joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fee83
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test byte [esi + 4], 1
push edi
mov dword [ebp - 4], ebx
je 0x100fee9d
mov edi, dword [esi + 0xc]
jmp 0x100feedd
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100feeb6
call fcn.10019127
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100feecb
call fcn.10019127
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100feedd
call fcn.10019127
call fcn.1000b1f4
cmp dword [eax + 0x3c], 0
je 0x100feef2
push edi
mov ecx, ebx
call fcn.100fe7a7
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100ff0b5
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7c]
test ecx, ecx
je 0x100fef15
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x7c], 0
test ebx, ebx
je 0x100fef1e
mov edi, ebx
mov dword [eax + 0x7c], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012e9a7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101b08a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10126336
mov dword [ebp - 0x14], eax
cmp dword [0x101b954c], edi
jne 0x1012ea98
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1012ea25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1012eb78
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1012eb78
push 0x101878c0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1012eb78
push eax
call ebx
push 0x101878cc
push esi
mov dword [0x101b954c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x101878dc
push esi
mov dword [0x101b9550], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101b9554], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101b955c], eax
test eax, eax
je 0x1012ea95
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101b9558], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1012eabd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1012eab0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1012ead2
push 4
pop eax
jmp 0x1012eb7a
cmp dword [ebp - 0x14], edi
je 0x1012ead2
push dword [0x101b954c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1012eab7
mov eax, dword [0x101b9558]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1012eb30
cmp dword [0x101b955c], esi
je 0x1012eb30
push eax
call ebx
push dword [0x101b955c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1012eb30
test eax, eax
je 0x1012eb30
call ecx
test eax, eax
je 0x1012eb25
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1012eb25
test byte [ebp - 8], 1
jne 0x1012eb30
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1012eb60
mov eax, dword [0x101b9550]
cmp eax, esi
je 0x1012eb5d
push eax
call ebx
test eax, eax
je 0x1012eb5d
call eax
mov edi, eax
test edi, edi
je 0x1012eb5d
mov eax, dword [0x101b9554]
cmp eax, esi
je 0x1012eb5d
push eax
call ebx
test eax, eax
je 0x1012eb5d
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101b954c]
call ebx
test eax, eax
je 0x1012eb78
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1012eb7a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011b77f
leave
ret
Function at 0x44a410
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
call ebx
shl dword [esi - 0x7b], cl
invalid
jge 0x44a43a
or dword [esi], 0x2000000
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a457
or dword [esi], 0x4000000
test edi, edi
je 0x44a46d
mov ecx, dword [0x651cf4]
push 0x651a28
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a47c
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x526540
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
add dl, 0x30
movzx eax, bl
mov byte [edi + eax], dl
mov ecx, 0xa
mov eax, esi
cdq
idiv ecx
mov esi, eax
dec ebx
test esi, esi
jne 0x526504
mov bl, 0x1c
mov esi, dword [0x797004]
int3
arpl di, si
cwde
aaa
in al, dx
lodsb al, byte [esi]
sahf
daa
xchg ebx, eax
call 0x1695d429
sbb al, 0x77
mov edi, 0x553f8021
fdiv st(6), st(0)
mov cs, word [ebp - 0xf]
mov esp, 0x97e626fa
xor eax, 0x5c09f55a
mov ebx, dword [ecx + esi*8 + 0x288db0fa]
clc
pop ss
adc byte [esp + esi*2], al
mov byte [edi - 0x45], 0xbb
xchg byte [ecx*8 + 0x1e07c471], ch
push ebx
pop eax
ficom word [ebp + 0x7797c23a]
aas
dec ebp
and byte [esi - 0x72], cl
aam 0xff
push ebp
mov ch, 0x1f
sub edx, esp
ja 0x52654e
jne 0x52660a
jl 0x52651f
invalid
mov al, byte [0xce926c98]
add al, byte [0x75f84dfc]
cli
dec ebp
or ch, al
jecxz 0x526640
pop ebx
fucomi st(5)
add dl, byte fs:[0x41b90dfc]
mov eax, dword [0xa88afad0]
frstor dword [edi + 0x22]
popfd
adc byte [ebp - 0x43], dh
sub ch, byte [eax + 0x35]
loope 0x526661
xor dh, byte [ecx - 0x3c]
add dword [ecx + edi*8 - 0x30], ebx
sbb bl, byte [0x39f5fe74]
pop esp
mov eax, dword [ecx + 0x6089fac5]
aad 0xba
das
sbb byte [edi - 0x420639c6], dl
rol byte [edi], 0x5f
sbb byte [ecx + 0x66254541], 0xd0
dec ebx
call 0x33b6df5f
aaa
invalid
xor esi, dword fs:[edi]
ret
Function at 0x60532a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push edx
push eax
push 0
mov ebx, edx
xor edi, edi
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x60534c
cmp dword [eax], ecx
jne 0x60534c
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x60534e
xor eax, eax
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x605366
add eax, dword [ecx - 4]
test eax, 0xc0000000
jne 0x6053d3
cmp edi, ecx
jne 0x605366
xor edi, edi
dec edx
jne 0x60534e
test edi, edi
je 0x60538b
mov edx, eax
mov eax, dword [esp + 4]
mov esi, dword [edi - 4]
call fcn.006051ca
mov edi, dword [esp + 4]
mov eax, dword [edi]
mov dword [esp], eax
shl esi, 1
add esi, dword [edi]
dec ebx
jmp 0x605395
call fcn.0060425e
mov dword [esp], eax
mov esi, eax
mov eax, dword [esp + ebx*4 + 0x1c]
mov edx, esi
test eax, eax
je 0x6053ab
mov ecx, dword [eax - 4]
shl ecx, 1
add esi, ecx
call fcn.0060165e
dec ebx
jne 0x605395
mov edx, dword [esp]
mov eax, dword [esp + 4]
test edi, edi
jne 0x6053c5
test edx, edx
je 0x6053c0
dec dword [edx - 8]
call fcn.006046ea
add esp, 8
pop edx
pop edi
pop esi
pop ebx
pop eax
pop eax
lea esp, [esp + edx*4]
jmp eax
jmp fcn.006023ea
Function at 0x635c2c18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.635c297d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.635c2932
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x635c2c5b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.635c296d
arpl word [edx], di
rcl dword [ebx], 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x635c388c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.635c297d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.635c2932
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.635c296d
into
pop ds
imul ecx, eax, 0x10468
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x635c3dcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.635c296d
sbb al, 0xe7
dec ebx
fimul dword [ebp - 0x72b7b]
call dword [eax - 0x18]
pop ss
jmp 0x635c3e64
invalid
Function at 0x635c7f1c
Capabilities:
Read file via mapping

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov edi, dword [esp + 0xf0]
mov esi, dword [esp + 0xf4]
mov ebp, dword [esp + 0xf8]
mov dword [esp + 0xc4], 0x635e33c0
mov eax, dword [esp + 0xfc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0xcc], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll__open
mov ebx, eax
mov dword [esi], 0
test eax, eax
js 0x635c8044
lea eax, [esp + 0xa0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__fstat
test eax, eax
js 0x635c809c
mov eax, dword [esp + 0xb4]
mov dword [ebp], eax
mov dword [esp], ebx
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov edi, eax
test eax, eax
je 0x635c80f5
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov ebp, eax
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
push eax
test ebp, ebp
je 0x635c8126
mov dword [esi], ebp
mov dword [esp], ebx
call sub.msvcrt.dll__close
xor esi, esi
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov esi, dword [eax]
neg esi
mov dword [esp + 8], pe_nt_image_headers32
lea ebx, [esp + 0x20]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.avutil_fb2k_52.dll_av_strerror
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Cannot_read_file__s:__s_n
mov dword [esp + 4], 0x10
lea eax, [esp + 0xc4]
mov dword [esp], eax
call sym.avutil_fb2k_52.dll_av_log
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov esi, dword [eax]
neg esi
mov dword [esp + 8], pe_nt_image_headers32
lea edi, [esp + 0x20]
mov dword [esp + 4], edi
mov dword [esp], esi
call sym.avutil_fb2k_52.dll_av_strerror
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Error_occurred_in_fstat__:__s_n
mov dword [esp + 4], 0x10
lea eax, [esp + 0xc4]
mov dword [esp], eax
call sym.avutil_fb2k_52.dll_av_log
mov dword [esp], ebx
call sub.msvcrt.dll__close
mov eax, esi
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.Error_occurred_in_CreateFileMapping___n
mov dword [esp + 4], 0x10
lea eax, [esp + 0xc4]
mov dword [esp], eax
call sym.avutil_fb2k_52.dll_av_log
mov dword [esp], ebx
call sub.msvcrt.dll__close
mov esi, 0xffffffff
jmp 0x635c8035
mov dword [esp + 8], str.Error_occurred_in_MapViewOfFile___n
jmp 0x635c80fd
Function at 0x635c9eb8
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x48
mov ebx, eax
mov eax, dword [0x635df028]
test eax, eax
js 0x635c9f40
cmp eax, 1
je 0x635c9f10
cmp eax, 0x100
je 0x635c9f10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_fputs
mov eax, dword [0x635df028]
test eax, eax
je 0x635c9f0b
movzx eax, word [0x635f1a88]
mov dword [esp + 4], eax
mov eax, dword [0x635f1a84]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleTextAttribute
sub esp, 8
add esp, 0x48
pop ebx
ret
movzx eax, byte [ebx + 0x635e3608]
or ax, word [0x635f1a8a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0x635f1a84]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.KERNEL32.dll_SetConsoleTextAttribute
sub esp, 8
mov edx, dword [esp + 0x1c]
jmp 0x635c9ed3
mov dword [esp], 0xfffffff4
mov dword [esp + 0x1c], edx
call sub.KERNEL32.dll_GetStdHandle
push ecx
mov dword [0x635f1a84], eax
inc eax
mov edx, dword [esp + 0x1c]
je 0x635c9f71
mov dword [esp], str.NO_COLOR
call sub.msvcrt.dll_getenv
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x635c9f80
mov dword [0x635df028], 0
jmp 0x635c9ed3
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test eax, eax
mov edx, dword [esp + 0x1c]
jne 0x635c9f71
mov dword [0x635df028], 1
lea eax, [esp + 0x2a]
mov dword [esp + 4], eax
mov eax, dword [0x635f1a84]
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
push edx
push edx
mov ax, word [esp + 0x32]
mov word [0x635f1a88], ax
and eax, 0xf0
mov word [0x635f1a8a], ax
mov eax, dword [0x635df028]
mov edx, dword [esp + 0x1c]
jmp 0x635c9ec7
Function at 0x635caaf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x10]
imul ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
pop ebx
jmp sym.avutil_fb2k_52.dll_av_rescale_rnd

Function at 0x635cbcb4
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
push ebx
sub esp, 0x68
mov edi, dword [esp + 0x7c]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x58], 0x10325476
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x67452301
mov dword [esp + 0x10], esi
mov eax, esi
sar eax, 0x1f
mov dword [esp + 0x14], eax
test esi, esi
jle 0x635cbd2c
mov al, byte [edi]
mov byte [esp + 0x18], al
xor ebx, ebx
mov eax, 1
nop
inc ebx
cmp ebx, esi
je 0x635cbd2c
mov dl, byte [edi + ebx]
mov byte [esp + eax + 0x18], dl
inc eax
cmp eax, 0x40
jne 0x635cbd04
lea edx, [esp + 0x18]
lea eax, [esp + 0x58]
call fcn.635cb1b0
xor eax, eax
inc ebx
cmp ebx, esi
jne 0x635cbd09
nop
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call sym.avutil_fb2k_52.dll_av_md5_final
add esp, 0x68
pop ebx
pop esi
pop edi
ret
Function at 0x635ce228
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce250
cmp dword [edx + 0xc], 0
jne 0x635ce250
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x635ce258
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce280
cmp dword [edx + 0xc], 1
jne 0x635ce280
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x635ce288
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce2b0
cmp dword [edx + 0xc], 2
jne 0x635ce2b0
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x635ce2b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce2e0
cmp dword [edx + 0xc], 4
jne 0x635ce2e0
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x635ce2e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce310
cmp dword [edx + 0xc], 3
jne 0x635ce310
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x635ce318
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x635ce340
cmp dword [edx + 0xc], 6
jne 0x635ce340
mov dword [esp + 8], ebx
pop ebx
jmp fcn.635ccff0
mov eax, 0xffffffea
pop ebx
ret
Function at 0x635d2d0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [eax + 0x100]
mov byte [esp + 0xb], dl
mov bl, byte [eax + 0x104]
mov byte [esp + 9], bl
test ecx, ecx
jle 0x635d2dba
dec ecx
mov dword [esp + 0xc], ecx
movzx ecx, dl
mov cl, byte [eax + ecx]
mov ebx, dword [esp + 0xc]
mov dword [esp + 4], ebx
mov byte [esp + 8], dl
mov dword [esp], esi
mov ebx, edi
nop
movzx ebp, byte [esp + 9]
movzx edi, byte [eax + ebp]
lea esi, [edi + ecx]
mov edx, esi
mov byte [esp + 0xa], dl
mov byte [eax + ebp], cl
movzx ecx, byte [esp + 8]
mov edx, edi
mov byte [eax + ecx], dl
movzx ecx, byte [esp + 0xa]
mov cl, byte [eax + ecx]
test ebx, ebx
je 0x635d2d86
xor cl, byte [ebx]
inc ebx
mov esi, dword [esp]
mov byte [esi], cl
inc esi
mov dword [esp], esi
inc byte [esp + 8]
movzx ecx, byte [esp + 8]
mov cl, byte [eax + ecx]
add byte [esp + 9], cl
dec dword [esp + 4]
cmp dword [esp + 4], 0xffffffff
jne 0x635d2d58
mov dl, byte [esp + 0xb]
mov cl, byte [esp + 0xc]
lea edx, [edx + ecx + 1]
mov byte [esp + 0xb], dl
movzx edx, byte [esp + 0xb]
mov dword [eax + 0x100], edx
movzx edx, byte [esp + 9]
mov dword [eax + 0x104], edx
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x635d5a44
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, edx
sar ecx, 5
mov byte [eax], cl
cmp edx, 0xe0
je 0x635d5af8
cmp edx, 0x100
je 0x635d5ab4
cmp edx, 0xa0
je 0x635d5a78
mov eax, 0xffffffff
ret
mov dword [eax + 0x50], 0x67452301
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
mov dword [eax + 0x70], 0x635d3554
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
xor eax, eax
ret
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
mov dword [eax + 0x70], 0x635d4a44
jmp 0x635d5aa2
mov dword [eax + 0x50], 0xc1059ed8
mov dword [eax + 0x54], 0x367cd507
mov dword [eax + 0x58], 0x3070dd17
mov dword [eax + 0x5c], 0xf70e5939
mov dword [eax + 0x60], 0xffc00b31
mov dword [eax + 0x64], 0x68581511
mov dword [eax + 0x68], 0x64f98fa7
mov dword [eax + 0x6c], 0xbefa4fa4
mov dword [eax + 0x70], 0x635d4a44
jmp 0x635d5aa2
Function at 0x635d905c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], 0x635e83c4
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x635d90a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x635d90c4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x635d9174
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x635d9168
cmp eax, 4
je 0x635d9168
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x635d90b9
cmp eax, 4
je 0x635d90b9
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.635d905c