joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58a590
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [edx]
mov ebp, dword [edx + 4]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
movzx eax, byte [edx + 0x10]
shr al, 2
cmp ebp, ecx
sete dl
and dl, al
cmp dl, 1
jne 0x58a629
xor eax, eax
test ebp, ebp
jle 0x58a65f
xor edi, edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
nop word cs:[eax + eax]
mov ecx, dword [esi + edi*4]
mov ebp, dword [ebx + edi*4]
mov edx, ebp
xor edx, ecx
mov ebx, ecx
sub ebx, ebp
xor ebx, ebp
or ebx, edx
xor ebx, ecx
sar ebx, 0x1f
mov esi, ebx
not ebx
and ebx, eax
or ebx, esi
mov esi, dword [esp + 8]
mov eax, ebp
sub eax, ecx
xor eax, ecx
or eax, edx
xor eax, ebp
mov ebp, dword [esp]
sar eax, 0x1f
mov ecx, eax
not eax
and eax, ebx
mov ebx, dword [esp + 4]
and ecx, 1
or eax, ecx
inc edi
cmp ebp, edi
jne 0x58a5e0
jmp 0x58a65f
mov eax, ebp
sub eax, ecx
jne 0x58a65f
jmp 0x58a64d
mov ecx, dword [esi + ebp*4 - 4]
mov edx, dword [ebx + ebp*4 - 4]
dec ebp
cmp ecx, edx
jne 0x58a655
test ebp, ebp
jg 0x58a640
xor eax, eax
jmp 0x58a65f
xor eax, eax
cmp edx, ecx
adc eax, 0xffffffff
or eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x58aa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
dec eax
and eax, ecx
shr eax, 0x1f
dec eax
mov ecx, dword [edx + 4]
mov edi, dword [esi + 4]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 4], ecx
xor dword [esi + 4], edi
mov ecx, dword [edx + 0xc]
mov edi, dword [esi + 0xc]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 0xc], ecx
xor dword [esi + 0xc], edi
mov ecx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
mov ebx, dword [esi + 0x10]
xor ebx, edi
and ebx, eax
and ebx, 4
xor edi, ebx
mov dword [edx + 0x10], edi
xor dword [esi + 0x10], ebx
test ecx, ecx
jle 0x58ab6f
mov edx, dword [edx]
mov esi, dword [esi]
xor edi, edi
cmp ecx, 4
jb 0x58ab13
lea ebx, [edx + ecx*4]
mov dword [esp], ebx
lea ebp, [esi + ecx*4]
cmp edx, ebp
setb bl
cmp esi, dword [esp]
setb bh
test bl, bh
jne 0x58ab13
mov edi, ecx
and edi, 0x7ffffffc
movd xmm0, eax
pshufd xmm0, xmm0, 0
xor ebx, ebx
nop word [eax + eax]
movdqu xmm1, xmmword [edx + ebx*4]
movdqu xmm2, xmmword [esi + ebx*4]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm0
pxor xmm1, xmm3
movdqu xmmword [edx + ebx*4], xmm1
pxor xmm3, xmm2
movdqu xmmword [esi + ebx*4], xmm3
add ebx, 4
cmp edi, ebx
jne 0x58aae0
cmp edi, ecx
je 0x58ab6f
mov ebx, edi
test cl, 1
je 0x58ab31
mov ebx, dword [edx + edi*4]
mov ebp, dword [esi + edi*4]
xor ebp, ebx
and ebp, eax
xor ebx, ebp
mov dword [edx + edi*4], ebx
xor dword [esi + edi*4], ebp
mov ebx, edi
or ebx, 1
lea ebp, [ecx - 1]
cmp edi, ebp
je 0x58ab6f
nop dword [eax + eax]
mov edi, dword [edx + ebx*4]
mov ebp, dword [esi + ebx*4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4], edi
xor dword [esi + ebx*4], ebp
mov edi, dword [edx + ebx*4 + 4]
mov ebp, dword [esi + ebx*4 + 4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4 + 4], edi
xor dword [esi + ebx*4 + 4], ebp
add ebx, 2
cmp ecx, ebx
jne 0x58ab40
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d7330
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x5d739d
movzx ecx, byte [edx]
test cl, cl
je 0x5d739d
inc edx
mov edi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
movsx eax, cl
mov ebp, edi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov esi, ebx
mov al, 0x20
sub al, cl
shl esi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
add edi, 0x100
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, esi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x5d7350
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d79f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x5d7a60
movzx ecx, byte [edx]
test cl, cl
je 0x5d7a60
inc edx
mov esi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
and cl, 0xdf
movsx eax, cl
mov ebp, esi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov edi, ebx
mov al, 0x20
sub al, cl
shl edi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, edi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
add esi, 0x100
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x5d7a10
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d9f60
Capabilities:
Access the windows event log
Check os version
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x220
mov esi, esp
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5d9fc6
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5d9fc6
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
push eax
push ebx
push 0x200
push ecx
mov ebx, ecx
call fcn.00788820
add esp, 0x10
test eax, eax
mov ecx, 0x200
cmovns ecx, eax
lea eax, [esi + 8]
push 0
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5da15e
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
lea eax, [eax*2 + 5]
inc edi
and eax, 0xfffffffc
call fcn.00789f40
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push edi
push ebx
push edi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 8]
test eax, eax
setne al
test edi, edi
sete cl
or cl, al
jne 0x5da05e
xor eax, eax
cmp edi, 0x10
jb 0x5da051
mov eax, edi
and eax, 0xfffffff0
xor ecx, ecx
nop word [eax + eax]
movq xmm0, qword [edx + ecx]
punpcklbw xmm0, xmm0
movq xmm1, qword [edx + ecx + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqa xmmword [ebx + ecx*2], xmm0
movdqa xmmword [ebx + ecx*2 + 0x10], xmm1
add ecx, 0x10
cmp eax, ecx
jne 0x5da020
jmp 0x5da05a
movsx ecx, byte [edx + eax]
mov word [ebx + eax*2], cx
inc eax
cmp edi, eax
jne 0x5da051
test edi, edi
je 0x5da0c1
xor eax, eax
jmp 0x5da075
inc eax
cmp eax, edi
jae 0x5da0c1
cmp word [ebx + eax*2], 0x25
jne 0x5da070
nop dword [eax]
inc eax
movzx ecx, word [ebx + eax*2]
lea edx, [ecx - 0x30]
cmp edx, 0xa
jb case.0x5da095.42
lea edx, [ecx - 0x2a]
cmp edx, 0x39
ja case.default.0x5da095
jmp dword [edx*4 + 0xa070f4]
mov word [ebx + eax*2], 0x63
jmp case.0x5da095.43
cmp ecx, 0x73
jne case.0x5da095.43
mov word [ebx + eax*2], 0x53
jmp case.0x5da095.43
mov word [ebx + eax*2], 0x43
jmp case.0x5da095.43
mov word [ebx + eax*2], 0x73
jmp case.0x5da095.43
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea edi, [esi + 0x10]
push eax
push ebx
push 0xff
push edi
call fcn.007887d0
add esp, 0x10
mov word [esi + 0x20e], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x5da14e
call fcn.005d9e60
test eax, eax
jle 0x5da14e
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x5da15e
mov dword [esi + 8], edi
sub esp, 0x24
lea ecx, [esi + 8]
mov dword [esp + 0x1c], ecx
movd xmm0, dword [0xa070f0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x5da15e
push 0x10
push str.OpenSSL:_FATAL
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e9ae0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x5e9b0b
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x5e9af7
neg eax
shr eax, 0x1f
pop edi
pop esi
ret
Function at 0x5ebb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5ebbf7
xor eax, eax
nop word cs:[eax + eax]
mov dword [esp], eax
mov ebp, eax
shr ebp, 3
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + ebp]
mov ecx, dword [esp]
mov bh, cl
and bh, 7
mov dl, bh
xor dl, 7
movzx ecx, dl
mov esi, edx
bt eax, ecx
setb bl
shl bl, 7
mov edi, dword [esp + 0x38]
movups xmm0, xmmword [edi]
movups xmmword [esp + 4], xmm0
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x50]
add esp, 0xc
movzx eax, bl
xor bl, byte [edi]
cmp dword [esp + 0x40], 0
movzx ecx, bl
cmove ecx, eax
movdqu xmm2, xmmword [esp + 4]
movdqa xmm0, xmm2
psrldq xmm0, 1
movd xmm1, ecx
pslldq xmm1, 0xf
por xmm1, xmm0
psrlw xmm1, 7
pand xmm1, xmmword [0xa08d20]
movdqa xmm0, xmm2
paddb xmm0, xmm2
por xmm0, xmm1
movdqu xmmword [edi], xmm0
mov edi, dword [esp + 0x2c]
movzx eax, byte [edi + ebp]
btr eax, esi
and bl, 0x80
movzx edx, bl
mov cl, bh
shr edx, cl
or edx, eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov byte [edi + ebp], dl
inc eax
cmp ecx, eax
jne 0x5ebb40
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5ebc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [esp + 0x2c], 0
je 0x5ebcc2
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x3c], 0
lea ebp, [esp + 1]
je 0x5ebc71
xor edi, edi
nop dword [eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [ebx]
xor al, byte [esi + edi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + edi], al
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ebc30
jmp 0x5ebcc2
xor edi, edi
nop word cs:[eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [esi + edi]
movzx ecx, byte [ebx]
xor cl, al
mov edx, dword [esp + 0x28]
mov byte [edx + edi], cl
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ebc80
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ec5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0x38]
mov eax, 0xfffffffe
or ecx, dword [esi + 0x3c]
jne 0x5ec7d4
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x34]
mov ebx, dword [esi + 0x30]
add ebx, ecx
adc edx, 0
mov eax, 0xffffffff
mov edi, ebx
neg edi
mov edi, 0x20000000
sbb edi, edx
jb 0x5ec7d4
mov edi, dword [esp + 0x24]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edx
mov eax, dword [esi + 0x170]
test eax, eax
je 0x5ec660
test ecx, ecx
je 0x5ec7cc
nop dword [eax]
movzx edx, byte [edi]
xor byte [esi + eax + 0x40], dl
inc edi
lea ebx, [ecx - 1]
inc eax
and eax, 0xf
je 0x5ec638
cmp ecx, 1
mov ecx, ebx
jne 0x5ec620
test eax, eax
jne 0x5ec7cc
lea eax, [esi + 0x40]
lea ecx, [esi + 0x60]
push ecx
push eax
call dword [esi + 0x168]
add esp, 8
mov ebp, ebx
and ebp, 0xfffffff0
mov dword [esp + 8], ebp
jne 0x5ec66d
mov ebp, edi
jmp 0x5ec685
mov ebx, ecx
mov ebp, ebx
and ebp, 0xfffffff0
mov dword [esp + 8], ebp
je 0x5ec65c
lea eax, [esi + 0x40]
lea ecx, [esi + 0x60]
push ebp
push edi
push ecx
push eax
call dword [esi + 0x164]
add esp, 0x10
add ebp, edi
and ebx, 0xf
test ebx, ebx
je 0x5ec7ca
lea ecx, [esi + 0x40]
mov dword [esp], 0
cmp ebx, 8
mov dword [esp + 4], ebx
jb 0x5ec760
mov eax, dword [esp + 8]
lea edx, [ebx + eax]
add edx, edi
cmp ecx, edx
lea edx, [esi + ebx + 0x40]
setb bl
cmp ebp, edx
setb dl
test bl, dl
mov ebx, dword [esp + 4]
jne 0x5ec760
mov dword [esp], 0
cmp ebx, 0x20
jb 0x5ec72e
mov eax, ebx
and eax, 0xffffffe0
mov edx, dword [esp + 8]
add edx, edi
add edx, 0x10
xor ebx, ebx
nop word cs:[eax + eax]
movups xmm0, xmmword [edx + ebx - 0x10]
movups xmm1, xmmword [edx + ebx]
movups xmm2, xmmword [esi + ebx + 0x40]
xorps xmm2, xmm0
movups xmm0, xmmword [esi + ebx + 0x50]
xorps xmm0, xmm1
movups xmmword [esi + ebx + 0x40], xmm2
movups xmmword [esi + ebx + 0x50], xmm0
add ebx, 0x20
cmp eax, ebx
jne 0x5ec6f0
mov ebx, dword [esp + 4]
cmp ebx, eax
je 0x5ec7ca
mov dword [esp], eax
