joyce8/EMBER2024-capa huggingface dataset:
Function at 0x887c5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x887c8d
dec al
je 0x887cc8
dec al
je 0x887d0d
dec al
je 0x887d76
jmp 0x887e00
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x887e00
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x887c9d
jmp 0x887e00
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x887e00
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x887cd8
jmp 0x887e00
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x887e00
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x887d3c
xor ebp, ebp
jmp 0x887d4c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x887d55
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x887d1d
jmp 0x887e00
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x887e00
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x887dcf
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00884e04
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x887d8a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x88c658
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x88c6a9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x88c690
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x88c680
jmp 0x88c6a9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x88c691
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e643c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x8e64d6
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x8e645b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x8e64ec
dec edx
je 0x8e6521
jmp 0x8e6572
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x8e6572
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_a]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x8e6690
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x8e66af
add edx, 3
sar edx, 2
test edx, edx
jle 0x8e67bd
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x8e66e4
je 0x8e6727
sub ecx, 0x2b
je 0x8e671d
sub ecx, 4
je 0x8e6722
dec ecx
sub ecx, 0xa
jb 0x8e670f
jmp 0x8e672a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x8e66f6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x8e6701
jmp 0x8e672a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x8e672a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x8e672a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x8e672a
mov byte [eax], 0x3e
jmp 0x8e672a
mov byte [eax], 0x3f
jmp 0x8e672a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x8e66c7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x8e677b
cmp byte [esp + 7], 0xff
jne 0x8e677b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x8e67b2
cmp dl, 0xff
je 0x8e67b2
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x8e66be
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x8e8cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x8e8ccb
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x8e8cc0
pop edi
pop esi
ret
Function at 0x8ebe68
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push ecx
push 0x8ebfe0
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
push 0x8ebffc
push esi
call fcn.00411488
mov ebx, eax
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x8ebea0
push esp
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call ebx
test eax, eax
je 0x8ebea0
cmp dword [esp], 0
jne 0x8ebea4
xor eax, eax
jmp 0x8ebea6
mov al, 1
mov byte [0xa499f0], al
mov eax, 0xa499f4
xor ecx, ecx
mov edx, 0x24
call fcn.008ebb7c
cmp byte [0xa499f0], 0
je 0x8ebed2
push 0x8ec01c
push esi
call fcn.00411488
jmp 0x8ebed6
xor edx, edx
mov eax, edx
test eax, eax
je 0x8ebee3
push 0xa499f4
call eax
jmp 0x8ebeed
push 0xa499f4
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, 0xa
call fcn.004048f0
cmp eax, 0x100000
jbe 0x8ebf14
cmp dword [0xa499fc], 0x100000
ja 0x8ebf14
mov dword [0xa499fc], 0x100000
call fcn.0040490c
mov dword [0xa49a18], 0x11c
push 0xa49a18
call sub.KERNEL32.DLL_GetVersionExW
xor eax, eax
mov edx, dword [0xa49a1c]
sub edx, 5
je 0x8ebf42
dec edx
je 0x8ebf86
jmp 0x8ebfc9
mov edx, dword [0xa49a20]
sub edx, 1
jb 0x8ebf54
je 0x8ebf58
dec edx
je 0x8ebf5c
jmp 0x8ebfc9
mov al, 1
jmp 0x8ebfc9
mov al, 2
jmp 0x8ebfc9
cmp byte [0xa49b32], 1
jne 0x8ebf73
cmp word [0xa499f4], 9
jne 0x8ebf73
mov al, 3
jmp 0x8ebfc9
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x8ebf82
mov al, 4
jmp 0x8ebfc9
mov al, 5
jmp 0x8ebfc9
mov edx, dword [0xa49a20]
sub edx, 1
jb 0x8ebf98
je 0x8ebfa9
dec edx
je 0x8ebfba
jmp 0x8ebfc9
cmp byte [0xa49b32], 1
jne 0x8ebfa5
mov al, 6
jmp 0x8ebfc9
mov al, 8
jmp 0x8ebfc9
cmp byte [0xa49b32], 1
jne 0x8ebfb6
mov al, 0xc
jmp 0x8ebfc9
mov al, 0xa
jmp 0x8ebfc9
cmp byte [0xa49b32], 1
jne 0x8ebfc7
mov al, 0xe
jmp 0x8ebfc9
mov al, 0x10
cmp word [0xa499f4], 9
jne 0x8ebfd4
inc eax
mov byte [0xa49b34], al
pop edx
pop esi
pop ebx
ret

Function at 0x8ec070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x8ec0e3
cmp dword [ebp + 8], 0
je 0x8ec0af
mov edx, esi
dec edx
test edx, edx
jl 0x8ec0af
inc edx
xor eax, eax
movzx ecx, byte [ebx + eax]
mov edi, dword [ebp + 8]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x8ec0a1
mov edx, esi
dec edx
test edx, edx
jl 0x8ec0c7
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x8ec0b9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtect
push esi
push ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_FlushInstructionCache
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x8ed1b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
mov ecx, 0xa31cd8
movzx ebx, word [eax + 0x112]
dec ebx
test ebx, ebx
jle 0x8ed31f
add eax, 0x10
mov edx, dword [eax]
mov esi, edx
shr esi, 0x18
movzx esi, byte [ecx + esi]
mov esi, dword [esi*4 + 0xa32ad8]
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa326d8]
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa322d8]
and edx, 0xff
movzx edx, byte [ecx + edx]
xor esi, dword [edx*4 + 0xa31ed8]
mov dword [eax], esi
mov edx, dword [eax + 4]
mov esi, edx
shr esi, 0x18
movzx esi, byte [ecx + esi]
mov esi, dword [esi*4 + 0xa32ad8]
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa326d8]
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa322d8]
and edx, 0xff
movzx edx, byte [ecx + edx]
xor esi, dword [edx*4 + 0xa31ed8]
mov dword [eax + 4], esi
mov edx, dword [eax + 8]
mov esi, edx
shr esi, 0x18
movzx esi, byte [ecx + esi]
mov esi, dword [esi*4 + 0xa32ad8]
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa326d8]
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa322d8]
and edx, 0xff
movzx edx, byte [ecx + edx]
xor esi, dword [edx*4 + 0xa31ed8]
mov dword [eax + 8], esi
mov edx, dword [eax + 0xc]
mov esi, edx
shr esi, 0x18
movzx esi, byte [ecx + esi]
mov esi, dword [esi*4 + 0xa32ad8]
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa326d8]
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [ecx + edi]
xor esi, dword [edi*4 + 0xa322d8]
and edx, 0xff
movzx edx, byte [ecx + edx]
xor esi, dword [edx*4 + 0xa31ed8]
mov dword [eax + 0xc], esi
add eax, 0x10
dec ebx
jne 0x8ed1cb
pop edi
pop esi
pop ebx
ret
Function at 0x8ed668
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb10
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x8ed7dc
mov eax, dword [0xa3fc0c]
cmp dword [eax + 0x14], 1
jbe 0x8ed69b
cmp dword [ebp + 0xc], 0x8000
jge 0x8ed6c3
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.008ed5b8
jmp 0x8ed7dc
mov eax, dword [0xa3fc0c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jle 0x8ed6db
mov dword [ebp - 0x10], 4
mov eax, dword [ebp + 0xc]
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x8ed776
inc edi
lea ebx, [ebp - 0x4e0]
lea eax, [ebp - 0x4f0]
mov dword [ebp - 0x20], eax
mov esi, ebx
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movzx eax, byte [ebp + 8]
mov byte [esi + 0xc], al
mov eax, dword [ebp - 4]
push esi
push edi
lea edi, [esi + 0x14]
mov esi, eax
mov ecx, 0x46
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [esi + 0x10]
push eax
push 0
push ebx
push 0x8ed638
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
shl eax, 4
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp + 0xc], eax
add dword [ebp - 0x20], 4
add ebx, 0x130
dec edi
jne 0x8ed70d
cmp dword [ebp + 0xc], 0
jle 0x8ed79b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0xc]
push eax
movzx eax, byte [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.008ed5b8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x4f0]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x8ed7dc
inc edi
lea ebx, [ebp - 0x4f0]
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_CloseHandle
add ebx, 4
dec edi
jne 0x8ed7ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8ed7e8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x8ed873
pop ebx
pop edi
pop esi
ret
Function at 0x8ed8b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x20]
lea edx, [ebx + 0x28]
lea eax, [ebp - 0x120]
call fcn.008ed7e8
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, edx
mov dword [ebp - 0xc], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0xa33ed8]
add eax, ecx
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp + edi*4 - 0x120]
mov ebx, dword [ebp - 0x20]
add ecx, eax
mov esi, eax
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp - 0x1c]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp - 0x18]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp edi, 0x40
jne 0x8ed905
pop edi
pop esi
pop ebx
mov eax, dword [esi]
add dword [ebx], eax
mov eax, dword [esi + 4]
add dword [ebx + 4], eax
mov eax, dword [esi + 8]
add dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
add dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
add dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
add dword [ebx + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8eda70
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x6c
call fcn.008ebb7c
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
pop ebx
ret

Function at 0x8edd68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
shr ecx, 3
je 0x8edd82
mov ebx, dword [eax]
mov esi, dword [eax + 4]
xor dword [edx], ebx
xor dword [edx + 4], esi
dec ecx
lea eax, [eax + 8]
lea edx, [edx + 8]
jne 0x8edd6f
pop esi
pop ebx
ret
Function at 0x8edd88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov ebx, edx
mov esi, eax
cmp dword [esp], 0
jle 0x8eddea
and ebx, 0x1fff
mov edi, 0x2000
sub edi, ebx
cmp edi, dword [esp]
jle 0x8eddae
mov edi, dword [esp]
lea eax, [ebx + 0xa31ed8]
mov ecx, edi
mov edx, esi
call fcn.008edd68
mov eax, 0xfffffff8
and eax, edi
add esi, eax
add ebx, eax
mov eax, 7
and eax, edi
test eax, eax
jle 0x8edde1
movzx edx, byte [ebx + 0xa31ed8]
xor byte [esi], dl
inc esi
inc ebx
dec eax
jne 0x8eddd3
sub dword [esp], edi
cmp dword [esp], 0
jne 0x8edd99
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x8ee78c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x8efad8
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x6c
call fcn.008ebb7c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
ret
Function at 0x8f003c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409218
mov eax, dword [ebp - 8]
call fcn.00409218
mov eax, dword [ebp - 0xc]
call fcn.00409218
xor eax, eax
push ebp
push 0x8f01f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x8f008f
mov eax, ebx
call fcn.00409148
jmp 0x8f01c0
mov eax, 0x18
call fcn.008efd64
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x8f01b9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.008efdb0
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x8f0199
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x8f00dd
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.0040a350
mov eax, dword [ebp - 0x24]
push eax
call fcn.0042dfe0
lea ecx, [ebp - 0x10]
pop edx
call fcn.0042db18
mov eax, dword [ebp - 0x10]
call fcn.0040b87c
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CryptEncrypt
call fcn.0042c770
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x41d1ac]
call fcn.0040ba30
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CryptEncrypt
call fcn.0042c770
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x41d1ac]
call fcn.0040ba30
add esp, 4
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.008efb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f01a0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CryptDestroyKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f01f8
lea eax, [ebp - 0x24]
call fcn.00409124
lea eax, [ebp - 0x10]
mov edx, dword [0x41d1ac]
call fcn.0040bb54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004091b4
ret