joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3667
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x5e367e
test esi, esi
jg 0x5e3685
xor eax, eax
jmp 0x5e372d
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.00611097
add esp, 0xc
test esi, esi
jns 0x5e36a1
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x5e3712
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005e3f5f
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x5e36ae
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.00611097
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e3737
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.00611097
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x5e37a0
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x5e376b
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x5e3798
cmp ecx, 4
jl 0x5e3769
cmp ecx, 4
jne 0x5e37a0
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x5e37ab
cmp esi, 0xa
jle 0x5e378d
cmp esi, 0xa
jg 0x5e393e
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x44a368]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x5e384e
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x5e38ec
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x5e382e
inc edx
cmp edx, dword [esp + 8]
jl 0x5e382c
jmp 0x5e38ec
mov edx, 1
jmp 0x5e386c
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x5e3857
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x5e3877
adc eax, 0
cmp edx, eax
jl 0x5e3855
mov eax, dword [esp + 8]
sar eax, 1
jns 0x5e3886
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x5e38ec
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x5e38d1
inc edx
cmp edx, dword [esp + 8]
jl 0x5e38cf
xor edx, edx
jmp 0x5e392a
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x5e38f4
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x5e3922
cmp ecx, 4
jl 0x5e38f2
cmp ecx, 4
jne 0x5e392a
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x5e3935
cmp esi, 0xa
jle 0x5e3917
cmp esi, 0xa
jle 0x5e37b4
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e3947
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, reloc.MSVCRT.dll___dllonexit
lea ebx, reloc.MSVCRT.dll___dllonexit
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, reloc.MSVCRT.dll___dllonexit
lea edx, reloc.MSVCRT.dll___dllonexit
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x5e3959
inc eax
cmp eax, 4
jl 0x5e3957
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.00611097
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x5e3955
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e603f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x5e605f
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x5e6046
cmp dword [eax], 0x11
jbe 0x5e607b
mov dword [eax], 0x11
jmp 0x5e606e
dec dword [eax]
cmp dword [eax], 0
je 0x5e607b
mov edx, dword [eax]
cmp dword [eax + edx*4], 0
je 0x5e606c
ret

Function at 0x5e690b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x5e6953
mov eax, 1
jmp 0x5e692b
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x5e6921
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, ebx
push edx
add eax, edi
push eax
call fcn.00611097
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x5e69b9
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jbe 0x5e6992
mov eax, 1
jmp 0x5e696a
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x5e6960
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, esi
push edx
add eax, edi
push eax
call fcn.00611097
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x5e69b9
mov eax, dword [ebx]
test eax, eax
jbe 0x5e69a5
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x5e69a5
dec eax
test eax, eax
ja 0x5e6998
mov dword [edi], eax
test eax, eax
jbe 0x5e69b9
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x5e69ab
pop edi
pop esi
pop ebx
ret
Function at 0x5f04d3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x5f0550
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x5f04fe
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x5f052a
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x5f04fc
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x5f04f6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x5f057c
cmp eax, dword [esp + 0x14]
ja 0x5f057c
xor eax, eax
jmp 0x5f0588
mov eax, 1
cmp edx, dword [esp + 0x14]
jbe 0x5f0588
inc eax
add esp, 0x90
pop esi
pop ebx
ret
Function at 0x63f795
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x63f7a4
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x63f88c
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x63f7b5
pop ebp
test edi, edi
je 0x63f8b1
jmp 0x63f895
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + reloc.MSVCRT.dll___dllonexit]
add ecx, 1
sub edi, 1
jne 0x63f895
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x640e15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x640e33
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x640e27
cmp dword [edi + 0x7c], ebx
je 0x640e42
call fcn.00641215
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00640b85
add esp, 0xc
test eax, eax
je 0x640e69
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.0065f2b8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x640eaa
push 0x4000
call fcn.0065f2b8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x640eb7