test bl, 0x18
je 0x5ec760
mov edx, dword [esp]
mov eax, ebx
and eax, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [ebp + edx]
movsd xmm1, qword [ecx + edx]
xorps xmm1, xmm0
movlps qword [ecx + edx], xmm1
add edx, 8
cmp eax, edx
jne 0x5ec740
mov dword [esp], eax
cmp ebx, eax
je 0x5ec7ca
mov edx, dword [esp]
and ebx, 3
je 0x5ec77c
mov edx, dword [esp]
nop dword [eax + eax]
movzx eax, byte [ebp + edx]
xor byte [ecx + edx], al
inc edx
dec ebx
jne 0x5ec770
mov ebx, dword [esp + 4]
mov eax, dword [esp]
sub eax, ebx
cmp eax, 0xfffffffc
ja 0x5ec7ca
mov eax, dword [esp + 8]
add eax, edi
add eax, 3
nop word cs:[eax + eax]
movzx ecx, byte [eax + edx - 3]
xor byte [esi + edx + 0x40], cl
movzx ecx, byte [eax + edx - 2]
xor byte [esi + edx + 0x41], cl
movzx ecx, byte [eax + edx - 1]
xor byte [esi + edx + 0x42], cl
movzx ecx, byte [eax + edx]
xor byte [esi + edx + 0x43], cl
add edx, 4
cmp ebx, edx
jne 0x5ec7a0
mov eax, ebx
mov dword [esi + 0x170], eax
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5eff10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x5f005b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x5eff71
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push str.crypto_modes_ocb128.c
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.005dcae0
add esp, 0x10
test eax, eax
je 0x5f006d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0xa08da0]
movdqa xmm1, xmmword [0xa08db0]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x5eff90
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5f0065
Function at 0x5f0740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
test esi, esi
js 0x5f078d
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
sete cl
test eax, eax
sete dl
or dl, cl
jne 0x5f0797
nop dword [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp]
inc ebp
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
inc esi
and esi, 0xf
je 0x5f0799
cmp eax, 1
mov eax, ecx
jne 0x5f0770
jmp 0x5f0799
mov ecx, 0xffffffff
jmp 0x5f08d2
mov ecx, eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x5f086a
mov dword [esp], ecx
push edx
push edi
push edi
call eax
add esp, 0xc
cmp esi, 0xf
ja 0x5f07f7
mov eax, dword [edi + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
cmp esi, 0xb
ja 0x5f07f7
mov eax, dword [edi + esi + 4]
xor eax, dword [ebp + esi + 4]
mov dword [ebx + esi + 4], eax
cmp esi, 7
ja 0x5f07f7
mov eax, dword [edi + esi + 8]
xor eax, dword [ebp + esi + 8]
mov dword [ebx + esi + 8], eax
cmp esi, 3
ja 0x5f07f7
mov eax, dword [edi + esi + 0xc]
xor eax, dword [ebp + esi + 0xc]
mov dword [ebx + esi + 0xc], eax
mov ecx, dword [esp]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
xor esi, esi
cmp ecx, 0x10
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
jb 0x5f086a
nop word cs:[eax + eax]
push edx
push edi
push edi
mov edi, ecx
call dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, edi
mov edi, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [edi]
xor eax, dword [ebp]
mov dword [ebx], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
xor eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x30]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
cmp ecx, 0xf
ja 0x5f0820
test ecx, ecx
je 0x5f088c
push edx
push edi
push edi
mov edi, ecx
call eax
mov edx, edi
add esp, 0xc
test dl, 1
jne 0x5f0890
mov eax, edx
mov edi, dword [esp + 0x28]
cmp edx, 1
jne 0x5f08b0
jmp 0x5f08d2
mov ecx, esi
jmp 0x5f08d2
mov edi, dword [esp + 0x28]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
lea eax, [edx - 1]
mov byte [ebx + esi], cl
inc esi
mov ecx, esi
cmp edx, 1
je 0x5f08d2
nop word [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
mov byte [ebx + esi], cl
movzx edx, byte [edi + esi + 1]
xor dl, byte [ebp + esi + 1]
lea ecx, [esi + 2]
mov byte [ebx + esi + 1], dl
mov esi, ecx
add eax, 0xfffffffe
jne 0x5f08b0
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6151b0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x18]
jne 0x615230
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx]
mov dh, dl
and dh, 0xfe
cmp dh, 0x6a
jne 0x615230
cmp dl, 0x6b
jne 0x615262
cmp eax, 4
jl 0x61529f
lea edx, [ecx + eax]
add edx, 0xfffffffe
add eax, 0xfffffffd
add ecx, 2
xor esi, esi
nop dword [eax]
movzx edi, byte [ecx - 1]
cmp edi, 0xbb
jne 0x615283
inc esi
inc ecx
cmp eax, esi
jne 0x6151f0
xor eax, eax
cmp byte [edx + eax], 0xcc
je 0x61526e
call fcn.005b7120
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005b7220
add esp, 0xc
push 0
push 0x8b
jmp 0x615250
call fcn.005b7120
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005b7220
add esp, 0xc
push 0
push 0x89
push 4
call fcn.005b7310
add esp, 0xc
mov eax, 0xffffffff
pop esi
pop edi
ret
inc ecx
add eax, 0xfffffffe
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x61520e
push eax
push edx
push dword [esp + 0x14]
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, esi
add esp, 0xc
pop esi
pop edi
ret
cmp edi, 0xba
jne 0x6152ad
test esi, esi
je 0x61529f
sub eax, esi
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x61520e
jmp 0x61526e
call fcn.005b7120
push str.RSA_padding_check_X931
push 0x56
jmp 0x6152b9
call fcn.005b7120
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005b7220
add esp, 0xc
push 0
push 0x8a
jmp 0x615250

Function at 0x61e110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x61e13d
mov eax, dword [eax]
test eax, eax
je 0x61e13d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x61e13d
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x61e1f2
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
test ebx, ebx
je 0x61e18a
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x61e18d
add esi, 6
add esi, 2
push 0x166
push str.crypto_ui_ui_lib.c
push esi
call fcn.005dc9b0
add esp, 0xc
test eax, eax
je 0x61e1f2
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.005de850
add esp, 0xc
push esi
push ebp
push edi
call fcn.005de8b0
add esp, 0xc
test ebx, ebx
je 0x61e1e1
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.005de8b0
add esp, 0xc
push esi
push ebx
push edi
call fcn.005de8b0
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.005de8b0
add esp, 0xc
jmp 0x61e1f4
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6413b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
cmp ebx, 2
jb 0x641428
mov dword [esp], ecx
mov eax, ebx
shr ebx, 1
lea esi, [edx + eax]
xor edi, edi
cmp ebx, 1
je 0x64140b
and ebx, 0xfffffffe
mov eax, dword [esp + 0x18]
lea ebp, [eax - 1]
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [edx + edi]
mov ah, byte [edx + ebp]
mov byte [edx + edi], ah
mov byte [edx + ebp], al
movzx eax, byte [edx + edi + 1]
mov ecx, edi
xor ecx, 0xfffffffe
mov ah, byte [esi + ecx]
mov byte [edx + edi + 1], ah
mov byte [esi + ecx], al
add edi, 2
add ebp, 0xfffffffe
cmp ebx, edi
jne 0x6413e0
mov ebx, dword [esp + 0x18]
test bl, 2
mov ecx, dword [esp]
je 0x641428
movzx eax, byte [edx + edi]
mov ebp, edi
not ebp
mov ah, byte [esi + ebp]
mov byte [edx + edi], ah
mov byte [esi + ebp], al
push ecx
push ebx
push edx
call fcn.00589e00
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret