joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59b460
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x118
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xe0], r14
mov r14d, dword [rdx + 4]
xor ebp, ebp
mov dword [rsp + 0x20], r14d
sub r14d, r8d
cmp r9d, r8d
mov qword [rsp + 0xd8], r15
mov edi, r8d
mov qword [rsp + 0x28], rdx
mov r15d, r9d
mov rsi, rcx
mov qword [rsp + 0x30], rcx
jae 0x59b4e2
lea r8, str.orig_len___md_size
lea rcx, [0x0073b450]
mov edx, 0xef
call fcn.005cc540
cmp edi, 0x40
jbe 0x59b4ff
lea r8, [0x0073b460]
lea rcx, [0x0073b480]
mov edx, pe_nt_image_headers64
call fcn.005cc540
lea rax, [rsp + 0x40]
mov qword [rsp + 0xf0], r12
neg rax
and eax, 0x3f
lea r12, [rsp + rax + 0x40]
lea eax, [rdi + 0x100]
cmp r15d, eax
jbe 0x59b52d
mov ebp, r15d
sub ebp, edi
sub ebp, 0x100
xor edx, edx
mov eax, edi
mov qword [rsp + 0x110], rbx
and eax, 0xfffffffe
mov r8, rdi
mov rcx, r12
shl eax, 0x17
mov qword [rsp + 0xe8], r13
mov r13, rdi
sub eax, ebp
add eax, r14d
div edi
mov ebx, edx
mov dword [rsp + 0x24], edx
xor edx, edx
call sub.msvcrt.dll_memset
cmp ebp, r15d
jae 0x59b60f
mov r8d, dword [rsp + 0x20]
mov r9d, ebp
mov r10d, ebp
mov eax, r8d
mov ebx, r8d
mov esi, r14d
not eax
sub r9d, r8d
sub ebx, r14d
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
not esi
add r10, qword [rax + 0x10]
mov r13d, dword [rsp + 0x20]
xor r11d, r11d
mov eax, ebp
lea edx, [rbx + r9]
mov ecx, ebp
xor ecx, r8d
xor eax, r14d
inc r10
or ecx, r9d
or edx, eax
mov eax, esi
not ecx
and eax, ebp
not edx
or edx, eax
mov eax, r13d
inc r9d
and eax, ebp
sar edx, 0x1f
inc ebp
or ecx, eax
sar ecx, 0x1f
not cl
and cl, byte [r10 - 1]
and cl, dl
or byte [r11 + r12], cl
inc r11d
mov ecx, r11d
mov eax, r11d
xor ecx, edi
sub eax, edi
not ecx
and ecx, eax
mov eax, r11d
not eax
and eax, edi
or ecx, eax
sar ecx, 0x1f
and r11d, ecx
cmp ebp, r15d
jb 0x59b5a0
mov ebx, dword [rsp + 0x24]
mov rsi, qword [rsp + 0x30]
mov r13, rdi
test edi, edi
mov r15, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x108]
je 0x59b668
nop
nop
mov ecx, ebx
mov eax, ebx
inc ebx
xor rax, 0x20
inc rsi
movzx eax, byte [rax + r12]
movzx eax, byte [rcx + r12]
mov ecx, ebx
mov byte [rsi - 1], al
xor ecx, edi
mov eax, ebx
sub eax, edi
not ecx
and ecx, eax
mov eax, ebx
not eax
and eax, edi
or ecx, eax
sar ecx, 0x1f
and ebx, ecx
dec r13
jne 0x59b630
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xc0]
call fcn.00693b90
add rsp, 0x118
ret
Function at 0x59c780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov eax, 0xd8
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xc0], rsi
mov esi, ecx
xor ebp, ebp
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0xb8], rdi
mov edi, ebp
mov ebx, ebp
call fcn.00580d10
test eax, eax
je 0x59c80d
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x59c7f0
inc edi
inc ebx
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebx
call fcn.00580d10
test eax, eax
jne 0x59c7e0
mov ecx, dword [rsp + 0x140]
mov rbx, qword [rsp + 0x138]
mov qword [rsp + 0xb0], r12
mov eax, ecx
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xa0], r14
mov r14, qword [rsp + 0x148]
cdq
mov qword [rsp + 0x98], r15
idiv edi
cmp edi, 1
movsxd rdi, dword [rsp + 0x158]
cmove ecx, ebp
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x140], ecx
mov rcx, r14
movsxd r13, eax
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call fcn.00580d10
test eax, eax
je 0x59c9a1
mov r12, qword [rsp + 0x150]
mov r15d, dword [rsp + 0x130]
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x59c980
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x59c9a8
mov eax, dword [rsp + 0x158]
mov r8d, dword [rsp + 0x140]
mov r9, qword [rsp + 0xe8]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x118]
and r8d, 1
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x110]
add r8d, r13d
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x108]
mov rdx, rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x20], eax
call fcn.0059c2e0
test eax, eax
je 0x59c9ca
add rbx, r13
test rdi, rdi
jle 0x59c980
mov r8, r12
mov rcx, r14
mov rdx, rdi
sub r8, r14
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x59c970
inc ebp
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebp
call fcn.00580d10
test eax, eax
jne 0x59c8a0
mov eax, 1
jmp 0x59c9cc
mov edx, 0x11c
lea r9, [0x0073b5e8]
mov ecx, reloc.WS2_32.dll_sendto
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], 0x114
call fcn.005ad900
xor eax, eax
mov r15, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xd8
ret
Function at 0x59ec50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov eax, 0x78
call fcn.00693bc0
sub rsp, rax
cmp r8d, 3
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov rbx, r9
mov r15, rcx
mov r14d, r8d
mov r13, rdx
jge 0x59ecb8
mov edx, 0x136
lea r9, [0x0073b8d8]
lea ecx, [rax - 0x64]
lea r8d, [rdx + 0x2b]
mov dword [rsp + 0x20], 0x133
call fcn.005ad900
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
jmp 0x59ee11
movzx eax, byte [rdx + 1]
mov qword [rsp + 0x68], rbp
movzx ebp, byte [rdx]
shl ebp, 8
add r13, 2
sub r14d, 2
or ebp, eax
mov eax, ebp
cdq
and eax, 1
xor eax, edx
cmp eax, edx
je 0x59ed0f
mov dword [rsp + 0x20], 0x13f
lea r9, [0x0073b8e8]
mov edx, 0x136
mov ecx, reloc.WS2_32.dll_sendto
lea r8d, [rdx + 0x2b]
call fcn.005ad900
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
jmp 0x59ee0c
lea eax, [rbp + 1]
cmp r14d, eax
jge 0x59ed28
mov dword [rsp + 0x20], 0x147
lea r9, [0x0073b8f8]
jmp 0x59ecec
test rcx, rcx
mov qword [rsp + 0x50], r12
je 0x59ed56
mov r12, qword [rcx + reloc.MFC42u.dll_CDaoException::CDaoException]
test r12, r12
jne 0x59ed59
mov rax, qword [rcx + 0x170]
test rax, rax
je 0x59ed56
mov r12, qword [rax + 0x2c0]
test r12, r12
jne 0x59ed59
xor r12d, r12d
mov qword [rcx + 0x278], 0
mov rcx, r12
mov qword [rsp + 0x58], rdi
call fcn.005c0870
test ebp, ebp
mov edi, eax
je 0x59edd1
mov qword [rsp + 0x60], rsi
nop
movzx esi, byte [r13]
movzx ecx, byte [r13 + 1]
add r13, 2
shl esi, 8
sub ebp, 2
sub r14d, 2
or esi, ecx
xor ebx, ebx
test edi, edi
jle 0x59edc0
mov edx, ebx
mov rcx, r12
call fcn.005c0880
cmp dword [rax + 8], esi
je 0x59edb7
inc ebx
cmp ebx, edi
jl 0x59eda0
jmp 0x59edc0
mov qword [r15 + 0x278], rax
mov edi, ebx
test ebp, ebp
jne 0x59ed80
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x60]
movzx eax, byte [r13]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
lea ecx, [r14 - 1]
cmp eax, ecx
je 0x59ee0a
mov edx, 0x136
mov dword [rsp + 0x20], 0x16f
lea r9, [0x0073b908]
lea r8d, [rdx + 0x2a]
mov ecx, reloc.WS2_32.dll_sendto
jmp 0x59ecfa
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x5b4ad0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x478
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0x498], rbp
xor ebp, ebp
test rcx, rcx
mov qword [rsp + 0x468], rdi
mov ebx, edx
mov rdi, rcx
je 0x5b4b33
lea rdx, [rsp + 0x20]
call sub.msvcrt.dll__stat
test eax, eax
js 0x5b4b33
xorpd xmm2, xmm2
lea edx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.005b40e0
test ebx, ebx
jne 0x5b4b3a
xor eax, eax
jmp 0x5b4bd7
lea rdx, [0x0073e6e0]
mov rcx, rdi
mov qword [rsp + AfxDaoInit], r12
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x5b4bcd
mov qword [rsp + 0x470], rsi
test ebx, ebx
jle 0x5b4b71
mov edi, 0x400
cmp ebx, edi
cmovl edi, ebx
jmp 0x5b4b76
mov edi, 0x400
lea rcx, [rsp + 0x50]
movsxd r8, edi
mov r9, r12
mov edx, 1
call sub.msvcrt.dll_fread
test eax, eax
mov rsi, rax
jle 0x5b4bae
cvtsi2sd xmm2, eax
lea rcx, [rsp + 0x50]
mov edx, edi
call fcn.005b40e0
add ebp, esi
test ebx, ebx
jle 0x5b4b61
sub ebx, edi
test ebx, ebx
jg 0x5b4b61
mov rcx, r12
call sub.msvcrt.dll_fclose
lea rcx, [rsp + 0x50]
mov edx, 0x400
call fcn.005db820
mov rsi, qword [rsp + 0x470]
mov r12, qword [rsp + 0x460]
mov eax, ebp
mov rdi, qword [rsp + 0x468]
mov rbp, qword [rsp + 0x498]
mov rbx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x450]
call fcn.00693b90
add rsp, 0x478
ret

Function at 0x5b4d90
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor ebx, ebx
mov qword [rsp + 0x48], rdi
mov rbp, rdx
mov rdi, rbx
mov rsi, rcx
call fcn.0060a3c0
test eax, eax
jne 0x5b4e1d
lea rcx, str.RANDFILE
call sub.msvcrt.dll_getenv
test rax, rax
mov rdi, rax
je 0x5b4e1d
cmp byte [rax], bl
je 0x5b4e1d
mov rdx, rax
mov ecx, ebx
cmp ecx, 0x80000000
jae 0x5b4df3
inc rdx
inc ecx
cmp byte [rdx], bl
jne 0x5b4de2
btr ecx, 0x1f
lea eax, [rcx + 1]
cmp rax, rbp
jae 0x5b4e1d
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.005d24d0
cmp rax, rbp
jb 0x5b4ec7
xor eax, eax
jmp 0x5b4eca
call fcn.0060a3c0
test eax, eax
jne 0x5b4e35
lea rcx, str.HOME
call sub.msvcrt.dll_getenv
mov rdi, rax
test rdi, rdi
lea rdx, [0x0073e704]
cmovne rdx, rdi
cmp byte [rdx], bl
je 0x5b4ec4
mov rcx, rdx
mov eax, ebx
nop
cmp eax, 0x80000000
jae 0x5b4e60
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x5b4e50
cmp byte [reloc.WLDAP32.dll_Ordinal_46], bl
lea rcx, [0x0073e708]
je 0x5b4e82
nop
cmp ebx, 0x80000000
jae 0x5b4e82
inc rcx
inc ebx
cmp byte [rcx], 0
jne 0x5b4e70
btr ebx, 0x1f
btr eax, 0x1f
lea ecx, [rbx + rax + 2]
cmp rcx, rbp
jae 0x5b4ec4
mov r8, rbp
mov rcx, rsi
call fcn.005d24d0
lea rdx, [0x0073e710]
mov r8, rbp
mov rcx, rsi
call fcn.005d2530
lea rdx, str..rnd
mov r8, rbp
mov rcx, rsi
call fcn.005d2530
jmp 0x5b4ec7
mov byte [rsi], 0
mov rax, rsi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x5bb880
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.00693bc0
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test rax, rax
je 0x5bb8aa
mov rcx, rax
add rsp, 0x28
jmp fcn.005d2680
call fcn.00610880
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x5bb8c8
cmp ecx, 0x80000000
jae 0x5bb8c8
inc rax
inc ecx
cmp byte [rax], dl
jne 0x5bb8b7
btr ecx, 0x1f
lea rax, [0x0073ed90]
inc ecx
cmp byte [reloc.WS2_32.dll_WSAGetLastError], dl
je 0x5bb8f2
nop
cmp edx, 0x80000000
jae 0x5bb8f2
inc rax
inc edx
cmp byte [rax], 0
jne 0x5bb8e0
btr edx, 0x1f
mov qword [rsp + 0x40], rbx
mov r8d, 0x231
lea ebx, [rdx + rcx + 1]
lea rdx, [0x0073eda0]
mov qword [rsp + 0x48], rdi
mov ecx, ebx
call fcn.005bde70
test rax, rax
mov rdi, rax
jne 0x5bb92f
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
movsxd rbx, ebx
call fcn.00610880
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.005d24d0
lea rdx, [0x0073edbc]
mov r8, rbx
mov rcx, rdi
call fcn.005d2530
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call fcn.005d2530
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
Function at 0x5c72a0
Capabilities:
Encode data using xor

Disassembly:
movsxd r10, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
shr rbx, 0x3f
mov qword [rsp + 0x18], rsi
xor rcx, r10
dec rbx
movsxd rsi, r9d
and rcx, rbx
lea eax, [rsi - 1]
mov qword [rsp + 0x20], rdi
xor r10d, ecx
mov r11, r8
mov rdi, rdx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x5c72f7
lea rdx, [0x00400000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1c74a0]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x5c72f7.10
nop
nop
nop
mov rax, qword [r11]
mov r8, qword [rdi]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rsi
jl 0x5c7310
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x18]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x20]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 0x10]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x5ca860
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.00693bc0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call sub.msvcrt.dll_memset
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x5caf60
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.00693bc0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call sub.msvcrt.dll_memset
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x5cc050
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.00693bc0
sub rsp, rax
cmp dword [0x007756e0], 0
jne 0x5cc114
lea rcx, str.OPENSSL_ia32cap
mov dword [0x007756e0], 1
call sub.msvcrt.dll_getenv
test rax, rax
je 0x5cc0f4
mov qword [rsp + 0x40], rbx
xor ebx, ebx
cmp byte [rax], 0x7e
sete bl
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x30]
movsxd rdi, ebx
lea rdx, str._I64i
add rdi, rax
mov rcx, rdi
call sub.msvcrt.dll_sscanf
test eax, eax
jne 0x5cc0cc
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_strtoul
mov r11d, eax
mov qword [rsp + 0x30], r11
jmp 0x5cc0d1
mov r11, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
test ebx, ebx
mov rbx, qword [rsp + 0x40]
je 0x5cc0fc
call fcn.005db6b0
mov r11, rax
mov rax, qword [rsp + 0x30]
not rax
and r11, rax
jmp 0x5cc0fc
call fcn.005db6b0
mov r11, rax
mov ecx, r11d
bts ecx, 0xa
shr r11, 0x20
mov dword [0x00775ff0], ecx
mov dword [0x00775ff4], r11d
add rsp, 0x28
ret
Function at 0x5cc290
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [rbx + 0x40]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov eax, 0x280
call fcn.00693bc0
sub rsp, rax
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x220], rdi
mov rax, qword [0x0072f1d0]
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x5cc314
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5cc314
lea rbx, [rbp + 0x248]
call sub.msvcrt.dll___iob_func
mov rdx, qword [rbp + 0x240]
lea rcx, [rax + 0x60]
mov r8, rbx
call sub.msvcrt.dll_vfprintf
jmp 0x5cc4ac
mov r8, qword [rbp + 0x240]
mov rcx, r8
call fcn.005cba50
inc eax
mov edi, eax
lea rax, [rax + rax + 0xf]
and rax, 0xfffffffffffffff0
call fcn.00693bc0
sub rsp, rax
lea rbx, [rsp + 0x50]
test rbx, rbx
jne 0x5cc34e
lea rbx, str.no_stack_
jmp 0x5cc3fa
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x5cc389
xor edx, edx
test rdi, rdi
je 0x5cc389
nop
mov rax, qword [rbp + 0x240]
inc rdx
cmp rdx, rdi
movsx ecx, byte [rdx + rax - 1]
mov word [rbx + rdx*2 - 2], cx
jb 0x5cc370
xor edx, edx
test rdi, rdi
je 0x5cc3fa
lea r9, [0x00400000]
cmp word [rbx + rdx*2], 0x25
jne case.0x5cc3c5.47
lea r8, [rbx + rdx*2 + 2]
movzx eax, word [r8]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x5cc3c5.47
cdqe
movzx eax, byte [r9 + rax + 0x1cc4e8]
mov ecx, dword [r9 + rax*4 + 0x1cc4d0]
add rcx, r9
jmp rcx
inc rdx
add r8, 2
jmp 0x5cc3a3
mov word [rbx + rdx*2 + 2], 0x53
jmp case.0x5cc3c5.47
mov word [rbx + rdx*2 + 2], reloc.WS2_32.dll_WSAStartup
jmp case.0x5cc3c5.47
mov word [rbx + rdx*2 + 2], 0x43
jmp case.0x5cc3c5.47
mov word [rbx + rdx*2 + 2], 0x63
inc rdx
cmp rdx, rdi
jb 0x5cc397
lea r9, [rbp + 0x248]
lea rcx, [rbp + 0x10]
mov r8, rbx
mov edx, 0xff
call sub.msvcrt.dll__vsnwprintf
mov word [rbp + 0x20e], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x5cc493
call fcn.005cc120
test eax, eax
jle 0x5cc493
lea rdx, str.OPENSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rsp + 0x40], 0
xor r9d, r9d
mov rbx, rax
lea rax, [rbp + 0x10]
xor r8d, r8d
mov qword [rbp], rax
lea rax, [rbp]
mov dx, 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov rcx, rbx
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x5cc4ac
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
call fcn.00693b90
mov rbx, qword [rbp + 0x228]
mov rdi, qword [rbp + 0x220]
lea rsp, [rbp + 0x230]
pop rbp
ret

Function at 0x5cc5a0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x5cc5c2
sub rdx, rcx
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
xor al, byte [rcx - 1]
or r9b, al
dec r8
jne 0x5cc5b0
movzx eax, r9b
ret
Function at 0x5ccf10
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
test rcx, rcx
mov r9, rcx
je 0x5ccf67
movzx eax, byte [rcx]
test al, al
je 0x5ccf67
mov r10d, 0x100
nop
nop
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
mov al, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x5ccf30
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x5ecf40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0xf8
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xc0], r14
xor eax, eax
test r9, r9
mov qword [rsp + 0xb8], r15
mov r15, qword [rsp + 0x120]
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
je 0x5ecfa9
mov eax, 1
mov qword [rcx], r9
jmp 0x5ecfac
mov r12, qword [rcx]
test rdx, rdx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xc8], r13
je 0x5ed0a5
mov rcx, r12
call fcn.005b4460
mov ebx, 0x80
cmp eax, ebx
mov ebp, eax
jle 0x5ecff6
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x18]
lea rcx, [0x0074f9a0]
call fcn.005cc540
cmp ebp, edi
jge 0x5ed04c
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.005d27f0
test eax, eax
je 0x5ed190
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.005d2a60
test eax, eax
je 0x5ed190
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.005d2a80
test eax, eax
je 0x5ed190
jmp 0x5ed088
test edi, edi
js 0x5ed054
cmp edi, ebx
jle 0x5ed06c
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x75
call fcn.005cc540
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call sub.msvcrt.dll_memcpy
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x5ed0ad
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
jmp 0x5ed0ad
test eax, eax
je 0x5ed17f
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop
nop
nop
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
dec r8
mov byte [rcx - 2], al
jne 0x5ed0d0
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.005d27f0
test eax, eax
je 0x5ed190
mov rcx, r12
call fcn.005b4460
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.005d2a60
test eax, eax
je 0x5ed190
lea rdx, [rsp + 0x21]
nop
nop
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
dec rdi
mov byte [rdx - 2], al
jne 0x5ed130
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.005d27f0
test eax, eax
je 0x5ed190
mov rcx, r12
call fcn.005b4460
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.005d2a60
test eax, eax
je 0x5ed190
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.005d2d80
test eax, eax
jne 0x5ed194
xor eax, eax
jmp 0x5ed199
mov eax, 1
mov r15, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call fcn.00693b90
add rsp, 0xf8
ret