push esi
call fcn.0065f07e
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x640eff
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0063fbd5
test eax, eax
jne 0x640eff
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x640f29
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x640f32
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
mov al, byte [esi + 0x6c]
neg al
lea edx, [esi + 0x70]
mov dword [edx], reloc.MSVCRT.dll___dllonexit
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp ebp, ebx
mov dword [esi + 0x7c], eax
je 0x640f6b
mov cl, byte [ebp]
cmp cl, bl
je 0x640f6b
call fcn.0063f8c5
add ebp, 1
jne 0x640f5a
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x6429d5
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x4493fc]
xor eax, esp
mov dword [esp + 0x60], eax
test ecx, ecx
mov eax, dword [ebp + 8]
push esi
jne 0x6429f3
xor eax, eax
push ecx
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call fcn.006428c5
add esp, 4
mov ecx, esi
call fcn.00642965
test edi, edi
je 0x642a56
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
mov eax, 0x10
call fcn.0065f06f
mov esp, ebp
pop ebp
ret
Function at 0x6c1767
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.MSVCRT.dll___dllonexit]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.MSVCRT.dll___dllonexit
call fcn.006d3147
push 4
mov dword [ebp - 4], 0
call fcn.006c2fae
mov edi, eax
add esp, 4
test edi, edi
je 0x6c17e7
call fcn.006d2bbb
mov dword [edi], eax
call fcn.006d297a
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.006d28af
mov eax, dword [ebx + 4]
cmp eax, reloc.MSVCRT.dll___dllonexit
jae 0x6c17dd
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.006d28d7
jmp 0x6c17e9
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6da387
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
mov ecx, edx
shr eax, 8
or eax, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and ecx, 0xff0000
or ecx, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr ecx, 8
or ecx, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0
sub dword [ebp + 0xc], reloc.MSVCRT.dll___dllonexit
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, esi
mov ebx, ecx
shl ebx, 4
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, eax
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x6da4a9
mov esi, eax
and esi, 0xff0000
mov edx, eax
shr edx, 0x10
or esi, edx
mov edx, eax
shl eax, 0x10
shr esi, 8
and edx, 0xff00
or edx, eax
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
shr eax, 8
pop edi
or eax, esi
pop esi
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6da547
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
mov eax, edx
shr ecx, 8
or ecx, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and eax, 0xff0000
or eax, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr eax, 8
or eax, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0xe3779b90
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, ecx
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
add edi, esi
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x61c88647
add ebx, eax
xor edi, ebx
sub ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x6da669
mov esi, ecx
and esi, 0xff0000
mov edx, ecx
shr edx, 0x10
or esi, edx
mov edx, ecx
shl ecx, 0x10
shr esi, 8
and edx, 0xff00
or edx, ecx
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
shr ecx, 8
pop edi
or ecx, esi
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6dabd7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, reloc.MSVCRT.dll___dllonexit
test ecx, ecx
je 0x6dac06
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + reloc.MSVCRT.dll___dllonexit]
inc edx
dec ecx
jne 0x6dabe9
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x6dc357
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.MSVCRT.dll___dllonexit]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.MSVCRT.dll___dllonexit
call fcn.006d3147
push 4
mov dword [ebp - 4], 0
call fcn.006c2fae
mov edi, eax
add esp, 4
test edi, edi
je 0x6dc3d7
call fcn.006d2bbb
mov dword [edi], eax
call fcn.006d297a
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.006d28af
mov eax, dword [ebx + 4]
cmp eax, reloc.MSVCRT.dll___dllonexit
jae 0x6dc3cd
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.006d28d7
jmp 0x6dc3d9
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6e86c7
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], reloc.MSVCRT.dll___dllonexit
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x702cb7
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x702cd0
mov edi, ebx
mov ebx, eax
jmp 0x702cd2
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x702ce2
mov eax, esi
jmp 0x702cec
push eax
push esi
call fcn.006e67f7
add esp, 8
test eax, eax
jne 0x702cf4
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x702d12
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x702cfb
cmp eax, dword [edi + 4]
jge 0x702d29
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x702d17
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x702d4d
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, reloc.MSVCRT.dll___dllonexit
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x702d4d
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x702d3c
pop edi
pop esi
mov eax, 1
pop ebx
ret