joyce8/EMBER2024-capa huggingface dataset:
Function at 0x655ff4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x16c]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00655e24
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x198], bl
je 0x656071
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x174]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
push ecx
call fcn.0069e2d4
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x6560ae
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x170
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x656083
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00656184
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x198], bl
je 0x65616d
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x194]
inc edi
cmp edi, ecx
jne 0x6560f9
xor edi, edi
cmp dword [eax + 0x1ac], ebx
je 0x656149
lea ebx, [eax + 0x138]
mov ecx, ebx
call fcn.00651cf9
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1ac]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x174]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.0069e344
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x6625be
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1006cb07
call fcn.0069e8bc
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a64
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x10072a5c
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.0063e928
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x664ca8
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1006d188
call fcn.0069e8bc
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x100717e0
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x10072a7c
push 4
mov ebx, 0x10071594
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00645b7d
mov dword [esi + 0x3c], 0x10072bd8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00645b7d
mov dword [edi], 0x10072be0
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0066109a
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.00663c9c
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0066109a
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.00663c9c
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0066109a
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.00663c9c
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0066109a
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.00663c9c
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.00663c9c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x6727d9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006e3e7
call fcn.0069e8bc
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a6c
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 1
mov dword [esi + 0x20], 0x10072d40
lea ecx, [esi + 0x38]
mov byte [esi + 0x34], bl
push 3
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.006404f1
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x681adc
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006f9e3
call fcn.0069e8bc
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0063e8c2
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0063e8c2
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0063e8c2
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0063e8c2
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0063e8c2
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.0063e8c2
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.0063e8c2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x684740
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006ffbe
call fcn.0069e8bc
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esi], al
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
call fcn.0063e8c2
and dword [ebp - 4], 0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.006847b7
and dword [esi + 0x30], 0
and dword [esi + 0x34], 0
lea ecx, [esi + 0x2c]
lea eax, [edi + 0x2c]
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x10071944
call fcn.00662c6f
mov al, byte [edi + 0x38]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x38], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x689ed4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x689f1b
mov ecx, ebx
call fcn.0068a694
mov eax, dword [esp + 0x50]
push esi
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.0068aea4
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.0068af44
jmp 0x689f37
test esi, esi
jbe 0x689f37
mov ecx, esi
mov esi, dword [esp + 0x50]
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x689f39
mov ecx, ebx
call fcn.0068a694
lea eax, [esp + 0xc]
push 0x40
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.0068aea4
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x689f68
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.0068a694
lea ecx, [esp + 0xc]
push 0x40
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.0068aea4
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x68a004
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xbc
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xd0]
cmp edi, 0x40
jbe 0x68a08c
lea ecx, [esp + 0x60]
call fcn.0068a694
mov eax, dword [esp + 0xcc]
push edi
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x88], 0
call fcn.0068aea4
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x64]
call fcn.0068af44
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dh, byte [esp + eax + 0xc]
mov cl, byte [esp + eax + 0xe]
mov dl, byte [esp + eax + 0xd]
add eax, 4
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + eax + 0xb]
shl edx, 8
or edx, ecx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], edx
jb 0x68a05e
jmp 0x68a0c5
xor eax, eax
test edi, edi
jbe 0x68a0c5
push ebp
mov ebp, dword [esp + 0xd0]
mov edx, eax
mov ecx, 3
shr edx, 2
lea esi, [esp + edx*4 + 0x24]
mov edx, eax
and edx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x68a09a
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x68a0ce
mov ecx, ebx
call fcn.0068a694
lea eax, [esp + 0x20]
push 0x10
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.0068b054
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x68a104
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.0068a694
lea ecx, [esp + 0x20]
push 0x10
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.0068b054
pop edi
pop esi
pop ebx
add esp, 0xbc
ret 8

Function at 0x68a194
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 5
mov ebp, ecx
push eax
call fcn.0068ae34
lea edx, [esp + 0x50]
push 5
lea ecx, [ebp + 0x68]
push edx
call fcn.0068ae34
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, 5
mov esi, ebx
lea edi, [esp + 0x10]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x68a21e
mov esi, eax
lea eax, [esp + 0x50]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.0068a6c4
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x54]
push edx
push eax
lea ecx, [ebp + 0x68]
call fcn.0068a6c4
lea ecx, [esp + 0x10]
mov eax, ebx
sub ecx, ebx
mov edx, 5
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x68a210
dec esi
jne 0x68a1dc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8

Function at 0x68a694
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x68b56e
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx + 0xc]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
xor eax, edx
mov edx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
and eax, esi
add eax, dword [ecx + 0x10]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 0x10], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
pop esi
xor eax, edx
mov dword [ecx + 0x14], eax
ret 4

Function at 0x68b7be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
movzx eax, byte [ebp + 0xc]
push esi
push 0x40
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0069edc4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
add esp, 0xc
xor esi, esi
sub ecx, eax
lea eax, [ebp + esi - 0x40]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
cmp esi, 0x14
jb 0x68b7e5
lea ecx, [ebp - 0xa8]
call fcn.0068a694
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x40]
push 0x40
push eax
lea ecx, [ebp - 0xa8]
call fcn.0068aea4
push dword [ebp + 0x10]
lea ecx, [ebp - 0xa8]
call fcn.0068af44
pop esi
leave
ret 0xc

Function at 0x68bd44
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test edx, edx
jbe 0x68bd8f
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
xor ecx, ecx
mov cl, byte [esi]
and ebx, 0xff
xor ebx, ecx
mov ecx, 8
call fcn.0069ea94
mov ecx, dword [ebx*8 + 0x1008cd00]
xor ecx, eax
mov ebx, dword [ebx*8 + 0x1008cd04]
mov eax, ecx
xor ebx, edx
inc esi
dec edi
mov edx, ebx
jne 0x68bd57
pop edi
pop ebx
pop esi
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
ret 8

Function at 0x690f44
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
push esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x20], edi
call fcn.00690f94
xor edx, edx
add esi, 0x70
mov eax, edx
mov ecx, 8
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0x690f67
mov dword [esi], eax
inc edx
add esi, 4
cmp edx, 0x100
jb 0x690f60
pop edi
pop esi
ret 4

Function at 0x696be4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0xc]
xor eax, eax
or ecx, edx
cmp ecx, 1
je 0x696c30
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x10]
mov edx, ecx
and ecx, 1
shr edx, 1
xor ebx, ebx
mov bx, word [edi + edx*2]
neg ecx
sar ecx, 4
shr ebx, 4
and ecx, 0x7f
xor ebx, ecx
mov ecx, dword [esi + ebx*4]
add eax, ecx
mov ecx, edx
cmp ecx, 1
jne 0x696c07
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x696c84
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov edx, 1
test edi, edi
je 0x696cce
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov ecx, esi
xor ebx, ebx
and ecx, 1
mov bx, word [ebp + edx*2]
mov ebp, ecx
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
add edx, edx
xor ebx, ebp
mov ebp, dword [esp + 0x20]
shr esi, 1
add eax, dword [ebp + ebx*4]
or edx, ecx
dec edi
jne 0x696c9b
pop esi
pop ebp
pop ebx
pop edi
ret 0x10

Function at 0x697a74
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, 0x100
or esi, edi
mov eax, esi
mov ecx, edi
shr eax, 7
and eax, 1
mov edx, esi
shl ebx, 1
push eax
and ecx, ebx
mov eax, edi
shr edx, 8
add eax, ecx
add edx, eax
lea ecx, [ebp + edx*2]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.006979c4
shl esi, 1
mov eax, esi
xor eax, ebx
not eax
and edi, eax
cmp esi, 0x10000
jb 0x697a8b
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x698fe4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
or ch, 1
mov edi, ecx
xor ebx, ebx
shr edi, 8
mov bx, word [esi + edi*2]
mov edi, ecx
shr edi, 7
and edi, 1
neg edi
sar edi, 4
shr ebx, 4
and edi, 0x7f
xor ebx, edi
shl ecx, 1
mov edi, dword [edx + ebx*4]
add eax, edi
cmp ecx, 0x10000
jb 0x698ff8
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x699034
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edx, 0x100
or ch, 1
shl esi, 1
mov edi, edx
mov ebx, ecx
and edi, esi
mov ebp, edx
shr ebx, 8
add ebp, edi
xor edi, edi
add ebx, ebp
mov ebp, dword [esp + 0x14]
mov di, word [ebp + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [esp + 0x20]
shl ecx, 1
mov ebp, dword [ebx + edi*4]
mov edi, ecx
xor edi, esi
add eax, ebp
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x69904a
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x69d914
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x50]
mov ecx, eax
imul ecx, dword [esp + 0xc]
add edx, ecx
mov dword [esi + 0x50], edx
mov edx, dword [esi + 0x4c]
sub edx, ecx
imul eax, dword [esp + 0x10]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x69d960
cmp ecx, 0x8000
jae 0x69d98a
neg eax
and eax, 0x7fff
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x54]
push eax
call dword [eax]
mov ecx, dword [esi + 0x4c]
and eax, 0xff
shl ecx, 8
or eax, ecx
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x50]
shl ecx, 8
shl eax, 8
mov dword [esi + 0x48], ecx
mov dword [esi + 0x50], eax
jmp 0x69d93b
pop esi
ret 0xc

Function at 0x69ddd4
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
ret 4

Function at 0x69e2e4
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0069eab3
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.0069e254
ret 0xc
Function at 0x4738b3
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4735cc
add edx, 0xe92e1caf
and edx, edi
sub edx, edx
call fcn.004738ff
mov edi, edi
push edi
mov edi, dword [esp]
add esp, 4
add edi, edi
xor dword [eax], ebx
sub edi, 0x8ea0fb6
dec edx
add eax, 2
add edi, 0x4e08ecb3
push 0x9eebf1e9
mov edx, dword [esp]
add esp, 4
and edi, edi
cmp eax, ecx
jl fcn.004738b3
inc edi
ret
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40633c
pop dword [ebp - 0x34]
mov eax, 0x2e5ad7a1
add eax, 0xd1e58b9b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x87c72d71
sub dword [ebp - 0x44], 0x3974e826
mov dword [ebp - 0x40], 0x4cd44957
add dword [ebp - 0x40], 0xe55f02ee
mov dword [ebp - 0x3c], 0x346f2293
add dword [ebp - 0x3c], 0x17dd219b
mov dword [ebp - 0x38], 0x4dc405f2
add dword [ebp - 0x38], 0xb23bfa0e
lea eax, [ebp - 0x44]
push eax
mov eax, 0x77e1c7d2
sub eax, 0x77a15772
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x969e27dd
sub dword [ebp - 0x44], 0x222bbe87
mov dword [ebp - 0x40], 0x214b96f0
sub dword [ebp - 0x40], 0xdfdf357b
mov dword [ebp - 0x3c], 0x2c16f399
add dword [ebp - 0x3c], 0x375878d3
mov dword [ebp - 0x38], 0x88a0067d
sub dword [ebp - 0x38], 0x88a0067d
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x29928bcd
sub eax, 0x29521acd
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36f81
push 0
call eax
mov ecx, 0xa151e684
add ecx, 0x5eae62e3
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x34]
mov esi, 0xa9224457
add dword [ebp - 0x24], ebx
mov ebx, dword [edi]
xor dword [ebp - 4], 0xfaf45bda
xor ebx, esi
sub dword [ebp - 0x28], 0x9bef0dbb
mov dword [edx], ebx
add dword [ebp - 0xc], esi
add edx, 0x7006cd26
add edx, 0x8ff932de
add edi, 4
loop 0x406452
add eax, 0x1186f
xor ebx, ebx
add ebx, eax
add eax, 0x6f368497
add eax, 0x90c97b6e
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x64a198
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64a2ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x59c3e0]
call fcn.0059c938
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], ebx
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0064a790
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.0040b45c
mov eax, dword [ebp - 4]
push eax
push 0x649120
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov eax, dword [ebp - 4]
push eax
push 0x64924c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 4]
push eax
push 0x649388
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x34]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [0x67754c]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00429ba4
test al, al
je 0x64a2b6
xor eax, eax
push ebp
push 0x64a2a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
call fcn.0044c13c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a2a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00429c5c
ret
mov ecx, 0x64a304
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.004279f0
call fcn.00406f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a2f1
lea eax, [ebp - 0x10]
call fcn.004078a4
lea eax, [ebp - 0xc]
call fcn.0040b444
ret

Function at 0x64afbc
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret