joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6dff44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x415680
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4156bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4156bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4157a3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4156e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x415717
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005f9f77
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4157a3
cmp eax, 1
jle 0x415776
cmp eax, 3
jne 0x4157a3
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.005f9f77
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x415793
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005f9ef6
add esp, 0x10
cmp edi, eax
jne 0x4157a3
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4156a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b977a
mov esp, ebp
pop ebp
ret 4
Function at 0x4157e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6dff44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x415881
cmp byte [esi + 0x3d], 0
je 0x415881
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x415837
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x415849
sub eax, 1
je 0x41584d
sub eax, 2
je 0x415881
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41586a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005f9ef6
add esp, 0x10
cmp edi, eax
jne 0x415837
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005b977a
mov esp, ebp
pop ebp
ret
Function at 0x42ee60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0x310030
movzx ecx, byte [ebp + 8]
lea eax, [esi + 0x200]
shr ecx, 4
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x350034
mov dword [ebp - 0x14], 0x370036
mov dword [ebp - 0x10], 0x390038
mov dword [ebp - 0xc], 0x420041
mov dword [ebp - 8], 0x440043
mov dword [ebp - 4], 0x460045
movzx ecx, word [ebp + ecx*2 - 0x20]
mov word [eax], cx
movsx ecx, byte [ebp + 8]
and ecx, 0xf
movzx ecx, word [ebp + ecx*2 - 0x20]
mov word [esi + 0x202], cx
xor ecx, ecx
mov word [esi + 0x204], cx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x445690
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x6dff44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x64], eax
mov eax, edi
mov dword [ebp - 0x60], 0
cdq
mov esi, ecx
and edx, 0x7fff
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
lea ebx, [edx + eax]
mov dword [ebp - 0x4c], 0x10325476
sar ebx, 0xf
mov dword [ebp - 0x48], 0xc3d2e1f0
test bl, bl
je 0x44570e
push 0x8000
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.004454a0
add esp, 4
add esi, 0x8000
add bl, 0xff
jne 0x4456f1
and edi, 0x80007fff
jns 0x445720
dec edi
or edi, 0xffff8000
add edi, 1
je 0x445730
push edi
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.004454a0
add esp, 4
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x60]
call fcn.00445550
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b977a
mov esp, ebp
pop ebp
ret

Function at 0x445750
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x6dff44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
push 0x69bac8
push ecx
mov esi, edx
call fcn.005fdefa
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x445790
lea eax, [edi + 1]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b977a
mov esp, ebp
pop ebp
ret
push edi
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x460], 0
push 1
push eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0x67452301
mov dword [ebp - 0x454], 0xefcdab89
mov dword [ebp - 0x450], 0x98badcfe
mov dword [ebp - 0x44c], 0x10325476
mov dword [ebp - 0x448], 0xc3d2e1f0
call fcn.005fa975
add esp, 0x10
test eax, eax
je 0x44581e
push eax
lea edx, [ebp - 0x404]
lea ecx, [ebp - 0x460]
call fcn.004454a0
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.005fa975
add esp, 0x14
test eax, eax
jne 0x4457f1
mov edx, esi
lea ecx, [ebp - 0x460]
call fcn.00445550
push edi
call fcn.00600293
push edi
mov esi, eax
call fcn.005f9c3e
mov ecx, dword [ebp - 4]
add esp, 8
neg esi
sbb esi, esi
xor ecx, ebp
and esi, 2
pop edi
mov eax, esi
pop esi
call fcn.005b977a
mov esp, ebp
pop ebp
ret
Function at 0x46c080
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov eax, 0x40
mov ebx, ecx
mov esi, dword [edi]
and esi, 0x3f
mov byte [esi + edi + 0x18], pe_nt_image_headers32
inc esi
sub eax, esi
cmp eax, 8
jae 0x46c0c2
push eax
lea eax, [edi + 0x18]
add eax, esi
push 0
push eax
call fcn.005f6720
push 0x40
lea edx, [edi + 0x18]
mov ecx, edi
call fcn.0046b6b0
add esp, 0x10
mov eax, 0x40
xor esi, esi
add eax, 0xfffffff8
push eax
lea eax, [edi + 0x18]
add eax, esi
push 0
push eax
call fcn.005f6720
shl dword [edi], 3
lea edx, [edi + 0x18]
mov eax, dword [edi]
mov ecx, edi
mov byte [edi + 0x50], al
mov eax, dword [edi]
shr eax, 8
mov byte [edi + 0x51], al
movzx eax, byte [edi + 2]
mov byte [edi + 0x52], al
movzx eax, byte [edi + 3]
mov byte [edi + 0x53], al
movzx eax, byte [edi + 4]
mov byte [edi + 0x54], al
mov eax, dword [edi + 4]
shr eax, 8
mov byte [edi + 0x55], al
movzx eax, byte [edi + 6]
mov byte [edi + 0x56], al
movzx eax, byte [edi + 7]
push 0x40
mov byte [edi + 0x57], al
call fcn.0046b6b0
movzx eax, byte [edi + 8]
mov ecx, dword [edi + 8]
mov byte [ebx], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 2], al
movzx eax, byte [edi + 0xc]
mov byte [ebx + 4], al
shr ecx, 0x18
mov byte [ebx + 3], cl
mov ecx, dword [edi + 0xc]
mov eax, ecx
shr eax, 8
mov byte [ebx + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 6], al
movzx eax, byte [edi + 0x10]
mov byte [ebx + 8], al
shr ecx, 0x18
mov byte [ebx + 7], cl
mov ecx, dword [edi + 0x10]
mov eax, ecx
shr eax, 8
mov byte [ebx + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xa], al
movzx eax, byte [edi + 0x14]
shr ecx, 0x18
mov byte [ebx + 0xc], al
mov byte [ebx + 0xb], cl
mov ecx, dword [edi + 0x14]
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xd], al
mov eax, ecx
push 0x98
shr eax, 0x10
shr ecx, 0x18
push 0
push edi
mov byte [ebx + 0xe], al
mov byte [ebx + 0xf], cl
call fcn.005f6720
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x46c1b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xf8
mov eax, dword [0x6dff44]
xor eax, esp
mov dword [esp + 0xf4], eax
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
xorps xmm0, xmm0
mov byte [esp + 0xcc], 0
xor eax, eax
movaps xmmword [esp + 0xac], xmm0
push edi
movaps xmmword [esp + 0xc0], xmm0
lea ecx, [esi + 1]
mov word [esp + 0x14], ax
mov byte [esp + 0x16], al
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x46c220
sub esi, ecx
mov eax, esi
and eax, 0x1fffffff
mov dword [esp + 0x18], eax
mov eax, esi
shr eax, 0x1d
mov dword [esp + 0x1c], eax
cmp esi, 0x40
jb 0x46c259
mov eax, esi
lea ecx, [esp + 0x18]
and eax, 0xffffffc0
push eax
call fcn.0046b6b0
add esp, 4
mov edx, eax
and esi, 0x3f
push esi
push edx
lea eax, [esp + 0x38]
push eax
call fcn.005f5c20
add esp, 0xc
lea edx, [esp + 0x18]
lea ecx, [esp + 0xec]
call fcn.0046c080
xor eax, eax
mov dword [esp + 0xc], eax
nop
movzx eax, byte [esp + eax + 0xec]
push eax
lea eax, [esp + 0x18]
push str._02X
push eax
call fcn.00414180
lea eax, [esp + 0x20]
add esp, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c2a1
lea edi, [esp + 0xb0]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c2b2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0xc]
inc eax
and ecx, 3
mov dword [esp + 0xc], eax
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x10
jl 0x46c280
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xb0]
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x46c2e5
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
xor ecx, esp
call fcn.005b977a
mov esp, ebp
pop ebp
ret
Function at 0x486060
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x75e340], 0
push ebx
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 4], ebx
jne 0x4860ec
mov byte [0x75e8ef], 0
mov edx, 1
mov byte [0x75e6d0], 0xff
xor ebx, ebx
mov byte [ebx + 0x75e7f0], dl
mov byte [edx + 0x75e6d0], bl
add edx, edx
mov ecx, edx
mov eax, edx
xor ecx, 0x11d
and eax, 0x100
cmove ecx, edx
inc ebx
movzx edx, cl
cmp ebx, 0xff
jb 0x486090
mov ebx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [0x75e7d0], xmm0
mov dword [0x75e7e8], 0
movq qword [0x75e7e0], xmm0
mov byte [0x75e7ec], 0
mov dword [0x75e340], 1
cmp edi, 0x1e
jbe 0x4860fa
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0
push eax
call fcn.005f6720
add esp, 0xc
mov dword [ebp - 0x14], 0xff
cmp byte [edi + 0x75e7ce], 0
jne 0x4861ec
xor ecx, ecx
mov dword [ebp - 0x94], 1
test edi, edi
je 0x4861b6
mov ebx, 0xff
nop word [eax + eax]
mov dword [ebp + ecx*4 - 0x90], 1
mov esi, ecx
test ecx, ecx
je 0x48618e
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x94]
xor edx, edx
movzx eax, byte [eax + 0x75e6d0]
add eax, ecx
div ebx
movzx eax, byte [edx + 0x75e7f0]
xor eax, dword [ebp + esi*4 - 0x98]
mov dword [ebp + esi*4 - 0x94], eax
sub esi, 1
jne 0x486160
mov eax, dword [ebp - 0x94]
xor edx, edx
movzx eax, byte [eax + 0x75e6d0]
add eax, ecx
inc ecx
div ebx
movzx eax, byte [edx + 0x75e7f0]
mov dword [ebp - 0x94], eax
cmp ecx, edi
jb 0x486140
mov ebx, dword [ebp - 4]
lea ecx, [edi - 2]
xor edx, edx
mov eax, ecx
shl eax, 5
sub eax, ecx
lea ecx, [eax + 0x75e348]
nop dword [eax + eax]
mov eax, dword [ebp + edx*4 - 0x94]
mov al, byte [eax + 0x75e6d0]
mov byte [ecx + edx], al
inc edx
cmp edx, edi
jbe 0x4861d0
mov byte [edi + 0x75e7ce], 1
lea eax, [edi - 2]
xor esi, esi
mov ecx, eax
mov dword [ebp - 0xc], esi
shl ecx, 5
sub ecx, eax
add ecx, 0x75e348
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x4862be
mov edx, dword [ebp + 0xc]
lea eax, [edx - 1]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
nop word [eax + eax]
movzx ecx, byte [esi + eax]
movzx eax, byte [edx]
xor ecx, eax
mov bl, byte [ecx + 0x75e6d0]
cmp bl, 0xff
je 0x486272
mov ecx, 1
cmp edi, ecx
jbe 0x486272
mov esi, dword [ebp - 8]
movzx eax, bl
dec esi
mov dword [ebp - 0x10], eax
add esi, edi
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi - 1]
add eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0x14]
mov al, byte [edx + 0x75e7f0]
mov edx, dword [ebp + 0xc]
xor byte [ecx + edx], al
inc ecx
cmp ecx, edi
jb 0x486250
mov esi, dword [ebp - 0xc]
lea eax, [edi - 1]
push eax
lea eax, [edx + 1]
push eax
push edx
call fcn.005f61a0
add esp, 0xc
cmp bl, 0xff
je 0x4862a4
mov eax, dword [ebp - 8]
xor edx, edx
movzx ecx, bl
movzx eax, byte [eax]
add eax, ecx
mov ecx, 0xff
div ecx
mov al, byte [edx + 0x75e7f0]
jmp 0x4862a6
xor al, al
mov ecx, dword [ebp - 0x18]
inc esi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov byte [ecx], al
mov eax, dword [ebp + 8]
cmp esi, dword [ebp - 4]
jb 0x486220
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486450
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x6dff44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x486470
mov esi, 1
mov edx, 0x75eef0
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x75ef18
jl 0x4864b0
mov eax, 1
mov byte [0x75e8f0], 0x63
mov byte [0x75ee53], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x75e8f0], bl
mov byte [ebx + 0x75edf0], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4864f0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x75e8f0]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x760318], ecx
rol ecx, 8
mov dword [esi*4 + 0x75ff18], ecx
rol ecx, 8
mov dword [esi*4 + 0x75f318], ecx
rol ecx, 8
mov dword [esi*4 + 0x75ef18], ecx
movzx ecx, byte [esi + 0x75edf0]
test ecx, ecx
je 0x486630
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x48663c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x75fb18], eax
rol eax, 8
mov dword [esi*4 + 0x75f718], eax
rol eax, 8
mov dword [esi*4 + 0x760718], eax
rol eax, 8
mov dword [esi*4 + 0x75e9f0], eax
inc esi
cmp esi, 0x100
jl 0x486570
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b977a
mov esp, ebp
pop ebp
ret
Function at 0x4875e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x6dff44]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.005f6720
add esp, 8
lea edi, [ebx + 8]
mov edx, esi
mov dword [ebx + 4], edi
lea ecx, [esp + 0x14]
call fcn.004866a0
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4877e0
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x4877ca
nop dword [eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x75e8f0]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x75e9f0]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x760718]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75f718]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75fb18]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x75e8f0]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x760718]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75f718]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75e9f0]
movzx eax, bl
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75fb18]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x75e8f0]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x760718]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75f718]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75e9f0]
movzx eax, bl
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75fb18]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x75e8f0]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x760718]
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75f718]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75e9f0]
movzx eax, bl
movzx eax, byte [eax + 0x75e8f0]
xor edx, dword [eax*4 + 0x75fb18]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x487670
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [fcn.005f6720]
call eax
mov ecx, dword [esp + 0x138]
add esp, 0xc
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005b977a
mov esp, ebp
pop ebp
ret
Function at 0x5c4eb0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x5c4ef9
mov al, byte [esi]
push eax
call fcn.005d0540
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x5c4ed7
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x5c6120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5c613e
cmp dword [esi + 0x6c], 0
je 0x5c613e
push 2
push 3
push esi
call fcn.005d0ae0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.005d2590
add esp, 4
test esi, esi
je 0x5c615e
cmp dword [esi + 0x6c], 0
je 0x5c615e
push 3
push esi
call fcn.005d0b20
add esp, 8
pop esi
pop ebp
ret

Function at 0x5ce0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1d0], 0
je 0x5ce104
push esi
push 1
push edi
call fcn.005c1470
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.005c1470
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x5ce13a
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x67ef48
push 2
push eax
call fcn.005f9ef6
push dword [edi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005f9ef6
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x5d0230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.005d0260
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.0060fe44
Function at 0x5dcd10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.005fdc83
add esp, 0x18
test eax, eax
je 0x5dcd32
cmp eax, 0xffffffff
jne 0x5dcd34
xor eax, eax
pop ebp
ret
Function at 0x5e4460
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x5e448f
push str.Couldnt_set_desired_mode
push edx
call fcn.005ce140
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x5e44a6
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.005ce220
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x5e44bd
push edi
call fcn.005e41c0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x5e44d1
push edi
call fcn.005e31f0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x5e44e5
push edi
call fcn.005e41a0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x5e44f5
push edi
call fcn.005e4340
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x5f3e10
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret