joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013d480
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x102d42a4]
xor edx, edx
cmp eax, edx
jne 0x1013d4a6
xor eax, eax
mov byte [eax + 0x102d41a4], al
inc eax
cmp eax, 0x100
jl 0x1013d48e
mov dword [0x102d42a4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x102d41a4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1013d537
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1013d50a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1013d4d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1013d540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1013d593
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1013d57a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10143f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1017607e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.10144840
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x10246a7c
call fcn.101642f5
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x10143fb3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.101642f5
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x10143fac
push 0
mov ecx, eax
call fcn.1013b0c0
mov dword [esi + 0xc], eax
jmp 0x10143fb5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x10143fb5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x10166994
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x101669cc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10164a0f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.101649e7
jmp 0x101669d8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1016818b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x101681cd
call fcn.1016e916
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x101681cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x101681c4
xor eax, eax
jmp 0x101681d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.101681db
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x70a4338c
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp edi, 0x3ffffffe
ja 0x70a4348c
lea ecx, [edi + 2]
mov edx, 0x55555556
mov eax, ecx
imul edx
sar ecx, 0x1f
sub edx, ecx
shl edx, 2
cmp edx, dword [esp + 0x18]
jge 0x70a4348c
mov edx, esi
cmp edi, 3
jle 0x70a43429
lea esi, [esi]
mov ecx, dword [ebx]
rol cx, 8
rol ecx, 0x10
rol cx, 8
add ebx, 3
sub edi, 3
mov eax, ecx
shr eax, 0x1a
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov eax, ecx
shr eax, 0x14
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0xe
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
shr ecx, 8
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 3], cl
add edx, 4
cmp edi, 3
jg 0x70a433d0
test edi, edi
je 0x70a43478
lea ecx, [ebx + edi]
xor eax, eax
nop
shl eax, 8
movzx ebp, byte [ebx]
add eax, ebp
inc ebx
cmp ebx, ecx
jne 0x70a43434
lea ecx, [edi*8]
test ecx, ecx
jle 0x70a43478
mov ebx, eax
shl ebx, 6
lea esi, [esi]
mov eax, ebx
shr eax, cl
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
inc edx
sub ecx, 6
test ecx, ecx
jg 0x70a43454
mov eax, edx
sub eax, esi
test al, 3
je 0x70a43480
nop
mov byte [edx], 0x3d
inc edx
mov eax, edx
sub eax, esi
test al, 3
jne 0x70a43474
mov byte [edx], 0
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x70a44310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
lea eax, [ecx - 8]
cmp eax, 0x18
ja 0x70a44343
xor eax, eax
xor edx, edx
test cl, 0x20
sete al
setne dl
shl eax, cl
shl edx, cl
xor ebp, ebp
cmp ebp, edx
jle 0x70a4434d
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
jge 0x70a444c3
cmp dword [esp + 0x24], 0x404
je 0x70a44367
cmp dword [esp + 0x24], 0x1000
jne 0x70a44343
mov eax, 0x20
sub eax, ecx
mov edx, ebx
mov cl, al
shl edx, cl
mov eax, edx
xor edx, edx
mov ecx, eax
jmp 0x70a443f0
and eax, 1
neg eax
and eax, ebx
mov ebp, edx
shr ebp, 1
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov ebp, eax
shr ebp, 1
and eax, 1
neg eax
and eax, ebx
xor eax, ebp
mov dword [esi + edx*4], eax
inc edx
cmp edx, 0x100
je 0x70a44460
mov eax, edx
test edi, edi
jne 0x70a4437c
shl eax, 0x18
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
lea ebp, [eax + eax]
sar eax, 0x1f
and eax, ecx
xor eax, ebp
rol ax, 8
rol eax, 0x10
rol ax, 8
mov dword [esi + edx*4], eax
inc edx
cmp edx, 0x100
jne 0x70a443f0
mov dword [esi + 0x400], 1
cmp dword [esp + 0x24], 0xfff
jbe 0x70a444bc
mov eax, esi
lea ebx, [esi + 0x400]
mov ecx, dword [eax]
movzx edx, cl
shr ecx, 8
xor ecx, dword [esi + edx*4]
mov dword [eax + 0x400], ecx
mov edx, ecx
shr edx, 8
and ecx, 0xff
xor edx, dword [esi + ecx*4]
mov dword [eax + 0x800], edx
mov ecx, edx
shr ecx, 8
and edx, 0xff
xor ecx, dword [esi + edx*4]
mov dword [eax + 0xc00], ecx
add eax, 4
cmp eax, ebx
jne 0x70a4447c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, eax
jae 0x70a44343
jmp 0x70a44353
Function at 0x70a4453c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add ebp, edx
mov ebx, dword [ecx + 0x400]
test ebx, ebx
jne 0x70a445e8
test dl, 3
je 0x70a44587
cmp edx, ebp
jb 0x70a44574
jmp 0x70a44587
cmp edx, ebp
je 0x70a44587
mov bl, al
xor bl, byte [edx]
movzx ebx, bl
shr eax, 8
xor eax, dword [ecx + ebx*4]
inc edx
test dl, 3
jne 0x70a44570
lea ebx, [ebp - 3]
mov esi, edx
cmp edx, ebx
jae 0x70a445e8
mov dword [esp], ebp
mov dword [esp + 4], edx
mov edx, ebx
lea esi, [esi]
mov ebx, dword [esi]
xor ebx, eax
add esi, 4
mov edi, ebx
shr edi, 0x10
and edi, 0xff
movzx eax, bl
mov ebp, ebx
shr ebp, 0x18
mov eax, dword [ecx + eax*4 + 0xc00]
xor eax, dword [ecx + ebp*4]
movzx ebx, bh
xor eax, dword [ecx + ebx*4 + 0x800]
xor eax, dword [ecx + edi*4 + 0x400]
cmp esi, edx
jb 0x70a4459c
mov ebp, dword [esp]
mov edx, dword [esp + 4]
lea ebx, [ebp - 4]
sub ebx, edx
shr ebx, 2
lea edx, [edx + ebx*4 + 4]
cmp ebp, edx
jbe 0x70a445fe
mov bl, al
xor bl, byte [edx]
movzx ebx, bl
shr eax, 8
xor eax, dword [ecx + ebx*4]
inc edx
cmp edx, ebp
jne 0x70a445ec
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x70a48da4
Capabilities:
Read file via mapping

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov edi, dword [esp + 0xf0]
mov esi, dword [esp + 0xf4]
mov ebp, dword [esp + 0xf8]
mov dword [esp + 0x20], 0x70a63180
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x28], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._open
mov ebx, eax
mov dword [esi], 0
test eax, eax
js 0x70a48ebc
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._fstat
test eax, eax
js 0x70a48f10
mov eax, dword [esp + 0x40]
mov dword [ebp], eax
mov dword [esp], ebx
call sym.__get_osfhandle
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._CreateFileMappingA_24
sub esp, 0x18
mov edi, eax
test eax, eax
je 0x70a48f66
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call sym._MapViewOfFile_20
sub esp, 0x14
mov ebp, eax
mov dword [esp], edi
call sym._CloseHandle_4
push eax
test ebp, ebp
je 0x70a48f94
mov dword [esi], ebp
mov dword [esp], ebx
call sym._close
xor esi, esi
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
mov esi, dword [eax]
neg esi
mov dword [esp + 8], pe_nt_image_headers32
lea ebx, [esp + 0x50]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.avutil_ttv_51.dll_av_strerror
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x70a63080
mov dword [esp + 4], 0x10
lea eax, [esp + 0x20]
mov dword [esp], eax
call sym.avutil_ttv_51.dll_av_log
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
mov esi, dword [eax]
neg esi
mov dword [esp + 8], pe_nt_image_headers32
lea edi, [esp + 0x50]
mov dword [esp + 4], edi
mov dword [esp], esi
call sym.avutil_ttv_51.dll_av_strerror
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Error_occurred_in_fstat__:__s_n
mov dword [esp + 4], 0x10
lea eax, [esp + 0x20]
mov dword [esp], eax
call sym.avutil_ttv_51.dll_av_log
mov dword [esp], ebx
call sym._close
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.Error_occurred_in_CreateFileMapping___n
mov dword [esp + 4], 0x10
lea eax, [esp + 0x20]
mov dword [esp], eax
call sym.avutil_ttv_51.dll_av_log
mov dword [esp], ebx
call sym._close
mov esi, 0xffffffff
jmp 0x70a48eae
mov dword [esp + 8], str.Error_occurred_in_MapViewOfFile___n
jmp 0x70a48f6e
Function at 0x70a4ad84
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x48
mov ebx, eax
mov ecx, dword [0x70a5f008]
test ecx, ecx
js 0x70a4ae10
cmp ecx, 1
je 0x70a4ade0
cmp ecx, 0x100
je 0x70a4ade0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._fputs
mov edx, dword [0x70a5f008]
test edx, edx
je 0x70a4adda
movzx eax, word [0x70a72a88]
mov dword [esp + 4], eax
mov eax, dword [0x70a72a84]
mov dword [esp], eax
call sym._SetConsoleTextAttribute_8
sub esp, 8
add esp, 0x48
pop ebx
ret
movzx eax, byte [ebx + 0x70a63768]
or ax, word [0x70a72a8a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0x70a72a84]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sym._SetConsoleTextAttribute_8
sub esp, 8
mov edx, dword [esp + 0x1c]
jmp 0x70a4ada1
mov dword [esp], 0xfffffff4
mov dword [esp + 0x1c], edx
call sym._GetStdHandle_4
push ecx
mov dword [0x70a72a84], eax
inc eax
mov edx, dword [esp + 0x1c]
je 0x70a4ae41
mov dword [esp], str.NO_COLOR
call sym._getenv
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x70a4ae50
mov dword [0x70a5f008], 0
jmp 0x70a4ada1
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sym._getenv
test eax, eax
mov edx, dword [esp + 0x1c]
jne 0x70a4ae41
mov dword [0x70a5f008], 1
lea eax, [esp + 0x2a]
mov dword [esp + 4], eax
mov eax, dword [0x70a72a84]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sym._GetConsoleScreenBufferInfo_8
push eax
push eax
mov ax, word [esp + 0x32]
mov word [0x70a72a88], ax
and eax, 0xf0
mov word [0x70a72a8a], ax
mov ecx, dword [0x70a5f008]
mov edx, dword [esp + 0x1c]
jmp 0x70a4ad94
Function at 0x70a4ce80
Capabilities:
Hash data with md5

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebp, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
mov dword [esp + 0x58], 0x10325476
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x67452301
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
test eax, eax
jle 0x70a4d015
mov cl, byte [edx]
mov byte [esp + 0x18], cl
lea ebx, [edx + 1]
lea ecx, [edx + eax]
mov eax, 1
lea edi, [esp + 0x18]
lea esi, [esp + 0x58]
cmp ebx, ecx
je 0x70a4cf05
mov dl, byte [ebx]
mov byte [esp + eax + 0x18], dl
inc eax
cmp eax, 0x40
je 0x70a4cffc
inc ebx
cmp ebx, ecx
jne 0x70a4cef0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, ecx
mov edx, ebx
shld edx, eax, 3
shl eax, 3
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, ecx
and eax, 0x3f
add ecx, 1
adc ebx, 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov byte [esp + eax + 0x18], pe_nt_image_headers32
cmp eax, 0x3f
je 0x70a4cf62
lea esi, [esi]
mov eax, ecx
and eax, 0x3f
cmp eax, 0x38
je 0x70a4cf80
add ecx, 1
adc ebx, 0
mov byte [esp + eax + 0x18], 0
cmp eax, 0x3f
jne 0x70a4cf40
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov edx, edi
mov eax, esi
call sym._body
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, ecx
and eax, 0x3f
cmp eax, 0x38
jne 0x70a4cf4a
lea esi, [esi]
add ecx, 8
adc ebx, 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov cl, byte [esp + 8]
mov byte [esp + 0x50], cl
mov al, byte [esp + 9]
mov byte [esp + 0x51], al
mov dl, byte [esp + 0xa]
mov byte [esp + 0x52], dl
mov cl, byte [esp + 0xb]
mov byte [esp + 0x53], cl
mov al, byte [esp + 0xc]
mov byte [esp + 0x54], al
mov dl, byte [esp + 0xd]
mov byte [esp + 0x55], dl
mov cl, byte [esp + 0xe]
mov byte [esp + 0x56], cl
mov al, byte [esp + 0xf]
mov byte [esp + 0x57], al
mov edx, edi
mov eax, esi
call sym._body
mov eax, dword [esp + 0x64]
mov dword [ebp], eax
mov eax, dword [esp + 0x60]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [ebp + 0xc], eax
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, edi
mov eax, esi
mov dword [esp + 4], ecx
call sym._body
xor eax, eax
mov ecx, dword [esp + 4]
inc ebx
jmp 0x70a4cf01
lea edi, [esp + 0x18]
lea esi, [esp + 0x58]
jmp 0x70a4cf0d
Function at 0x70a4ed34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4ed5c
cmp dword [edx + 0xc], 0
jne 0x70a4ed5c
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret

Function at 0x70a4ed64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4ed8c
cmp dword [edx + 0xc], 1
jne 0x70a4ed8c
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret

Function at 0x70a4ed94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4edbc
cmp dword [edx + 0xc], 2
jne 0x70a4edbc
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret

Function at 0x70a4edc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4edec
cmp dword [edx + 0xc], 4
jne 0x70a4edec
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret

Function at 0x70a4edf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4ee1c
cmp dword [edx + 0xc], 3
jne 0x70a4ee1c
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret

Function at 0x70a4ee24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x70a4ee4c
cmp dword [edx + 0xc], 6
jne 0x70a4ee4c
mov dword [esp + 8], ebx
pop ebx
jmp sym._set_string_number
mov eax, 0xffffffea
pop ebx
ret
Function at 0x70a52f6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov edx, dword [eax + 0x100]
mov byte [esp + 2], dl
mov cl, byte [eax + 0x104]
mov byte [esp], cl
mov ebx, dword [esp + 0x28]
dec ebx
mov dword [esp + 4], ebx
mov ecx, dword [esp + 0x28]
test ecx, ecx
jle 0x70a5300c
mov bl, dl
and edx, 0xff
mov cl, byte [eax + edx]
xor edx, edx
inc ebx
mov byte [esp + 3], bl
lea esi, [esi]
mov byte [esp + 1], dl
movzx edi, byte [esp]
mov bl, byte [eax + edi]
lea ebp, [ebx + ecx]
mov byte [eax + edi], cl
mov cl, byte [esp + 2]
add ecx, edx
movzx ecx, cl
mov byte [eax + ecx], bl
and ebp, 0xff
mov cl, byte [eax + ebp]
test esi, esi
je 0x70a52fe1
xor cl, byte [esi]
inc esi
mov ebx, dword [esp + 0x20]
mov byte [ebx + edx], cl
mov bl, byte [esp + 1]
add bl, byte [esp + 3]
movzx ebx, bl
mov cl, byte [eax + ebx]
add byte [esp], cl
inc edx
cmp edx, dword [esp + 0x28]
jne 0x70a52fb4
mov dl, byte [esp + 3]
add edx, dword [esp + 4]
mov byte [esp + 2], dl
movzx edx, byte [esp + 2]
mov dword [eax + 0x100], edx
movzx edx, byte [esp]
mov dword [eax + 0x104], edx
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x70a55afc
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, edx
sar ecx, 5
mov byte [eax], cl
cmp edx, 0xe0
je 0x70a55bb0
cmp edx, 0x100
je 0x70a55b6c
cmp edx, 0xa0
je 0x70a55b30
mov eax, 0xffffffff
ret
mov dword [eax + 0x50], 0x67452301
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
mov dword [eax + 0x70], sym._sha1_transform
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
xor eax, eax
ret
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
mov dword [eax + 0x70], sym._sha256_transform
jmp 0x70a55b5a
mov dword [eax + 0x50], 0xc1059ed8
mov dword [eax + 0x54], 0x367cd507
mov dword [eax + 0x58], 0x3070dd17
mov dword [eax + 0x5c], 0xf70e5939
mov dword [eax + 0x60], 0xffc00b31
mov dword [eax + 0x64], 0x68581511
mov dword [eax + 0x68], 0x64f98fa7
mov dword [eax + 0x6c], 0xbefa4fa4
mov dword [eax + 0x70], sym._sha256_transform
jmp 0x70a55b5a

Function at 0x70a560b4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov esi, dword [eax + 0x10]
mov ebx, dword [eax + 4]
mov dword [esp + 0x30], ebx
mov ecx, dword [eax]
add ecx, dword [esp + 0x68]
and ebx, 1
mov dword [esp + 0x34], ebx
je 0x70a560ea
cmp esi, 0x1e
je 0x70a561b8
cmp esi, 0x3c
invalid
Function at 0x70a563b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebx + 0x318b0441], 1
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x70a563c8
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x70a563b9
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.70a56174
sbb dh, dh
fbstp tbyte [edx]
lea eax, [ebp - 0x58]
push eax
call fcn.70a56184
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.70a56139
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x70a56462
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
invalid
invalid
cld