xec7058
add ecx, 0x10
mov esi, str.expand_32_byte_kexpand_16_byte_k
jmp 0xec705d
mov esi, 0xed8d50
mov eax, dword [ecx]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x38], eax
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x14], eax
mov eax, dword [esi + 8]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [0xedd5ec], esi
mov dword [edx + 0x3c], eax
pop esi
pop ebp
ret