joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
or ebp, 0xffffffff
jmp 0x45d392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45d399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d388
mov eax, 1
add ebx, ebx
jne 0x45d3ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45d3bc
jne 0x45d3db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d3db
dec eax
add ebx, ebx
jne 0x45d3c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45d3a0
add ebx, ebx
jne 0x45d3d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45d42d
xor ecx, ecx
sub eax, 3
jb 0x45d3f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45d462
sar eax, 1
mov ebp, eax
jmp 0x45d3fe
add ebx, ebx
jne 0x45d3fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d3cc
inc ecx
add ebx, ebx
jne 0x45d40c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d3cc
add ebx, ebx
jne 0x45d419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45d40e
jne 0x45d42a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d40e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45d44c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45d43e
jmp 0x45d38e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45d44c
add edi, ecx
jmp 0x45d38e
pop esi
mov edi, esi
mov ecx, 0x1774
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45d46a
cmp byte [edi], 0xe
jne 0x45d46a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45d46f
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45d4e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5e064]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5e154]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45d49c
mov ecx, edi
jns 0x45d4cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5e158]
or eax, eax
je 0x45d4e1
mov dword [ebx], eax
add ebx, 4
jmp 0x45d4b9
call dword [esi + 0x5e168]
mov ebp, dword [esi + 0x5e15c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45d51b
sub esp, 0xffffff80
jmp 0x420583
Function at 0x64efa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x694d66
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6ade70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x64f00b
mov dword [ebp - 4], 0
lea edx, [esi + 8]
xor al, al
xchg byte [edx], al
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x64efec
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x64eff9
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x10
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0067f038
add esp, 8
mov ebx, dword [edi + 4]
mov dword [edi + 8], 0
test ebx, ebx
je 0x64f02a
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [fcn.00698fa0]
mov ecx, ebx
call esi
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x64f043
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [fcn.00698fa0]
mov ecx, ebx
call esi
push dword [edi + 0xc]
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [edi + 0x18], 0xffffffe8
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xffffffe8
mov dword [edi + 0x28], 0xffffffe8
mov dword [edi + 0x2c], 0xffffffe8
mov dword [edi + 0x30], 0xffffffe8
mov dword [edi + 0x34], 0xffffffe8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret

Function at 0x6518e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0x7c380585
mov dword [ebp - 0x24], 0xcfcb6b51
mov dword [ebp - 0x20], 0xb4059b4e
mov dword [ebp - 0x1c], 0x13d0a148
movups xmm0, xmmword [ebp - 0x28]
mov dword [ebp - 0x18], 0x77754f43
mov dword [ebp - 0x14], 0x8b4fadac
movups xmmword [eax], xmm0
mov dword [ebp - 0x10], 0x3057366e
mov dword [ebp - 0xc], 0xb54ce978
movups xmm0, xmmword [ebp - 0x18]
mov dword [ebp - 8], 0x58734ff3
mov ecx, dword [ebp - 8]
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 0x20], ecx
mov word [ebp - 4], 0x5648
mov cx, word [ebp - 4]
mov word [eax + 0x24], cx
mov esp, ebp
pop ebp
ret
Function at 0x656840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69565c
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x6ade70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x65687e
lea eax, [ecx - 7]
jmp 0x656a40
mov edi, dword [ebp + 0xc]
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0
push eax
push edi
push ecx
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile_1]
test eax, eax
je 0x6568bd
cmp dword [ebp - 0xe4], edi
jne 0x6568b6
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
jmp 0x656a40
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov esi, eax
cmp esi, 0xe9
ja 0x6568f9
je case.0x6568de.109
cmp esi, 0xe8
ja case.0x6568de.1
movzx eax, byte [esi + 0x656a74]
jmp dword [eax*4 + 0x656a60]
mov eax, 0xfffffff2
jmp 0x656a40
mov eax, 0xffffffe7
jmp 0x656a40
sub eax, 0x3e5
je case.0x6568de.0
sub eax, 0x313
je case.0x6568de.8
sub eax, 0x20
je case.0x6568de.8
push 0x6a920c
lea ecx, [ebp - 0x124]
call fcn.00660720
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0
call fcn.006606c0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push ecx
lea ecx, [ebp - 0x88]
call fcn.00657560
mov ecx, eax
call fcn.00657490
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
push ecx
lea ecx, [ebp - 0xe0]
call fcn.00657420
mov ecx, eax
call fcn.00657000
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x104]
call fcn.0064eb90
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0xf4]
call fcn.00660000
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x6569a8
mov esi, dword [esi]
push ecx
mov ecx, dword [0x6b04b4]
push 0
push 0xbc
push esi
push dword [eax + 4]
call fcn.0066fda0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], 0x6a48b8
test eax, eax
je 0x6569dc
push eax
call fcn.00684583
add esp, 4
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], 0x6a48b8
test eax, eax
je 0x6569f9
push eax
call fcn.00684583
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00650140
lea ecx, [ebp - 0x28]
call fcn.00650140
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x656a1c
push eax
call fcn.00684583
add esp, 4
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x656a2f
push eax
call fcn.00684583
add esp, 4
or eax, 0xffffffff
jmp 0x656a40
mov eax, 0xfffffff6
jmp 0x656a40
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret 8
Function at 0x65a910
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695a09
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6ade70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [0x6ae7cc]
mov esi, eax
mov dword [edi + 4], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
mov ecx, edi
push 0
mov dword [edi], 0x6a48c0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00651390
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
test esi, esi
je 0x65aa3b
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
jle 0x65aa34
push dword [esi + ebx*4]
lea ecx, [ebp - 0x34]
call fcn.00660750
mov dword [ebp - 4], 2
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], ecx
jne 0x65a9fc
shr ecx, 1
lea edx, [ebp - 0x1c]
cmp ecx, 0xa
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xa
cmovae eax, edx
mov ecx, edi
mov esi, dword [eax]
mov eax, dword [edi]
call dword [eax + 8]
mov edx, dword [edi]
add eax, esi
push eax
mov ecx, edi
call dword [edx + 4]
mov esi, dword [ebp - 0x20]
mov ecx, dword [edi + 4]
shl ecx, 4
add ecx, dword [edi + 8]
je 0x65aa10
lea eax, [ebp - 0x34]
push eax
call fcn.0065fe80
inc dword [edi + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], 0x6a48b8
test eax, eax
je 0x65aa2e
push eax
call fcn.00684583
add esp, 4
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x65a9b4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65fb20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp dword [0x6ae7e0], 0
push ebx
push esi
push edi
je 0x65fb69
push 0
push 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
xorps xmm0, xmm0
push eax
push 0
movups xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread_1]
push eax
call dword [0x6ae7e0]
mov ecx, dword [esp + 0x20]
jmp 0x65fb70
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x65fc58
mov eax, dword [ecx + 8]
mov dword [0x6b01ec], eax
mov eax, dword [ecx + 4]
cmp byte [0x6b01e8], 0
mov dword [0x6b01f0], eax
lea eax, [ebp + 4]
mov dword [0x6b01f4], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
mov dword [0x6b01f8], eax
jne 0x65fbb2
push 1
call dword [0x6ae7d4]
mov byte [0x6b01e8], 1
call dword [0x6ae7d0]
push 0
push 0x3e8
push dword [0x6b03a4]
mov esi, eax
mov dword [esp + 0x20], 0
push dword [0x6b03a0]
call fcn.006946b0
push edx
push eax
push esi
push 0
call fcn.006946b0
mov edi, dword [0x6b01f4]
xor ecx, ecx
mov edx, dword [0x6b01ec]
mov ebx, edi
sub ebx, edx
xor esi, esi
inc ebx
shr ebx, 1
cmp edx, edi
cmova ebx, ecx
test ebx, ebx
je 0x65fc20
imul eax, eax, 0x19660d
lea edx, [edx + 2]
inc esi
add eax, 0x3c6ef35f
mov ecx, eax
shr ecx, 8
mov word [edx - 2], cx
cmp esi, ebx
jb 0x65fc04
mov edx, dword [0x6b01f0]
add edx, 0xfffffffe
cmp edx, edi
jb 0x65fc4a
nop dword [eax]
imul eax, eax, 0x19660d
add eax, 0x3c6ef35f
mov ecx, eax
shr ecx, 8
mov word [edx], cx
sub edx, 2
cmp edx, edi
jae 0x65fc30
mov eax, dword [0x6b01f8]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId_1]
push 0x28
mov esi, eax
call fcn.0067f000
mov edi, eax
xorps xmm0, xmm0
add esp, 4
mov dword [esp + 0x10], edi
mov dword [edi + 4], esi
mov dword [edi + 8], 0x6a48b8
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], 0x6a8ee0
movups xmmword [edi + 0x18], xmm0
mov esi, dword [edi + 0x18]
test esi, esi
jne 0x65fcb5
push dword [edi + 4]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x65fccb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess_1]
cmp dword [edi + 0x18], 0
jne 0x65fccb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x662e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x6ade70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
mov edx, dword [edi]
setne al
test al, al
je 0x662fbc
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x40
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x144], 0
push eax
call dword [edx + 0x30]
cmp dword [ebp - 0x148], 0x40
jne 0x662fbc
cmp dword [ebp - 0x144], 0
jne 0x662fbc
mov ax, word [ebp - 0x48]
mov ecx, 0x454e
cmp ax, cx
je 0x662fa7
mov ecx, 0x454c
cmp ax, cx
je 0x662fa7
mov ecx, 0x5a4d
cmp ax, cx
je 0x662f13
mov eax, 0xfffffffc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov esi, dword [edi]
push 0
cdq
push edx
push eax
call dword [esi + 0x1c]
mov eax, dword [edi]
lea ecx, [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x148], 0xf8
push ecx
mov ecx, edi
mov dword [ebp - 0x144], 0
call dword [eax + 0x30]
cmp dword [ebp - 0x148], 0xf8
jne 0x662fbc
cmp dword [ebp - 0x144], 0
jne 0x662fbc
cmp dword [ebp - 0x140], 0x4550
jne 0x662efe
mov ax, word [ebp - 0x128]
mov ecx, 0x10b
cmp ax, cx
je 0x662f95
mov ecx, 0x20b
cmp ax, cx
je 0x662f95
mov ecx, 0x107
cmp ax, cx
jne 0x662efe
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffff7
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffff5
pop edi
xor ecx, ebp
pop esi
call fcn.0067efea
mov esp, ebp
pop ebp
ret
Function at 0x668ae0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
or eax, ecx
test al, 3
je 0x668b02
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x10]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x668bb6
mov eax, edi
lea ebx, [ecx + 4]
sub eax, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
nop dword [eax]
mov esi, dword [ebx - 4]
mov eax, 0xc6ef3720
mov edi, dword [ebx]
mov dword [ebp - 4], 0x20
mov ebx, dword [ebp + 0x14]
mov edx, esi
shr edx, 5
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
xor edx, ecx
sub esi, edx
sub dword [ebp - 4], 1
jne 0x668b41
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov dword [eax + ecx*8], esi
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [eax + ebx], edi
add ebx, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], ebx
cmp ecx, eax
jb 0x668b30
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea esi, [eax*8]
cmp ebx, esi
jbe 0x668be7
push ecx
push dword [ebp + 0x14]
lea eax, [esi + ecx]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00668c00
mov ecx, ebx
lea eax, [ebp - 0x18]
sub ecx, esi
push ecx
push eax
lea ecx, [esi + edi]
push ecx
call fcn.00681610
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x668c00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov eax, 0xc6ef3720
mov dword [ebp - 4], 0x20
nop dword [eax + eax]
mov ebx, dword [ebp + 0x10]
mov edx, esi
shr edx, 5
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
xor edx, ecx
sub esi, edx
sub dword [ebp - 4], 1
jne 0x668c20
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x66b7d0
Capabilities:
Hash data using sha256

Disassembly:
push 0x40
lea eax, [ecx + 0x20]
mov dword [ecx + 0x14], 0
push 0
push eax
mov dword [ecx + 0x124], 0x6a09e667
mov dword [ecx + 0x128], 0xbb67ae85
mov dword [ecx + 0x12c], 0x3c6ef372
mov dword [ecx + 0x130], 0xa54ff53a
mov dword [ecx + 0x134], 0x510e527f
mov dword [ecx + 0x138], 0x9b05688c
mov dword [ecx + 0x13c], 0x1f83d9ab
mov dword [ecx + 0x140], 0x5be0cd19
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x120], 0
call fcn.00681c40
add esp, 0xc
ret 4

Function at 0x6745e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x674620]
jmp dword [eax*4 + 0x674610]

Function at 0x6757d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ade70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x675825
mov eax, dword [edi + 0xc]
push ebx
push ebx
inc eax
push eax
push ecx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar_1]
mov esi, eax
lea eax, [esi + esi]
call fcn.0067f670
mov eax, dword [edi + 0xc]
mov ebx, esp
push esi
push ebx
inc eax
push eax
push dword [edi + 4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar_1]
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW_1]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
cmp ebx, 0xffffffff
jne 0x675866
mov ecx, eax
call fcn.00670980
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0
push eax
push dword [ebp + 0xc]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov dword [ebp - 8], eax
cmp esi, dword [ebp - 0x10]
jne 0x675899
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
jne 0x675899
mov ecx, 1
jmp 0x67589b
xor ecx, ecx
and edi, ecx
je 0x6758b2
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile_1]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov esi, eax
jmp 0x6758b5
mov esi, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
test edi, edi
jne 0x6758db
mov ecx, esi
call fcn.00670980
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret
Function at 0x68c7bb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0068c63a

Function at 0x68fafb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0068f7a9
Function at 0x401ce5
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
call fcn.0055b410
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
push 0x80001
push 0
push ebx
push 1
mov eax, 7
mov ebx, 0x675510
call fcn.0055b42e
add esp, 0x10
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0x80000301
push 0
push 1
push 2
mov eax, 7
mov ebx, 0x6754f0
call fcn.0055b42e
add esp, 0x1c
push 0
push 0
push 0
push 0x80000301
push 0
push 0
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_bind
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x690720
push 0x80001
push 0
push dword [ebp - 4]
push 6
mov eax, 7
mov ebx, 0x675500
call fcn.0055b42e
add esp, 0x4c
mov ebx, eax
test ebx, ebx
je 0x401db8
push ebx
call fcn.0055b416
add esp, 4
push 0
push 0
push 0
push 0x80000301
push 0
push 0
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_bind
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x70bb12
push 0x80001
push 0
push dword [ebp - 4]
push 6
mov eax, 7
mov ebx, 0x675500
call fcn.0055b42e
add esp, 0x4c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401e26
push ebx
call fcn.0055b416
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
mov eax, 7
mov ebx, 0x6754e0
call fcn.0055b42e
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x401e5d
push eax
mov ebx, eax
call fcn.0040153d
inc eax
push eax
call fcn.0055b410
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x401e62
push eax
mov ebx, dword [ebp - 4]
push ebx
push 0x80001
push 0
push ebx
push 1
mov eax, 7
mov ebx, 0x675520
call fcn.0055b42e
add esp, 0x10
call fcn.0055b416
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401e9b
push ebx
call fcn.0055b416
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40b4d5
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
call fcn.0055b410
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
push 0x80001
push 0
push ebx
push 1
mov eax, 7
mov ebx, 0x675510
call fcn.0055b42e
add esp, 0x10
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0x80000301
push 0
push 1
push 2
mov eax, 7
mov ebx, 0x6754f0
call fcn.0055b42e
add esp, 0x1c
push 0
push 0
push 0
push 0x80000301
push 0
push 0
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_bind
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x690720
push 0x80001
push 0
push dword [ebp - 4]
push 6
mov eax, 7
mov ebx, 0x675500
call fcn.0055b42e
add esp, 0x4c
mov ebx, eax
test ebx, ebx
je 0x40b5a8
push ebx
call fcn.0055b416
add esp, 4
push 0
push 0
push 0
push 0x80000301
push 0
push 0
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_bind
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x70bb12
push 0x80001
push 0
push dword [ebp - 4]
push 6
mov eax, 7
mov ebx, 0x675500
call fcn.0055b42e
add esp, 0x4c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40b616
push ebx
call fcn.0055b416
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
mov eax, 7
mov ebx, 0x6754e0
call fcn.0055b42e
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x40b64d
push eax
mov ebx, eax
call fcn.0040153d
inc eax
push eax
call fcn.0055b410
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40b652
push eax
mov ebx, dword [ebp - 4]
push ebx
push 0x80001
push 0
push ebx
push 1
mov eax, 7
mov ebx, 0x675520
call fcn.0055b42e
add esp, 0x10
call fcn.0055b416
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40b68b
push ebx
call fcn.0055b416
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret