joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58df00
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x58df48
lea eax, [ebp - 0x6c]
call fcn.0058d0fc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp + 0xc]
call fcn.0058d138
lea edx, [ebp - 0x6c]
mov eax, dword [ebp + 8]
call fcn.0058d260
mov dword [ebp + 0xc], 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x58df4e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, dword [ebp + 0xc]
jg 0x58df83
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
xor al, 0x36
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0xac], al
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
xor al, 0x5c
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0xec], al
inc dword [ebp - 0x14]
jmp 0x58df99
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0xac], 0x36
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0xec], 0x5c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x58df53
lea eax, [ebp - 0x6c]
call fcn.0058d0fc
lea edx, [ebp - 0xac]
lea eax, [ebp - 0x6c]
mov ecx, 0x40
call fcn.0058d138
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
call fcn.0058dd7c
lea edx, [ebp - 0x6c]
mov eax, dword [ebp + 8]
call fcn.0058d260
lea eax, [ebp - 0x6c]
call fcn.0058d0fc
lea edx, [ebp - 0xec]
lea eax, [ebp - 0x6c]
mov ecx, 0x40
call fcn.0058d138
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x6c]
mov ecx, 0x10
call fcn.0058d138
lea edx, [ebp - 0x6c]
mov eax, dword [ebp + 8]
call fcn.0058d260
mov esp, ebp
pop ebp
ret 8
Function at 0x596864
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
xor eax, eax
push ebp
push 0x59696a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x59694c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004095f8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x5968bb
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 4
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call fcn.004093c0
pop ecx
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.0040331c
add dword [ebp - 0x10], 4
lea eax, [ebp - 0x1c]
call fcn.004063d0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
call fcn.0040331c
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x59694c
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov ecx, 0x16
cdq
idiv ecx
mov al, byte [edx + 0x70f53c]
mov edx, dword [ebp - 0x10]
xor byte [edx], al
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x59692b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x596971
lea eax, [ebp - 0x1c]
call fcn.00405b98
lea eax, [ebp - 4]
call fcn.00406d70
ret
Function at 0x5980e8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5980f1
xchg dword [ebp - 4], ecx
push ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5982b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0059844c
xor eax, eax
push ebp
push 0x59828e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x59813c
call fcn.00405448
jmp 0x598295
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x598217
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x598193
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x598193
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00597fa0
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00407348
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5981d4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00597fa0
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00407348
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x598278
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00597fa0
push dword [ebp - 0x28]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push dword [ebp + 8]
push 0x5982cc
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00407348
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00597fcc
jmp 0x598278
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x59823d
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x59823d
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x598254
mov eax, dword [ebp + 8]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x598278
lea eax, [ebp - 0x2c]
mov ecx, 0x5982cc
mov edx, dword [ebp + 8]
call fcn.00407264
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00597fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x598295
mov eax, dword [ebp - 4]
call fcn.00598460
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5982b7
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00406d78
ret
Function at 0x5a1998
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x70f6d7]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx - 1]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x55], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x31
jne 0x5a19ae
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
dec eax
add eax, eax
lea eax, [eax + eax*2]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
dec eax
shl eax, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x54]
add eax, eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x4f]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x53]
shl eax, 3
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x52]
shl edx, 2
add eax, edx
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x51]
add edx, edx
add eax, edx
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x50]
add eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
dec eax
je 0x5a1a5d
dec eax
je 0x5a1a92
dec eax
je 0x5a1ac4
dec eax
je 0x5a1af5
jmp 0x5a1b1d
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x70f7a0]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 8
and eax, 0xff
shr eax, 3
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x5a1b1d
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x70f7a0]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 4
and eax, 0xff
shr eax, 2
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x5a1b1d
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x70f7a0]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 2
and eax, 0xff
shr eax, 1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x5a1b1d
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x70f7a0]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x5a1a45
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jne 0x5a19e0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x70f707]
mov al, byte [ebp + eax - 0x75]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x21
jne 0x5a1b3e
mov esp, ebp
pop ebp
ret
Function at 0x5a2ba4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
shl eax, 7
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
shr edx, 1
or al, dl
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
shl eax, 6
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
shr edx, 2
or al, dl
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 2]
shl eax, 5
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 3]
shr edx, 3
or al, dl
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 3]
shl eax, 4
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 4]
shr edx, 4
or al, dl
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 4]
shl eax, 3
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 5]
shr edx, 5
or al, dl
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
shl eax, 2
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 6]
shr edx, 6
or al, dl
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add eax, eax
and al, 0xff
mov byte [ebp - 0x1d], al
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x24]
shl eax, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
and eax, 1
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jne 0x5a2c6e
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x24]
and al, 0xfe
