joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4694c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
jne 0x47a50f
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x4694d9
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
jne 0x469b57
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
test ecx, 0xffff0000
lea eax, [eax + 1]
jne 0x79af43
jmp 0x469501
cmp word [eax], 0
je 0x49a1a8
lea eax, [eax + 2]
test eax, 3
jne 0x47a50f
jmp 0x4694d9
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x469501
invalid

Function at 0x477745
Capabilities:
Check http status code

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xfc
cmp dword [ebp + 0x7c], 0
mov eax, dword [0x31644000]
push ebx
mov dword [ebp + 0x6c], eax
mov ebx, edx
mov dword [ebp - 0x8c], ecx
jne 0x53e497
and word [ebp + 0x1c], 0
push esi
push edi
push 0x13
xor eax, eax
cmp word [ebx], 0
pop ecx
lea edi, [ebp + 0x1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x103
jne 0x73a46f
mov edx, dword [ebp - 0x8c]
mov ecx, 0x30ca14f8
call fcn.004778ea
push dword [ebp + 0x78]
mov ecx, dword [ebp - 0x8c]
xor edx, edx
call fcn.00477957
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x53e4bf
cmp eax, 0x647
je 0x53e4bf
cmp ebx, 0xc8
jge 0x53e4bf
push dword [ebp + 0x78]
mov edx, eax
mov ecx, 0x30ca14a0
call fcn.0046b0a8
mov ecx, dword [ebp + 0x78]
call fcn.004779e8
mov ecx, eax
call fcn.00477a0f
test eax, eax
je 0x7dcdae
and dword [ebp - 0x88], 0
push 0x28
pop ecx
xor eax, eax
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x78]
push 0xa4
lea edx, [ebp - 0x88]
call fcn.00477a61
test eax, eax
je 0x7dcd9a
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp + 0x6c]
pop ebx
call fcn.00468687
add ebp, 0x70
leave
ret 8
mov ecx, dword [ebp + 0x78]
call fcn.004779e8
mov ecx, eax
call fcn.00477a0f
test eax, eax
je 0x47776b
mov ecx, 0x30d68134
call fcn.00477381
xor eax, eax
jmp 0x477828
cmp word [ebp + 0x1c], 0
je 0x7dcdd7
jmp 0x7dcdc4

Function at 0x486926
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ax, word [esi]
cmp ax, 0x80
push edi
mov edi, edx
jae 0x486981
cmp ax, 0x20
jbe 0x486a47
cmp ax, 0x7f
je 0x486a47
cmp ax, 0x25
je 0x48cdd7
movzx eax, ax
cmp eax, 0x3d
jle 0x4869ac
cmp eax, 0x5e
jle 0x4869fd
sub eax, 0x60
je 0x486a47
sub eax, 0x1b
je 0x486a47
dec eax
dec eax
je 0x486a47
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
je 0x4869f3
sub eax, 0x22
cmp eax, 0x1a
ja 0x486981
movzx eax, byte [eax + 0x30dd8c84]
jmp dword [eax*4 + 0x30dd8c70]
mov eax, dword [ebp + 8]
and eax, 0x100000
jmp 0x486983
cmp eax, 0x5d
jge 0x486a47
sub eax, 0x3e
je 0x486a47
dec eax
je 0x712e75
dec eax
je 0x4869f3
sub eax, 0x1b
jmp 0x48697b
xor eax, eax
inc eax
jmp 0x486983
test byte [ebp + 8], 0x40
jne 0x486a47
cmp edi, 2
jle 0x72b70f
mov ax, word [esi + 2]
push eax
call fcn.00487454
test eax, eax
je 0x72b70f
mov ax, word [esi + 4]
push eax
call fcn.00487454
test eax, eax
je 0x72b70f
jmp 0x486981
mov eax, dword [ebp + 8]
and eax, 0x40000
jmp 0x486983
cmp edi, 5
jle 0x486a47
jmp 0x5aefb4
Function at 0x4875e3
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
mov ebx, 0x10000
ja 0x803c30
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x78b7f5
