joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x589d2d
sub esp, 0x70
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045f9e4
lea ecx, [0x589d40]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x88]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x9c]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x90]
mov dword [esp + 0x68], ebx
lea ebx, [esp + 0x78]
mov dword [esp + 0x6c], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.0057c040
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x589c23
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x589bfa
mov eax, dword [esp + 0x8c]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
call fcn.0057c040
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x589c80
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x589c55
mov eax, dword [esp + 0x94]
test eax, eax
je 0x589ca5
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x589d29
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x589d29
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x674be0]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x6f6a20]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], eax
add esp, 0x70
ret
call fcn.0045e340
jmp fcn.00589af0
Function at 0x58d9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58db94
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045fe9c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0058cf80
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f9e6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x58da62
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x58db35
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x58db66
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x58da5b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x58da5b
test byte [eax], al
cmp ebp, 0x20
jb 0x58db58
mov eax, ebp
mov ecx, 0x20
call fcn.0045f7d0
nop
call fcn.0045e340
jmp fcn.0058d9b0
Function at 0x593f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x594061
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x593fc3
mov edx, dword [esp + 0x18]
movzx ebx, byte [edx + ecx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x593fad
mov eax, ecx
jmp 0x593fb4
mov eax, ecx
mov ecx, 0x100
mov byte [esp + 0xa], bl
mov dword [esp + 0x10], esi
sar ebp, 0x1f
xor edi, edi
jmp 0x594013
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
inc edi
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
mov dword [esp + 0xc], esi
movzx ebp, byte [eax + edx - 1]
movzx eax, byte [esp + 0xa]
and esi, eax
mov eax, dword [esp + 0xc]
and ebp, eax
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
movzx eax, byte [esp + 0xb]
and ebp, eax
movzx eax, byte [esp + 0xa]
mov esi, dword [esp + 0x10]
mov eax, ebx
movzx ebx, byte [esp + 0xa]
cmp ecx, edi
jle 0x59402e
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub esi, edi
sub eax, edi
lea ebp, [eax - 1]
mov ebx, dword [esp + 0x1c]
cmp ebx, ebp
ja 0x593fd4
jmp 0x594057
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ebp
mov ecx, ebx
call fcn.0045f7d0
nop
call fcn.0045e340
jmp fcn.00593f70
Function at 0x5b8960
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5b8a7d
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045f9d8
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x5b89e3
mov eax, dword [esp + 0x88]
xor edx, edx
jmp 0x5b8a3d
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00569c50
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
mov ebx, dword [esp + 0x80]
add ebx, 0xc
mov edx, eax
mov eax, ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x80], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.00569a50
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x8c]
cmp ecx, eax
jg 0x5b8a2f
jmp 0x5b89e3
call fcn.0045e340
jmp fcn.005b8960
Function at 0x5b8a90
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5b8c50
sub esp, 0x84
lea eax, [0x659160]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.004483a0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045f9d9
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5b8b37
mov ecx, dword [esp + 0x88]
xor edx, edx
jmp 0x5b8c13
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.0057b5f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jl 0x5b8b6d
mov ecx, 0x24
mov edx, dword [esp + 0x80]
cmp eax, edx
je 0x5b8b88
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004600e0
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], eax
call fcn.005b8960
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jl 0x5b8bbf
mov ecx, 0x14
mov edx, dword [esp + 0x80]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x5b8be4
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004600e0
mov edx, dword [esp + 0x80]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 0x24
mov dword [esp + 0x9c], 0x24
add esp, 0x84
ret
mov ebx, dword [esp + 0x7c]
add ebx, 0xc
mov ecx, ebx
mov edx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x7c], ecx
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.0057b3f0
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x8c]
cmp ecx, eax
jg 0x5b8c08
jmp 0x5b8b37
call fcn.0045e340
jmp fcn.005b8a90
Function at 0x5bb6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bb87f
sub esp, 0x40
lea eax, [0x659160]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.004483a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jbe 0x5bb732
lea ebx, [0x659160]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00448460
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov edx, ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.004600e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jb 0x5bb760
mov edx, dword [esp + 0x38]
jmp 0x5bb794
lea edx, [0x659160]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00448460
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov edx, eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x5c]
add ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 8], ecx
call fcn.004600e0
lea eax, [0x659160]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.004483a0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.005bb5f0
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [str.master_secret]
mov ebx, dword [0x85afd4]
mov ebp, dword [0x85afd8]
mov esi, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov edi, dword [esp + 0x4c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
call fcn.0045e340
jmp fcn.005bb6b0
Function at 0x5bc3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bc57a
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5bc3fe
movzx ecx, byte [esp + 0x80]
jmp 0x5bc40b
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5bc443
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5bc561
cmp cl, 0xe4
je 0x5bc422
cmp ax, 0x303
jmp 0x5bc447
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5bc4d5
cmp cl, 0xe3
jne 0x5bc49f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045fe7e
call fcn.005bc0b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.004e6310
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea eax, [0x658f60]
mov dword [esp], eax
lea eax, [0x6f5e3c]
mov dword [esp + 4], eax
call fcn.00434250
nop
call fcn.0045e340
jmp fcn.005bc3d0
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402ee4
pop dword [ebp - 8]
mov eax, 0x402ee4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbff7b9df
sub dword [ebp - 0x18], 0x71a57494
mov dword [ebp - 0x14], 0x57d0aafa
sub dword [ebp - 0x14], 0x259d5eb5
mov dword [ebp - 0x10], 0x34ecbebf
add dword [ebp - 0x10], 0x175f856f
mov dword [ebp - 0xc], 0xc4149277
add dword [ebp - 0xc], 0x3beb6d89
lea eax, [ebp - 0x18]
push eax
mov eax, 0x6a39cf1a
add eax, 0x9606b1ea
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb7186582
sub dword [ebp - 0x18], 0x42a5fc2c
mov dword [ebp - 0x14], 0x81e9965
sub dword [ebp - 0x14], 0xc6b237f0
mov dword [ebp - 0x10], 0xaedc6fe9
add dword [ebp - 0x10], 0xb492fc83
mov dword [ebp - 0xc], 0x8ab475ab
sub dword [ebp - 0xc], 0x8ab475ab
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x395af
push 0
call eax
mov ecx, 0xaf511600
add ecx, 0x50af3b47
xor edi, edi
add edi, eax
mov esi, 0x46e400
add esi, dword [ebp - 8]
mov ebx, 0xaf0c3348
add ebx, 0x3ed1bb15
xor dword [ebp - 4], 0x75d08404
mov edx, dword [esi]
mov dword [ebp - 4], 0x8f5e3ea2
sub edx, ebx
sub dword [ebp - 4], 0x54fb4b5b
mov dword [edi], edx
xor dword [ebp - 4], edx
add edi, 0xd4a2c596
sub edi, 0xd4a2c592
add esi, 0x6eb245f7
add esi, 0x914dba0d
loop 0x402ff8
add eax, 0x7d380317
sub eax, 0x7d36cb28
xor ebx, ebx
add ebx, eax
add eax, 0x3267b2fb
add eax, 0xcd984d0a
mov ecx, 0x66301fc3
add ecx, 0x9a0fe03d
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401bd7
pop dword [ebp - 0x2c]
mov eax, 0x4fcf9049
sub eax, 0x4f8f7472
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x291a97aa
add dword [ebp - 0x3c], 0x2537ada1
mov dword [ebp - 0x38], 0x54e91696
sub dword [ebp - 0x38], 0x22b5ca51
mov dword [ebp - 0x34], 0x2fc503f3
add dword [ebp - 0x34], 0x1c87403b
mov dword [ebp - 0x30], 0x5c2d52f7
sub dword [ebp - 0x30], 0x5c2d52f7
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x76296fa9
add eax, 0x8a1700b7
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xa211cd55
sub dword [ebp - 0x3c], 0x2d9f63ff
mov dword [ebp - 0x38], 0x192e9827
add dword [ebp - 0x38], 0x283dc94e
mov dword [ebp - 0x34], 0xde056dad
add dword [ebp - 0x34], 0x8569febf
mov dword [ebp - 0x30], 0x5c49ba4f
add dword [ebp - 0x30], 0xa3b645b1
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xc0bb97e1
add eax, 0x3f84d91f
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37ac3
push 0
call eax
mov ecx, 0x4c64
xor esi, esi
add esi, eax
mov edx, 0xdf4eaf91
add edx, 0x20f2506f
add edx, dword [ebp - 0x2c]
mov ebx, 0x415109bc
mov dword [ebp - 0x20], 0xbd3d67bb
mov edi, dword [edx]
mov dword [ebp - 0x18], 0xc94fd5b4
add edi, ebx
add dword [ebp - 0x28], 0x90d8252b
mov dword [esi], edi
xor dword [ebp - 0x14], ebx
add esi, 4
add edx, 0xf3467b1c
add edx, 0xcb984e8
loop 0x401cef
add eax, 0x12463
mov ebx, eax
add eax, 0x57265c74
sub eax, 0x57265c6f
mov ecx, 0x92f5c1ee
add ecx, 0x6d4a3e12
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10004c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x10004c7f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10004c54
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10004c91
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x10004ca5
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x10004ceb
xor ecx, ecx
cmp edi, 0x100
jb 0x10004cc8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x100055ec
jle 0x100055e7
cmp eax, 3
jg 0x100055e7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100055de
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x100055cc
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.100188f5
mov eax, 1
ret 0x10

Function at 0x10005b60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x10005bac
jle 0x10005ba7
cmp eax, 3
jg 0x10005ba7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x10005b9e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x10005b8c
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10006a50
mov eax, 1
ret 0x10