or al, byte [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x24], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x5a2c67
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.004064f8
push 1
mov eax, dword [ebp - 0xc]
call fcn.004063d0
mov edx, eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.005a1c4c
mov esp, ebp
pop ebp
ret
Function at 0x5c822c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c8358
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x69c], 0
je 0x5c8291
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x5c8291
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + 0x69c]
xor byte [eax + edx], cl
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x5c8277
lea edx, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xd8]
mov dword [ebp - 0x10], eax
mov dl, 9
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x94]
test al, al
je 0x5c833a
inc dword [0x70fb84]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x54]
mov edx, 8
mov eax, dword [ebp - 4]
call fcn.00479e44
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0x11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b4]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [0x70fb84]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x50]
mov ecx, 5
mov eax, 0x5c8374
call fcn.0047b9a8
mov ecx, dword [ebp - 0x20]
mov dl, 9
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c835f
lea eax, [ebp - 0x54]
call fcn.00406d70
lea eax, [ebp - 0x20]
call fcn.00406d70
ret
Function at 0x5f6dc8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f6f1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x3a]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005f6c9c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040879c
add eax, 0x28
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4774d0]
call fcn.00408964
add esp, 4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x2a]
mov ecx, 0x1c
call fcn.0040331c
mov dword [ebp - 0x14], 0x1c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea edx, [eax + edx]
lea eax, [ebp - 0x3a]
mov ecx, 0x1c
call fcn.0040331c
add dword [ebp - 0x14], 0x1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040879c
mov dword [ebp - 0x18], eax
mov eax, dword [0x7222b8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.005e2ca0
add dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
add eax, edx
xor ecx, ecx
mov edx, 3
call fcn.00403b8c
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov byte [eax + edx], 0x3a
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040879c
push eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor edx, edx
call fcn.005e2b1c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov word [ebp - 0x1a], ax
mov ax, word [ebp - 0x1a]
call fcn.005e2b04
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
call fcn.005e2c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f6f24
lea eax, [ebp - 0x10]
mov edx, dword [0x4774d0]
call fcn.00408a84
ret

Function at 0x5f8e6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f8ef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.0040710c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00406e0c
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5f8ed8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040710c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.005e40a8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00406d80
jmp 0x5f8ee2
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00406d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8eff
lea eax, [ebp - 0xc]
call fcn.00406d70
ret
Function at 0x5f9c50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x710bb8
test edx, edx
jne 0x5f9c63
xor eax, eax
jmp 0x5f9d78
mov dword [esp], 1
cmp byte [esp], 0
je 0x5f9c80
push ecx
push edx
push eax
call fcn.005f9d7c
add esp, 0xc
jmp 0x5f9d78
push ecx
push edx
push eax
call fcn.005fa080
add esp, 0xc
jmp 0x5f9d78
pop edx
pop esi
pop ebx
ret
Function at 0x5fb9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x5fba0b
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x5fba8c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.005f9914
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x5fba59
mov cx, word [ebp - 4]
sub cx, si
jmp 0x5fba5b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5fba42
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x5fba81
mov cx, word [ebp - 4]
sub cx, si
jmp 0x5fba83
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5fba6a
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x5fbb72
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.005fb744
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x5fbadd
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x5fbaf3
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x5fb9df
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x5fbb72
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x5fbb35
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x5fbb1a
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.005f98fc
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x5fbb72
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x5fbb72
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x5fbb5b
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov edx, dword [ebx + 0x38]
add edx, eax
push edx
call fcn.005f98fc
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x60398c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004a0004
cmp byte [ebp - 5], 0
je 0x6039be
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 4]
call fcn.004044bc
jmp 0x6039d1
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop ecx
pop ecx
pop ebp
ret
Function at 0x603c6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406348
xor eax, eax
push ebp
push 0x603e03
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 5
mov eax, 0x3d
call fcn.004035c0
mov edx, 0x603e1c
mov al, byte [edx + eax*2]
mov byte [ebp - 0xe], al
mov eax, 0x3d
call fcn.004035c0
mov edx, 0x603e1c
mov al, byte [edx + eax*2]
mov byte [ebp - 0xf], al
mov eax, 0x3d
call fcn.004035c0
mov edx, 0x603e1c
mov al, byte [edx + eax*2]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xe]
add al, byte [ebp - 0xf]
add al, byte [ebp - 0x10]
mov byte [ebp - 0x11], al
xor eax, eax
mov al, byte [ebp - 0x11]
and eax, 0x1f
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x603cfb
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x603d12
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x603d47
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
lea eax, [ebp - 4]
call fcn.004063d0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov cl, byte [ecx + ebx - 1]
xor cl, byte [ebp - 0x11]
mov byte [eax + edx - 1], cl
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x603d23
lea eax, [ebp - 0x28]
mov dl, byte [ebp - 0xd]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00403a70
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0xe]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00403a40
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
call fcn.00403a70
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0xf]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x34]
mov cl, 3
call fcn.00403a40
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
call fcn.00403a70
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0x10]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x3c]
mov cl, 4
call fcn.00403a40
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x24]
mov ecx, 0
call fcn.00405ef0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.00406058
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x11]
mov byte [eax], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603e0a
lea eax, [ebp - 0x24]
call fcn.00405b98
lea eax, [ebp - 4]
call fcn.00405b98
ret