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
mov eax, dword [0x31621440]
test eax, eax
mov ecx, dword [0x3162143c]
je 0x487665
mov edx, dword [eax + 8]
test edx, edx
je 0x48766d
cmp edx, dword [ebp - 4]
jb 0x48766d
cmp edx, dword [ebp - 8]
ja 0x48766d
mov edx, dword [eax + 8]
cmp edx, dword [ebp - 4]
jb 0x78b80a
cmp edx, dword [ebp - 8]
ja 0x78b80a
mov ecx, dword [edx + 0x18]
mov dword [eax + 8], ecx
push 8
mov eax, 0xcccccccc
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
test ecx, ecx
jne 0x803c3e
mov eax, ecx
test ecx, ecx
mov dword [0x31621440], eax
jne 0x803c4a
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov edi, esi
jbe 0x78b801
cmp edi, 0x60000000
jb 0x4876a5
cmp edi, 0x80000000
ja 0x4876a5
mov edi, 0x5fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [0x30c9153c]
test eax, eax
je 0x78b801
cmp dword [ebp - 0x30], ebx
jne 0x78b7e2
cmp dword [ebp - 0x34], ebx
jb 0x78b7e2
push 0x40
push 0x3000
push ebx
push edi
call dword [0x30c91548]
test eax, eax
mov dword [0x31621440], eax
je 0x78b801
mov ecx, dword [0x3162143c]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x3162143c], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
jmp 0x487751
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x487751
mov dword [eax + 8], edx
jmp 0x487637
test byte [ebp + 0x21000000], dh
inc ebp
cld
mov eax, dword [esi]
push ebx
lea ecx, [ebp - 4]
push ecx
mov ebx, 0x746
push ebx
push esi
add byte [ebx + 0x56], dl
call dword [eax + 0x13c]
test eax, eax
jne 0x78b879
ja 0x78b85a
push edi
push 0x100
push 0x38
call fcn.00482a8f
mov edi, eax
mov dword [ebp - 4], edi
xor eax, eax
push 0xe
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
and dword [eax + 0x20], 0
mov eax, dword [ebp - 4]
and dword [eax + 0x24], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x10000
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0x401
mov eax, dword [ebp - 4]
push 0x121
push 0xc
mov dword [eax + 0x18], 0x30f98c23
call fcn.00482a8f
mov ecx, eax
test ecx, ecx
je 0x78b878
enter 0xffffffffffffc985, 0x74
sbb dword [ebx], esi
ror byte [ebx - 0x54545407], 0x8b
inc ebp
clc
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], ecx
pop edi
push dword [ebp - 4]
mov eax, dword [esi]
push 0x30faab28
push ebx
push esi
call dword [eax + 0x134]
test eax, eax
pop ebx
je 0x8487bc
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x497ce8
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx], 0
ret

Function at 0x49946d
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], edx
push ebx
push esi
push edi
push ebp
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x49947a
xor edx, edx
xor esi, esi
mov edi, dword [esp + 0x1c]
mov byte [ecx + 0x101], dl
mov byte [ecx + 0x100], dl
mov byte [esp + 0x13], dl
xor ebx, ebx
xor eax, eax
mov bl, dl
mov al, byte [esp + 0x13]
xor edx, edx
inc esi
mov dl, byte [ebx + edi]
add edx, eax
xor eax, eax
mov al, byte [esi + ecx - 1]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov dl, byte [esi + ecx - 1]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
lea ebp, [eax + ecx]
mov al, byte [ebp]
mov byte [esi + ecx - 1], al
lea eax, [ebx + 1]
mov byte [ebp], dl
cdq
idiv dword [esp + 0x14]
cmp esi, 0x100
jl 0x49949d
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x499660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov al, byte [ecx + 0x100]
mov dword [esp + 4], edx
push ebx
push esi
mov dl, byte [ecx + 0x101]
xchg ecx, eax
add dword [ecx], eax
add byte [eax], al
mov byte [esp + 0xa], al
push edi
push ebp
xor edi, edi
mov byte [esp + 0x13], dl
cmp dword [esp + 0x14], edi
jle 0x4996ee
xor eax, eax
xor ebx, ebx
mov al, byte [esp + 0x12]
inc edi
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov byte [esp + 0x12], al
xor eax, eax
mov al, byte [esp + 0x12]
lea esi, [ecx + eax]
xor eax, eax
mov al, byte [esp + 0x13]
mov bl, byte [esi]
add eax, ebx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
lea ebp, [eax + ecx]
mov al, byte [ebp]
mov byte [esi], al
xor eax, eax
mov byte [ebp], bl
mov al, byte [esi]
add eax, ebx
mov ebx, dword [esp + 0x1c]
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov dl, byte [ecx + eax]
xor byte [ebx + edi - 1], dl
cmp edi, dword [esp + 0x14]
jl 0x499677
mov al, byte [esp + 0x12]
Function at 0x4ae005
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
mov edx, dword [esi + 0x58]
mov eax, edx
and eax, 0x3f
mov ebx, 0x40
sub ebx, eax
cmp ebx, 8
push edi
jbe 0x855c9f
lea ecx, [ebx - 8]
mov ebp, ecx
shr ecx, 2
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 0x54]
mov eax, edx
shl ecx, 3
shr eax, 0x1d
or ecx, eax
mov dword [esp + 0x10], ecx
lea ecx, [edx*8]
push 2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + ebx + 0x18]
push eax
mov byte [esp + 0x24], 0x80
mov dword [esp + 0x20], ecx
call fcn.004ae0f1
push ebx
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.004ad976
mov edx, dword [esp + 0x68]
push 5
lea edi, [esi + 0x40]
push edi
push edx
call fcn.004ae0f1
xor eax, eax
mov dword [edi], 0x67452301
pop edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x44], 0xefcdab89
mov dword [esi + 0x48], 0x98badcfe
mov dword [esi + 0x4c], 0x10325476
mov dword [esi + 0x50], 0xc3d2e1f0
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8

Function at 0x4ae0f1
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x4ae134
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, edx
mov ecx, dword [esi + edx]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [edx], ecx
add edx, 4
dec edi
jne 0x4ae106
pop esi
pop ebx
pop edi
ret 0xc
Function at 0x4b273f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp eax, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x9e3779b9
mov dword [ebp - 4], eax
mov ebx, edi
jae 0x4b31a4
mov ecx, dword [ebp + 8]
add esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
dec eax
cmp eax, 0xa
ja 0x4b2795
jmp dword [eax*4 + 0x30ddb3cf]
sub ebx, esi
sub ebx, edi
sub edi, esi
mov eax, esi
shr eax, 0xd
xor ebx, eax
sub edi, ebx
mov eax, ebx
shl eax, 8
xor edi, eax
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov eax, esi
shr eax, 0xc
xor ebx, eax
sub edi, ebx
mov eax, ebx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
shr ecx, 3
xor ebx, ecx
sub edi, eax
sub edi, ebx
mov ecx, ebx
shl ecx, 0xa
xor edi, ecx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0xc
pop ecx
xor edx, edx
div ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
jmp 0x4b3231
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [eax + edx]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [eax + edx]
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
shl edx, 8
add edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
add edx, eax
movzx eax, byte [ecx]
shl edx, 8
add edx, eax
sub edx, esi
sub edx, edi
sub edi, esi
mov eax, esi
shr eax, 0xd
add edx, ebx
xor edx, eax
sub edi, edx
mov eax, edx
shl eax, 8
xor edi, eax
sub esi, edi
sub esi, edx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub edx, esi
sub edx, edi
mov eax, esi
shr eax, 0xc
xor edx, eax
sub edi, esi
sub edi, edx
mov eax, edx
shl eax, 0x10
xor edi, eax
sub esi, edi
sub esi, edx
mov eax, edi
shr eax, 5
xor esi, eax
sub edx, esi
mov eax, esi
shr eax, 3
sub edx, edi
xor edx, eax
sub edi, esi
mov ebx, edx
mov eax, ebx
shl eax, 0xa
sub edi, ebx
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 0xf
xor esi, eax
add ecx, 0xc
sub dword [ebp - 4], 0xc
dec dword [ebp + 0x10]
jne 0x4b3231
jmp 0x4b2762
Function at 0x4be747
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x24]
test ecx, ecx
push esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
js 0x4de768
cmp dword [0x315ff6c4], 0
je 0x4be77b
mov dword [esp + 8], 2
test ecx, 0x40000000
jne 0x535015
test ecx, 0x20000000
jne 0x51d2a5
mov eax, dword [esp + 0x20]
mov esi, dword [eax]
test esi, esi
je 0x74ea99
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x2c]
push edi
mov edi, dword [eax + 0x20]
mov eax, dword [esp + 0x34]
push eax
push ebp
push ecx
push esi
mov ecx, ebx
call fcn.0048b8fe
cmp eax, edi
jg 0x4be8e8
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
mov ecx, dword [esp + 0x10]
push 0
push ecx
push 0
lea edx, [esp + 0x28]
push edx
push 0x30db23e4
call fcn.004694c7
push eax
push 0x30db23e4
push ebx
call fcn.00481536
mov eax, ebp
sub eax, dword [esp + 0x1c]
mov ebx, 1
add edi, eax
test edi, edi
jle 0x4be973
test esi, esi
mov dword [esp + 0x2c], 0
mov ebx, esi
jle 0x4be96a
mov ecx, dword [esp + 0x2c]
lea eax, [ecx + ebx + 1]
mov ecx, dword [esp + 0x18]
cdq
sub eax, edx
mov edx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x34]
push ebp
push eax
sar esi, 1
push esi
call fcn.0048b8fe
cmp eax, edi
jl 0x4beea3
jle 0x4d676f
lea ebx, [esi - 1]
cmp dword [esp + 0x2c], ebx
jl 0x4be92b
cmp ebx, 1
jl 0x7db266
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
pop esi
mov dword [ecx], ebx
mov eax, 1
pop ebx
add esp, 0x14
ret 0x10
mov dword [esp + 0x2c], esi
jmp 0x4be964
mov ebx, esi
jmp 0x4be96a
mov dword [esp + 8], 4
jmp 0x4be77b
or byte [esp + 0xa], 0x20
jmp 0x4be793
or byte [esp + 0xa], 0x10
jmp 0x4be787
mov eax, dword [0x18850f40]
outsd dx, dword [esi]
or al, byte [eax]
jmp 0x7f59a2
into
dec dword [ebx - 0x7f411738]
cmp al, 0
Function at 0x5062e0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x404
push ebx
mov ebx, ecx
test byte [ebx + 0xc0], 0x40
jne 0x506ee8
push esi
push edi
call fcn.00506f1a
mov ecx, ebx
call fcn.00506fe1
mov ecx, ebx
call int.0050619d
mov ecx, ebx
call fcn.00507097
mov ecx, ebx
call fcn.0050710e
mov ecx, ebx
call fcn.00507203
mov ecx, ebx
call fcn.00507237
mov ecx, ebx
call fcn.0050728e
mov ecx, ebx
call fcn.005072c3
mov edx, dword [ebx]
lea eax, [ebx + 0x194]
push eax
push 4
mov ecx, ebx
mov dword [ebp + 0x58], eax
call dword [edx + 0x1c]
mov edx, dword [ebx]
lea eax, [ebx + 0xa1c]
push eax
push 0xa
mov ecx, ebx
mov dword [ebp + 0x2c], eax
call dword [edx + 0x1c]
mov ecx, ebx
call fcn.0050613a
mov ecx, ebx
call fcn.0050732f
or dword [ebx + 0xc0], 0x40
xor esi, esi
cmp dword [ebx + 0x380], esi
mov dword [ebx + 0x38c], esi
setne byte [ebp + 0x77]
cmp byte [ebp + 0x77], 0
je 0x5063a0
mov ecx, ebx
call fcn.004e1a73
cmp dword [eax + 0x80], esi
je 0x667758
cmp dword [ebx + 0x438], esi
setne byte [ebp + 0x76]
cmp byte [ebp + 0x76], 0
jne 0x66d5eb
lea eax, [ebx + 0x42c]
cmp dword [eax], esi
jne 0x745b25
xor ecx, ecx
cmp byte [ebp + 0x76], 0
mov dword [eax], ecx
jne 0x5063db
mov ecx, ebx
call fcn.0050744b
test eax, eax
mov byte [ebp + 0x73], 1
jne 0x5063df
mov byte [ebp + 0x73], 0
cmp dword [ebx + 0xc2c], 0xca
mov eax, 0x20000000
je 0x6db409
cmp byte [ebp + 0x73], 0
jne 0x50769b
mov dword [ebx + 0x708], esi
mov dword [ebx + 0x654], esi
mov dword [ebx + 0x5a0], esi
mov dword [ebx + 0x4ec], esi
cmp dword [ebx + 0x4ec], esi
mov ecx, ebx
call fcn.0051da5c
cmp dword [eax + 0x20], esi
jne 0x5063a0
mov byte [ebp + 0x77], 0
mov dword [ebx + 0x380], esi
jmp 0x5063a0
mov ecx, ebx
call fcn.004e1a73
cmp dword [eax + 0x74], esi
jne 0x5063b4
mov ecx, ebx
call fcn.0051da5c
cmp dword [eax + 0x20], esi
jne 0x5063b4
mov byte [ebp + 0x76], 0
mov dword [ebx + 0x438], esi
jmp 0x5063b4

Function at 0x50a265
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x5e570a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
adc al, 0x8b
inc esp
and al, 0x5c
push ebp
mov ebp, esp
mov eax, 0x14c0
call fcn.0047da39
mov eax, dword [0x31644000]
push ebx
push esi
push edi
push 6
mov dword [ebp - 0x14c0], ecx
pop ecx
mov esi, 0x30e0f3f0
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov esi, 0x825
push esi
lea eax, [ebp - 0x14bc]
push eax
push dword [ebp - 0x14c0]
xor ebx, ebx
mov word [ebp - 0x14bc], bx
call fcn.00469702
push esi
lea eax, [ebp - 0x14bc]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00479a3d
lea eax, [ebp - 0x14bc]
push eax
call fcn.0047949e
test eax, eax
je 0x5e22fb
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00468687
leave
ret

Function at 0x624941
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor bh, byte [edi + edi*8 - 0x7c077401]
les ecx, [eax]
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, edx
push 2
lea edx, [ebp - 4]
mov edi, ecx
call fcn.006255b0
test esi, esi
je 0x62492d
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
mov ecx, eax
shr ecx, 5
sub eax, ecx
mov ecx, eax
shr ecx, 5
and ecx, 0x25
add ecx, eax
and ecx, 0x1ff
movzx esi, byte [ecx + 0x30e4e5f8]
cmp esi, 0x51
jge 0x624b9e
mov ecx, esi
call fcn.0064a54f
mov cx, word [edi]
test ch, 0xff
jne 0x7bff11
movzx ecx, cx
movzx ecx, byte [ecx + 0x30e61788]
movzx ecx, cl
inc edi
inc edi
test ecx, ecx
je 0x624b93
movzx edx, byte [eax]
movzx edx, byte [edx + 0x30e61788]
inc eax
cmp edx, ecx
je 0x62495b
jmp 0x624b9e
cmp byte [eax], 0
jne 0x624b9e
mov eax, esi
pop edi
pop esi
leave
ret
or eax, 0xffffffff
jmp 0x624b9a
sar edi, cl
mov ecx, ebx
call 0x5130b8
test eax, eax
jne 0x7bff52
mov eax, dword [ebx + 0xa8]
cmp eax, esi
je 0x7bff2d
mov eax, dword [eax + 4]
jmp 0x7bff2f
xor eax, eax
mov ecx, eax
call 0xcf69b1
and dword [ebx + 0xac], 0xfffffffb
push esi
mov ecx, ebx
call 0xcfa37b
test eax, eax
je 0x4f4f7a
jmp 0x4ed348
mov ecx, ebx
call 0xcfa7b3
jmp 0x4f4f7a
Function at 0x653867
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add al, 0xe8
sbb al, 0
add byte [eax], al
push esi
push edi
mov esi, edx
mov edi, ecx
mov ax, word [esi]
test ah, 0xff
jne 0x7b9d9e
movzx eax, ax
movzx eax, byte [eax + 0x30e65378]
movzx eax, al
add esi, 2
test eax, eax
je 0x653894
rol edi, 0
add edi, eax
jmp 0x65386d
mov eax, edi
shr eax, 1
xor eax, edi
mov esi, eax
shr esi, 6
and esi, 1
sub eax, esi
and eax, 0x3f
movzx eax, byte [eax + 0x30e7d5b8]
cmp eax, 0x1b
jge 0x65390c
mov si, word [eax*2 + 0x30e7d57c]
lea edi, [esi + 1]
movzx esi, si
movzx esi, word [esi*2 + 0x30e75318]
cmp esi, ecx
movzx edi, di
lea edi, [edi*2 + 0x30e75318]
jne 0x65390c
movzx ecx, word [edx]
test ecx, ecx
je 0x7b9da8
lea ebx, [ebx]
add edx, 2
cmp ecx, 0xff
jg 0x65390c
movzx cx, byte [ecx + 0x30e65378]
mov si, word [edi]
add edi, 2
cmp si, cx
jne 0x65390c
movzx ecx, word [edx]
test ecx, ecx
jne 0x6538e4
pop edi
pop esi
ret
or eax, 0xffffffff
jmp 0x7b9da8
inc ebp
cwde
push eax
push 0x165
call 0x48f037
push edx
int 0xff
test eax, eax
jne 0x4a1e92
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x68]
call dword [0x30c91060]
test eax, eax
push 0x10
pop ecx
je 0x7b9dd4
mov dword [ebp - 0x6c], ecx
push 3

Function at 0x65a25f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x98
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x78], eax
lea eax, [esp]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x2c], edx
push eax
lea edx, [esp + 8]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x88], 0
call fcn.0065aeba
mov ecx, dword [esp + 4]
push ebx
push ebp
add ecx, 0x1c
push esi
mov dword [esp + 0x40], ecx
push edi
Function at 0x65e11a
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x7b5188
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x65e1d9
push edi
mov edi, eax
shr edi, 3
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
dec edi
jne 0x65e146
pop edi
test eax, eax
je 0x65e1f1
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x30e87e60]
inc edx
dec eax
jne 0x65e1dd
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
sbb dh, dh
invalid
Function at 0x6bd1a780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6bd1a7db
cmp byte [esi + ebx - 1], 0xa
je 0x6bd1a7af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6bd2c0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6bd1b4d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x6bd2c0e0]
test eax, eax
je 0x6bd1b588
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x6bd1b510
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6bd1b4fc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6bd1b5bd
mov dword [esp + 4], 0x6bd250e4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6bd2c0e0], eax
sub esp, 8
test eax, eax
jne 0x6bd1b4ed
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6bd1b4fe