joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522be4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x522c12
mov eax, ebx
call fcn.00523698
cmp dword [ebx + 0x40], 0
je 0x522c0b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x522c83
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x522c75
cmp dword [ebx + 8], 0
je 0x522c34
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x522c46
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x522c75
cmp dword [ebx + 8], 0
je 0x522c27
cmp eax, 3
je 0x522c59
dec eax
jne 0x522c27
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x522c27
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x522c27
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x522ca1
cmp dword [ebx + 0x14], 0xcc
je 0x522ca1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00522cac
pop ebx
ret

Function at 0x53796c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x537984
add esp, 0xfffffff0
call fcn.004053fc
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x537a9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404214
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x537a88
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00533710
xor eax, eax
push ebp
push 0x537a75
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00533710
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407078
jmp 0x537a46
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407620
mov eax, dword [ebx + 4]
call fcn.00407180
dec eax
jle 0x537a5a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x537a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537a7c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537aa5
lea eax, [ebp - 4]
call fcn.00406a58
ret
Function at 0x53d674
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov esi, eax
mov eax, dword [esi + 0x38]
call fcn.00437ad4
test eax, eax
setg bl
test bl, bl
je 0x53d725
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [esi + 0x5c]
call fcn.00406e8c
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
setne bl
test bl, bl
je 0x53d725
mov eax, esi
call fcn.0053def8
cmp edx, 0
jne 0x53d6d0
cmp eax, 0
jbe 0x53d71f
jmp 0x53d6d2
jle 0x53d71f
xor eax, eax
mov dword [esp], eax
push esp
push edi
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
xor eax, eax
or eax, dword [esp + 8]
or edx, dword [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, esi
call fcn.0053def8
cmp edx, dword [esp + 0xc]
jne 0x53d71c
cmp eax, dword [esp + 8]
sete bl
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x54340c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x63c4d0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x54342e
shr eax, 1
xor eax, 0xedb88320
jmp 0x543430
shr eax, 1
dec edx
jne 0x54341c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x543415
mov byte [0x63c8d0], 1
pop esi
pop ebx
ret

Function at 0x54344c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x63c8d0], 0
jne 0x543463
call fcn.0054340c
mov eax, edi
dec eax
test eax, eax
jl 0x54348b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x63c4d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x54346d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x546234
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5462ce.0
jmp dword [ecx*4 + 0x546267]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x546299
sub dl, 8
je 0x5462a8
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545edc
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545f34
jmp case.0x5462ce.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5462ce.0
movzx ecx, byte [ecx + 0x5462d5]
jmp dword [ecx*4 + 0x5462e6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545fe0
jmp case.0x5462ce.0
cmp dl, 3
jne 0x546313
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x546038
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x545ff4
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x54607c
jmp case.0x5462ce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x54633e
sub dl, 8
je 0x54634a
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5460a8
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x546114
jmp case.0x5462ce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x546369
sub dl, 8
je 0x546375
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5461d0
jmp case.0x5462ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5461f8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x546417
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005453e0
test eax, eax
je 0x546417
mov eax, ebx
call fcn.00546420
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x5463b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x546420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x546451
dec al
je 0x54648c
dec al
je 0x5464d1
dec al
je 0x54653a
jmp 0x5465c4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5465c4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x546461
jmp 0x5465c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5465c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x54649c
jmp 0x5465c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5465c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x546500
xor ebp, ebp
jmp 0x546510
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x546519
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5464e1
jmp 0x5465c4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5465c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x546593
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00543494
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x54654e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5767f4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov dword [esp], eax
mov eax, dword [esp]
mov edx, dword [eax + 0x34]
mov eax, dword [edx]
call fcn.0058d430
mov dword [esp + 0x18], eax
xor ebx, ebx
mov edx, dword [esp]
mov eax, dword [esp]
mov ebp, dword [edx + 0x38]
xor edx, edx
mov dl, byte [eax + 5]
mov dword [esp + 8], edx
mov ecx, dword [esp]
movzx eax, word [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp]
movzx ecx, word [edx + 0x10]
mov dword [esp + 0x14], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x34]
mov ecx, dword [edx + 0x24]
xor edx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov bl, byte [ebp + eax + 5]
mov eax, dword [esp + 8]
shl ebx, 8
mov dl, byte [ebp + eax + 6]
or ebx, edx
mov eax, dword [esp + 0x18]
sub ecx, ebx
add eax, ebx
lea edx, [ebx + ebp]
call fcn.0054b5d8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
add eax, eax
xor ecx, ecx
add eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0xc]
add edx, 0xfffffffc
mov dword [esp + 0x20], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jge 0x576932
mov edi, dword [esp + 4]
xor eax, eax
add edi, edi
add edi, dword [esp + 0x10]
add edi, ebp
movzx esi, byte [edi]
shl esi, 8
mov al, byte [edi + 1]
or esi, eax
cmp esi, dword [esp + 0x1c]
jl 0x5768c7
cmp esi, dword [esp + 0x20]
jle 0x5768d6
mov eax, 0x451
call fcn.00565ff0
jmp 0x576990
mov edx, dword [esp + 0x18]
mov eax, dword [esp]
add edx, esi
call fcn.005766dc
movzx eax, ax
sub ebx, eax
cmp ebx, dword [esp + 0x1c]
jl 0x5768f8
lea edx, [eax + esi]
cmp edx, dword [esp + 0xc]
jle 0x576907
mov eax, 0x45d
call fcn.00565ff0
jmp 0x576990
lea ecx, [ebx + ebp]
mov edx, dword [esp + 0x18]
xchg ecx, eax
add edx, esi
call fcn.0054b5d8
mov edx, ebx
sar edx, 8
mov byte [edi], dl
mov byte [edi + 1], bl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jl 0x5768a2
mov eax, dword [esp + 8]
mov edx, ebx
sar edx, 8
mov esi, ebx
mov byte [ebp + eax + 5], dl
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 6], bl
mov eax, dword [esp + 8]
mov byte [ebp + eax + 1], 0
mov edx, dword [esp + 8]
mov byte [ebp + edx + 2], 0
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 7], 0
sub esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add eax, ebp
xor edx, edx
mov ecx, esi
call fcn.0054b5f8
mov edi, dword [esp]
movzx eax, word [edi + 0xe]
cmp esi, eax
je 0x57698e
mov eax, 0x46e
call fcn.00565ff0
jmp 0x576990
xor eax, eax
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x58d760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
add esp, 0xffffffec
mov eax, dword [ebx + 0x3c]
xor ebp, ebp
mov esi, edx
cmp dword [eax], 0
jne 0x58d783
mov ecx, dword [ebx + 0x78]
mov edx, eax
mov eax, ebx
call fcn.0058d2d0
mov ebp, eax
test ebp, ebp
jne 0x58d890
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x24]
jbe 0x58d890
mov eax, dword [ebx + 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x80]
cdq
call fcn.0054b32c
mov dword [esp], eax
mov dword [esp + 4], edx
mov ecx, esp
mov edx, 5
mov eax, dword [ebx + 0x3c]
call fcn.00597ba4
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x24], ecx
jmp 0x58d890
mov edi, dword [esi + 0x14]
cmp edi, dword [ebx + 0x18]
ja 0x58d88d
test byte [esi + 0x18], 0x20
jne 0x58d88d
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
mov eax, edi
dec eax
xor edx, edx
call fcn.0054b32c
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esi + 0x14], 1
jne 0x58d809
mov eax, esi
call fcn.0058cd34
cmp dword [ebx + 0xb0], 0
jne 0x58d81b
mov edx, dword [esi + 4]
mov dword [esp + 0x10], edx
jmp 0x58d83d
push 6
mov ecx, edi
mov edx, dword [esi + 4]
mov eax, dword [ebx + 0xbc]
call dword [ebx + 0xb0]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x58d83d
mov eax, 7
jmp 0x58d89e
push dword [esp + 0xc]
push dword [esp + 0xc]
mov ecx, dword [ebx + 0x80]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x3c]
call fcn.00597b4c
mov ebp, eax
cmp edi, 1
jne 0x58d872
mov edx, dword [esp + 0x10]
add edx, 0x18
lea eax, [ebx + 0x64]
mov ecx, 0x10
call fcn.0054b5d8
cmp edi, dword [ebx + 0x20]
jbe 0x58d87a
mov dword [ebx + 0x20], edi
inc dword [ebx + 0xa8]
mov ecx, dword [esi + 4]
mov edx, edi
mov eax, dword [ebx + 0x58]
call fcn.00589494
mov esi, dword [esi + 0xc]
test ebp, ebp
jne 0x58d89c
test esi, esi
jne 0x58d7cb
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x59091c
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
jle 0x59093d
mov ebx, ecx
shl ebx, 3
xor ecx, ebx
xor ebx, ebx
mov bl, byte [eax]
inc eax
movzx ebx, byte [ebx + 0x62e1f0]
xor ecx, ebx
dec edx
test edx, edx
jg 0x590923
mov eax, ecx
pop ebx
ret
Function at 0x59ee0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0xf8]
call fcn.0059ef70
lea ecx, [ebp - 0xf8]
mov edx, edi
mov eax, esi
call fcn.0059ef80
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x1a4]
mov ecx, 0xac
call fcn.0054b5d8
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp + 0x14]
mov eax, ebx
call fcn.0059eff0
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
shr eax, 5
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x59ef64
lea eax, [ebp - 0x4c]
mov ecx, 0x20
xor edx, edx
call fcn.0054b5f8
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.0054b5d8
mov eax, dword [ebp - 4]
mov ebx, 4
inc eax
mov edx, eax
mov ecx, eax
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x2c], dl
shr eax, 8
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], al
xor edx, edx
mov al, byte [ebp - 4]
inc eax
mov byte [ebp - 0x29], al
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x59ef2a
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0059eff0
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, 0x20
call fcn.0059f084
xor ebx, ebx
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov cl, byte [eax]
xor byte [edx], cl
inc ebx
inc edx
inc eax
cmp ebx, 0x20
jb 0x59eefd
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.0054b5d8
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jb 0x59eed2
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
shl ebx, 5
mov eax, dword [ebp + 0xc]
lea edx, [eax + ebx]
lea eax, [ebp - 0x4c]
jmp 0x59ef4a
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc ebx
inc dword [ebp - 8]
inc edx
cmp dword [ebp - 8], 0x20
jae 0x59ef55
cmp ebx, dword [ebp + 8]
jb 0x59ef40
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x59ee7a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x59eff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
push ecx
mov dword [esp], eax
mov eax, dword [ebx + 0xa8]
mov esi, edx
cmp eax, 0xffffffff
je 0x59f06e
cmp eax, 0x40
jbe 0x59f01f
lea edx, [ebx + 0x40]
mov eax, ebx
call fcn.005a027c
mov dword [ebx + 0xa8], 0x20
mov ecx, 0x40
mov eax, dword [ebx + 0xa8]
sub ecx, dword [ebx + 0xa8]
add eax, ebx
xor edx, edx
call fcn.0054b5f8
xor edx, edx
mov eax, ebx
xor dword [eax], 0x36363636
inc edx
add eax, 4
cmp edx, 0x10
jb 0x59f03d
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.005a0260
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.005a0070
mov dword [ebx + 0xa8], 0xffffffff
test esi, esi
je 0x59f07f
lea ecx, [ebx + 0x40]
mov edx, esi
mov eax, dword [esp]
call fcn.005a0070
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x59f084
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
cmp dword [ebx + 0xa8], 0xffffffff
je 0x59f0a5
mov ecx, ebx
xor edx, edx
xor eax, eax
call fcn.0059eff0
lea edx, [ebx + 0x40]
lea eax, [esp + 4]
call fcn.005a027c
xor eax, eax
mov edx, ebx
xor dword [edx], 0x6a6a6a6a
inc eax
add edx, 4
cmp eax, 0x10
jb 0x59f0b5
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.005a0260
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.005a0070
mov ecx, edi
lea eax, [esp + 4]
mov edx, 0x20
call fcn.005a0070
mov edx, edi
lea eax, [esp + 4]
call fcn.005a027c
xor eax, eax
mov edx, dword [esp]
mov ecx, edx
lea edx, [esp + 4]
cmp esi, eax
jbe 0x59f111
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp esi, eax
ja 0x59f106
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x5a0260
Capabilities:
Hash data using sha256

Disassembly:
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov edx, 0x634144
add eax, 8
mov ecx, 0x20
call fcn.0054b5d8
ret
Function at 0x608ab4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040488c
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov eax, dword [0x63680c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
call fcn.00406e8c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.00406e8c
mov dword [ebp - 0x3c], eax
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x608b70
mov eax, dword [0x63680c]
mov eax, dword [eax]
call fcn.004c731c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x14], 0
je 0x608b4f
cmp dword [ebp - 0x14], 0x103
je 0x608b4f
mov eax, dword [0x63680c]
mov eax, dword [eax]
call fcn.004c6d1c
cmp dword [ebp - 0x14], 0x103
jne 0x608b68
mov eax, dword [0x63680c]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x608b1b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x608b77
mov dword [ebp - 0x10], 0x2b67
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x6093d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406de8
xor eax, eax
push ebp
push 0x60945c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
xor ecx, ecx
mov edx, 0x1e
call fcn.0040488c
mov dword [ebp - 0x1f], 3
mov word [ebp - 0x13], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x609478
mov edx, dword [ebp - 4]
call fcn.004072e4
mov eax, dword [ebp - 0x28]
call fcn.00406e8c
mov dword [ebp - 0x1b], eax
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x609463
lea eax, [ebp - 0x28]
call fcn.00406df0
lea eax, [ebp - 4]
call fcn.00406df0
ret

Function at 0x609580
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x44ce78]
call fcn.0044e07c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6095df
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0044e164
xor ecx, ecx
mov edx, 0x609604
mov eax, dword [ebp - 0xc]
call fcn.0044e2ac
mov ecx, dword [ebp - 8]
mov edx, 0x609694
mov eax, dword [ebp - 0xc]
call fcn.0044ecdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6095e9
mov eax, dword [ebp - 0xc]
call fcn.00404ec8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret