joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62f430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax - 1]
mov edi, edx
dec edi
test di, di
jb 0x62f4b6
inc edi
xor esi, esi
movzx eax, si
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx eax, byte [edx + eax]
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
xor al, bl
mov byte [ebp - 6], al
movzx edx, byte [ebp - 6]
movzx eax, byte [ebp - 5]
call fcn.0062f2b4
mov edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax - 8]
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
mov eax, dword [ebp + 8]
inc dword [eax - 8]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0xf000
jl 0x62f4a1
mov bl, 0x80
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 8], edx
movzx eax, si
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx ecx, byte [ebp - 6]
mov byte [edx + eax], cl
inc esi
dec di
jne 0x62f44e
mov eax, dword [ebp + 8]
mov byte [eax - 1], bl
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x62ff9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x62ffe8
cmp dword [ebp - 4], 0
jle 0x630051
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbd98
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b7e0c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63005c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x6300c6
cmp dword [ebp - 4], 0
jle 0x63012f
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b7e0c
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbd98
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x63014c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0xc]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0xe]
mov byte [esi], al
inc dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 4
jne 0x630195
cmp dword [ebp - 4], 0
jle 0x630203
mov eax, dword [ebp - 8]
call fcn.004b7dec
push edx
push eax
mov eax, dword [ebp - 4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004b7e0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63020c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x630258
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 4], 0
jle 0x6302c5
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbd98
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6302d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov bl, 0x80
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x630339
cmp dword [ebp - 4], 0
jle 0x630396
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbd98
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6303a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x6303ec
cmp dword [ebp - 4], 0
jle 0x630457
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0062f4c4
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b7e0c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x630464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b7e0c
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x6304da
cmp dword [ebp - 4], 0
jle 0x630545
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b7e0c
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0062f4c4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x630550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63059c
cmp dword [ebp - 4], 0
jle 0x630648
call fcn.00433d70
push eax
push 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x498ccc]
call fcn.004bcea8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x630641
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.004bbd98
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004bd138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630650
mov eax, dword [ebp - 0x18]
call fcn.00408650
ret
mov eax, dword [ebp - 0xc]
call fcn.0040a310
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x630658
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040a3f4
xor eax, eax
push ebp
push 0x63076e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0x13], al
call fcn.00433d70
mov edx, dword [ebp - 8]
call fcn.00432e24
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x6306e3
call fcn.00433d70
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.0043334c
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004b80dc
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630775
lea eax, [ebp - 0x18]
mov edx, dword [0x41f6b8]
call fcn.0040cbb0
lea eax, [ebp - 8]
call fcn.0040a310
ret

Function at 0x6307d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0xc]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0xe]
mov byte [esi], al
inc dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 4
jne 0x63081d
cmp dword [ebp - 4], 0
jle 0x63088b
mov eax, dword [ebp - 8]
call fcn.004b7dec
push edx
push eax
mov eax, dword [ebp - 4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004b7e0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x630894
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x6308e0
cmp dword [ebp - 4], 0
jle 0x63098e
call fcn.00433d70
push eax
push 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x498ccc]
call fcn.004bcea8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x630987
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.0062f4c4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004bd138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630996
mov eax, dword [ebp - 0x18]
call fcn.00408650
ret
mov eax, dword [ebp - 0xc]
call fcn.0040a310
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6309a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040a3f4
xor eax, eax
push ebp
push 0x630aef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0x13], al
call fcn.00433d70
mov edx, dword [ebp - 8]
call fcn.00432e24
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x630a26
cmp dword [ebp - 4], 0
jle 0x630ad6
call fcn.00433d70
push eax
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x498ccc]
call fcn.004bcea8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x630acf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004b7e0c
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0062f4c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630ad6
mov eax, dword [ebp - 0x18]
call fcn.00408650
ret
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630af6
lea eax, [ebp - 8]
call fcn.0040a310
ret
Function at 0x630b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0xf], al
lea edx, [ebp - 0xf]
mov ecx, 1
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov dword [ebp - 4], ebx
mov eax, pe_nt_image_headers32
call fcn.00406a00
mov byte [ebp - 0xf], al
mov bl, 0x80
movzx eax, byte [ebp - 0xf]
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0xe]
mov ecx, 1
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0062f2b4
mov edx, eax
movzx ecx, byte [ebp - 0xc]
inc ecx
mov eax, ebx
call fcn.0062f2c8
mov ebx, eax
lea edx, [ebp - 0xe]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 4
jne 0x630b7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x630bec
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
xor ebx, ebx
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 6
jne 0x630c44
mov eax, dword [esp + 8]
test eax, eax
jne 0x630c29
mov edx, dword [esp + 0xc]
cmp edx, 0x1770
jne 0x630c1f
mov bl, 1
cmp edx, 0x1770
jbe 0x630c29
mov bl, 1
cmp eax, 1
jne 0x630c44
mov eax, dword [esp + 0xc]
cmp eax, 0x1db0
jne 0x630c3b
mov bl, 1
cmp eax, 0x1db0
jbe 0x630c44
mov bl, 1
mov eax, ebx
add esp, 0x114
pop ebx
ret
Function at 0x63f110
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
mov edx, 0x63f188
call fcn.0040a6f0
call sub.kernel32.dll_GetSystemDefaultUILanguage_1
and eax, 0xff
movzx eax, ax
sub eax, 1
jb 0x63f142
sub eax, 6
je 0x63f15e
sub eax, 2
je 0x63f150
sub eax, 0x10
je 0x63f16c
jmp 0x63f178
mov eax, ebx
mov edx, 0x63f188
call fcn.0040a6f0
pop ebx
ret
mov eax, ebx
mov edx, 0x63f188
call fcn.0040a6f0
pop ebx
ret
mov eax, ebx
mov edx, 0x63f1a4
call fcn.0040a6f0
pop ebx
ret
mov eax, ebx
mov edx, 0x63f1c0
call fcn.0040a6f0
pop ebx
ret

Function at 0x642048
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00407604
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x64273c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x64276d
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040b494
jmp 0x642774
mov eax, ebx
call fcn.0040a310
add esp, 0x204
pop ebx
ret

Function at 0x6428dc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x642951
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040b56c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b3d8
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x642934
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b7b4
jmp 0x64293b
mov eax, ebx
call fcn.0040a310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642958
lea eax, [ebp - 4]
call fcn.0040a310
ret